Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Financial Threat. Show all posts
UNC
CrowdStrike Cyber Security cybercriminals Financial Threat Google Cloud Google Mandiant Mandiant Threat Intelligence UNC

Protecting Your Business from Snowflake Platform Exploitation by UNC5537

 

A recent report from Mandiant, a subsidiary of Google Cloud, has uncovered a significant cyber threat involving the exploitation of the Snowflake platform. A financially motivated threat actor, identified as UNC5537, targeted around 165 organizations' Snowflake customer instances, aiming to steal and exfiltrate data for extortion and sale. Snowflake, a widely-used cloud data platform, enables the storage and analysis of vast amounts of data. The threat actor gained access to this data by using compromised credentials, which were obtained either through infostealer malware or purchased from other cybercriminals. 

UNC5537 is known for advertising stolen data on cybercrime forums and attempting to extort victims. The sold data can be used for various malicious purposes, including cyber espionage, competitive intelligence, and financial fraud. The joint statement from Snowflake, Mandiant, and cybersecurity firm CrowdStrike clarifies that there is no evidence of a vulnerability, misconfiguration, or breach within Snowflake’s platform itself. 

Additionally, there is no indication that current or former Snowflake employees' credentials were compromised. Instead, the attackers acquired credentials from infostealer malware campaigns that infected systems not owned by Snowflake. This allowed them to access and exfiltrate data from the affected Snowflake customer accounts. Mandiant's research revealed that UNC5537 primarily used credentials stolen by various infostealer malware families, such as Vidar, Risepro, Redline, Racoon Stealer, Lumma, and Metastealer. Many of these credentials dated back to November 2020 but remained usable. The majority of credentials exploited by UNC5537 were exposed through previous infostealer malware incidents. 

The initial compromise often occurred on contractor systems used for personal activities like gaming and downloading pirated software, which are common vectors for spreading infostealers. Once obtained, the threat actor used these credentials to access Snowflake accounts and extract valuable customer data. UNC5537 also purchased credentials from cybercriminal marketplaces, often through Initial Access Brokers who specialize in selling stolen corporate access. The underground market for infostealer-obtained credentials is robust, with large lists of stolen credentials available for free or for purchase on the dark web and other platforms. 

According to Mandiant, 10% of overall intrusions in 2023 began with stolen credentials, making it the fourth most common initial intrusion vector. To protect your business from similar threats, it is crucial to implement robust cybersecurity measures. This includes regular monitoring and updating of all systems to protect against infostealer malware, enforcing strong password policies, and ensuring that all software is kept up to date with the latest security patches. Employee training on cybersecurity best practices, especially regarding the dangers of downloading pirated software and engaging in risky online behavior, is also essential. 

Moreover, consider using multi-factor authentication (MFA) to add an extra layer of security to your accounts. Regularly audit your systems for any unusual activity or unauthorized access attempts. Engage with reputable cybersecurity firms to conduct thorough security assessments and implement advanced threat detection solutions. By staying vigilant and proactive, businesses can better protect themselves from the threats posed by cybercriminals like UNC5537 and ensure the security and integrity of their data.
Read more »
Python-based Malware
Chaes Malware Financial Threat malware Python-based Malware

The Rise of Chaes Malware: A Threat to Financial and Logistics Industries


The world of cybersecurity is constantly evolving, with new threats emerging on a regular basis. One such threat is the Chaes