Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber. Show all posts
Phishing scam
AI scam Cyber Cyber Fraud Fraud Gmail Hack Google security Phishing scam

Gmail Confirms AI Hack: 2.5 Billion Users Warned of Phishing Scam

 

  
Gmail has issued a warning to its 2.5 billion users about a sophisticated AI-powered phishing attack. Fraudsters are using caller IDs that seem to originate from Google support, convincing users that their accounts have been compromised. Under the pretense of an account recovery process, they send an email with a recovery code that appears to come from a genuine Gmail address, Forbes reports.

Zach Latta, founder of Hack Club, noticed irregularities during an interaction with a so-called Google support agent. "She sounded like a real engineer, the connection was super clear, and she had an American accent," Latta told Forbes. Despite the convincing approach, the scam's goal is to deceive users into providing their login credentials, allowing cybercriminals to take control of their accounts.

Spencer Starkey, Vice President at SonicWall, emphasized the evolving nature of cyber threats: "Cybercriminals are constantly developing new tactics, techniques, and procedures to exploit vulnerabilities and bypass security controls, and companies must be able to quickly adapt and respond to these threats." He advised businesses to adopt a proactive cybersecurity approach, including regular security assessments and incident response planning.

Users Report Similar Fraud Attempts

According to the New York Post, Y Combinator founder Garry Tan shared his experience on X (formerly Twitter) after receiving phishing emails and phone calls.

"They claim to be checking that you are alive and that they should disregard a death certificate filed that claims a family member is recovering your account," Tan wrote, calling it an elaborate scheme to manipulate users into approving password recovery.

Microsoft solutions consultant Sam Mitrovic also encountered this scam months ago. Initially, he ignored the recovery notification and follow-up call, but when it happened again, he decided to answer.

"It's an American voice, very polite and professional. The number is Australian," Mitrovic recalled. He even verified the number on an official Google support page, making the deception more convincing. 

The caller alleged there was suspicious activity on his account and asked if he had logged in from Germany. When he denied it, the agent claimed someone had been accessing his account for a week and offered to help secure it. Mitrovic realized something was off when he spotted a suspicious email address in the follow-up message and stopped responding.

Forbes advises Gmail users to remain calm and immediately disconnect any call from so-called Google support, as Google does not contact users via phone. Instead, users should verify account activity themselves:
  • Use Google Search to check official security support pages.
  • Log into Gmail and navigate to the bottom right corner to review recent account activity.
  • Avoid sharing recovery codes with anyone over the phone.
With cyber threats evolving rapidly, vigilance is key to safeguarding online accounts.

Read more »
Phantom
Cyber Data Breach data security Phantom

Phantom Domains: The New Threat to Enterprise Cybersecurity

 

A recent study presented at the 2024 Web Conference has identified a rising cybersecurity risk known as “phantom domains.” These phantom domains result from unregistered or placeholder dot-com links that hackers can hijack, turning them into dangerous attack vectors. 

Phantom domains arise in two common forms: domain errors and placeholders. Domain errors often occur when web developers misspell a domain name, leaving users vulnerable to clicking on seemingly legitimate but unregistered links. 
For instance, a fictional company, Bob’s Sports Gear, might have a typo in their web link, such as “www.bobsportsgear.com” instead of “www.bobssportsgear.com,” leading to an unregistered phantom domain. 

Hackers can buy these domains and create spoofed versions of the real site, tricking users into providing sensitive information. Placeholder domains are another form of vulnerability. Developers may leave placeholder links in websites for future projects that never materialize, leaving the unregistered domains up for grabs. 

If attackers acquire these domains, they can easily set up malicious sites that resemble legitimate ones. Research suggests that phantom domains are far from rare, with over 572,000 such domains active on the web today. 

These links can go unnoticed for long periods, creating a window of opportunity for cybercriminals to exploit users’ trust in familiar websites. Once hijacked, these links can direct users to spoofed websites designed to steal credentials or deliver malware. 

To counter this threat, experts recommend enterprises scan their websites regularly for broken or incorrect links and educate employees about the dangers of phantom domains. In addition, using credential management tools that autofill login information only for verified domains can help prevent data breaches. 

Ultimately, while phantom domains may not pose an immediate threat if detected in time, they highlight a broader cybersecurity challenge: the need for proactive monitoring and human vigilance in an increasingly digital world.
Read more »
server access
Black Suit hackers Cyber Data Breach Hacker group KADOKAWA cyberattack Ransomware Threat server access

Hackers Warn of Further Attacks on KADOKAWA, Claim Ongoing Access to Servers

 

KADOKAWA is on high alert for potential cyberattacks from the Russian hacker group Black Suit after failed negotiations aimed at resolving a previous major cyber incident. Black Suit, known for its ransomware operations, has warned of further attacks following KADOKAWA's refusal to pay an $8 million ransom (around 1.1 billion yen).

In a recent update to Kyodo News, the hackers disclosed that discussions with the company had broken down.

“We demanded $8 million, but KADOKAWA did not comply,” Black Suit stated, cautioning that the company “will face the same problem repeatedly” as they still have access to KADOKAWA’s systems.

Cybersecurity specialist Katsuji Okamoto from Trend Micro commented on the matter, stressing the severity of the threat.

“Even if this is a bluff, KADOKAWA must reassess its systems and prepare for the worst. Black Suit is notorious for their persistence and thorough execution of attacks, typically carrying them out from start to finish independently.”

KADOKAWA, however, has chosen not to disclose specific details about the incident, citing an active police investigation.

“This is a matter under police investigation, and we cannot comment,” a company spokesperson said.

The company initially reported the cyberattack in early June, noting disruptions across multiple websites and services. Since then, KADOKAWA has provided regular updates on its progress in system restoration and investigation efforts.

On June 27, 2024, Black Suit reportedly revealed the full scale of the breach, claiming they had stolen 1.5 terabytes of sensitive data, including business plans, user information, contracts, and financial records.

The group alleged they exploited vulnerabilities within KADOKAWA’s network infrastructure, gaining access to a “control center” that enabled them to encrypt the entire network, impacting subsidiaries like Dwango and NicoNico.

They threatened to release the stolen data if the ransom was not paid by July 1, 2024.

As of August 5, KADOKAWA confirmed a data leak affecting 254,241 individuals, following an investigation by third-party experts.
Read more »
Smishing Scam
Automotive Industry Cyber cyber attack IRS phishing Ransomware Smishing Scam

IRS Warns Car Dealers of New Phishing and Smishing Threats


 

The Internal Revenue Service (IRS) has issued an urgent warning to car dealers and sellers across the United States, highlighting a surge in sophisticated phishing and smishing scams targeting the automotive industry. These cyber threats pose a significant risk to the daily operations of businesses, potentially leading to severe disruptions.

The warning follows a recent ransomware attack on CDK Global, a software provider for car dealerships. This cyberattack affected approximately 15,000 dealerships nationwide, crippling their scheduling, sales, and order systems. Some dealers were forced to revert to manual processes to continue their operations. In response to the attack, CDK Global reportedly paid a $25 million ransom to regain control of their systems.

According to the IRS, scammers are increasingly impersonating the agency to extract sensitive financial and personal information. These fraudulent communications often come in the form of emails or text messages, urging recipients to click on suspicious links, download malicious files, or provide confidential details. The IRS emphasised that such tactics are a "favourite" among cybercriminals.


Recommendations for Protection

To safeguard against these scams, the IRS provided several recommendations for both businesses and individuals:

1. Stay Alert to Fake Communications: Be cautious of unsolicited messages that appear to come from legitimate organisations, friends, or family. These messages may impersonate banks or other financial entities to deceive recipients into clicking harmful links.

2. Avoid Clicking Unsolicited Links: Never click on links in unsolicited emails or text messages, as they may lead to identity theft or malware installation.

3. Verify the Sender: If you receive a suspicious message, verify its authenticity by contacting the sender through a different communication method. Do not use contact information provided in the unsolicited message.

4. Do Not Open Attachments: Avoid opening attachments in unsolicited emails, as they can contain malicious code that can infect your computer or mobile device.

5. Delete Suspicious Emails: To prevent potential harm, delete any unsolicited emails immediately.


Vigilance is Key

The IRS stressed the importance of vigilance in the face of these evolving cyber threats. By following the recommended precautions, car dealers and sellers can reduce their risk of falling victim to phishing and smishing scams. As cybercriminals continue to refine their tactics, staying informed and cautious remains crucial for protecting sensitive information and maintaining business continuity.


Read more »
ransomware incident
City Hall computer disruption City Hall cyber problems Cleveland Cyber Cyber Attacks Digital threats IT systems breach Ransomware attack ransomware incident

Cleveland Confirms Ransomware Attack Behind City Hall Cyber Issues

 

Cleveland Mayor Justin Bibb’s office informed employees today that the "cyber incident" affecting City Hall computer systems was indeed a ransomware attack.

In an email sent to workers on Friday afternoon, which Signal Cleveland obtained, the city confirmed the ransomware presence following an investigation by city IT staff, the FBI, and the Ohio National Guard’s Cyber Reserve.

"The nature of the attack is still under investigation as we work to restore and recover our systems," the email stated. "At this time, we cannot disclose anything further, as this is a sensitive investigation."

This email marked the city’s first public acknowledgment of the ransomware attack since encountering computer system issues the previous Saturday.

The email noted that ransomware attacks are increasingly common, highlighting that no organization is immune to digital threats. Neither the employee message nor a subsequent news release from the city indicated whether the ransom had been paid.

"We are taking this matter very seriously and are working diligently to assess the full extent of the attack on our systems," the email continued. "We have taken immediate steps to validate our cybersecurity measures and are working to restore our systems as quickly as possible."

City Hall will remain closed to the public on Monday, though employees are expected to report to work. The mayor's office assured that essential services—emergency response, waste collection, recreation centers, the airport, and utilities—are still operational.
Read more »
Vulnerabilities and Exploits
CVE-2024-3400 Cyber Cybersecurity Palo Alto Networks PAN-OS firewall Remote Code Execution Threat actors Volexity Vulnerabilities and Exploits

Zero-Day Exploitation of Palo Alto Networks Firewall Allows Backdoor Installation

 

Suspected state-sponsored hackers have exploited a zero-day vulnerability in Palo Alto Networks firewalls, identified as CVE-2024-3400, since March 26. These hackers have utilized the compromised devices to breach internal networks, pilfer data, and hijack credentials.

Palo Alto Networks issued a warning on the active exploitation of an unauthenticated remote code execution flaw in its PAN-OS firewall software. Patch updates are slated for release on April 14. Given the ongoing exploitation, Palo Alto Networks opted to disclose the vulnerability and provide interim mitigations for customers until patches are fully deployed.

Further insights into the zero-day exploitation emerged from a subsequent report by Volexity, the entity that discovered the flaw. According to Volexity, hackers have been exploiting the vulnerability since March, employing a custom backdoor dubbed 'Upstyle' to infiltrate target networks and execute data theft. The activity, tracked under the designation UTA0218, is strongly suspected to be orchestrated by state-sponsored threat actors.

Volexity's investigation traced the zero-day exploitation to April 10, primarily targeting the GlobalProtect feature of Palo Alto Networks PAN-OS. The subsequent deployment of identical exploitation methods at another customer site underscored the severity of the situation. Despite the exploitation period starting as early as March 26, payloads were not deployed until April 10.

The 'Upstyle' backdoor, facilitated by a Python script, enables remote command execution on compromised devices. The backdoor leverages a path configuration file to execute commands, allowing threat actors to operate stealthily within compromised environments.

In addition to the 'Upstyle' backdoor, Volexity observed the deployment of additional payloads, including reverse shells, PAN-OS configuration data exfiltration tools, and the Golang tunneling tool 'GOST.' In some instances, threat actors pivoted to internal networks to steal sensitive files, such as Active Directory databases and browser data from specific targets.

Volexity recommends two methods for detecting compromised Palo Alto Networks firewalls: generating Tech Support Files to analyze forensic artifacts and monitoring network activity for specific indicators of compromise.

This incident underscores the increasing targeting of network devices by threat actors, as demonstrated by previous campaigns exploiting vulnerabilities in Fortinet, SonicWall, Cisco, TP-Link, and Barracuda devices.
Read more »
real-time crime prevention
Cyber Cyber Security Financial Fraud India-Interpol international crime strategy Interpol cooperation online radicalization real-time crime prevention

India Seeks Strengthened Interpol Collaboration for Real-Time Crime Prevention

 

India has called for coordinated efforts through Interpol channels to address transnational crimes, including terrorism, online radicalization, and cyber-enabled financial fraud, on a real-time basis, officials revealed on Friday. At the 91st General Assembly of Interpol in Vienna, the Indian delegation, headed by CBI Director Praveen Sood, emphasized the necessity of eliminating safe havens for criminals and the proceeds of crime. The delegation also advocated for cohesive strategies to restrict the activities of transnational criminal organizations.

The team, which included NIA Director General Dinkar Gupta, participated in the four-day assembly that commenced on November 28, coinciding with the centenary year of Interpol, established in 1923. The increased utilization of Interpol channels and global law enforcement relationships resulted in the repatriation of 24 criminals and fugitives wanted by India this year, marking a record high, as per the Central Bureau of Investigation (CBI) spokesperson.

In discussions with law enforcement agencies from various countries, India called for enhanced coordination through Interpol to combat organized crime, terrorism, drug trafficking, money laundering, online radicalization, and cyber-enabled financial crimes in real-time. Emphasizing the denial of safe havens for criminals, the delegation highlighted the importance of coordinated strategies against criminal organizations with international reach.

Detailed talks on police cooperation took place with delegations from Austria, the UAE, the US, the UK, Nepal, Brazil, Australia, Mauritius, New Zealand, Japan, Switzerland, Bangladesh, Singapore, and Zambia. The discussions aimed at improving the sharing of criminal information via Interpol channels to expedite mutual legal assistance and extradition requests.

India expressed support for Interpol's 'Vision 2030' and the establishment of the Interpol Future Council, a group of experts to ensure the development and implementation of Vision 2030 aligns with the evolving needs of law enforcement in member countries. The team engaged in discussions with senior officials from Interpol, Europol, Pacific Islands Chiefs of Police Organization, and the US Air Force Office of Special Investigations to enhance cooperation arrangements.

India, a member of Interpol since 1949, has actively participated in the organization, hosting two General Assemblies. During last year's 90th General Assembly, a resolution was adopted to strengthen collaborative responses against financial crime and corruption, combat online child sexual exploitation, and promote diversity within Interpol. Additionally, the Interpol's presence in the Metaverse was launched during the 90th General Assembly.
Read more »
User Safety
Cyber Cyber Approach Cyber Attacks Cyber Data Ransomware User Data User Safety

Beyond Security: The Comprehensive Approach to Tackling Cyberattacks

 

In today's digital landscape, organizations are increasingly facing the harrowing consequences of cyberattacks, particularly ransomware incidents. In these malicious schemes, hackers encrypt vital data, rendering it inaccessible, and then demand exorbitant payments for its restoration. 

Unfortunately, such attacks are becoming alarmingly common, with ransomware reigning as the most prevalent form of cyberattack worldwide. On average, victims are forced to bear the staggering cost of $4 million per breach. Shockingly, some experts predict that by 2031, cumulative damages from ransomware could exceed a staggering $250 billion.

As a response, organizations have been diligently allocating more security resources to prevent such attacks. However, the aftermath of a breach is often overlooked, leaving companies ill-prepared to recover their data. Consequently, the recovery process can drag on for months, causing severe disruptions to business operations.

To minimize the impact of ransomware attacks, a change in mindset is essential. Rather than merely bolstering defensive measures and hoping for the best, organizations must acknowledge the inevitability of such attacks and adopt a proactive approach. A robust data resilience plan becomes imperative, wherein files are safeguarded to withstand the attempts of cybercriminals. 

Modern technological advancements, including artificial intelligence (AI), have made it feasible to establish and manage such a defense effectively. By incorporating AI-driven solutions, organizations can significantly enhance their data protection capabilities and mitigate the devastating consequences of ransomware attacks.
Read more »
Subscribe to: Posts (Atom)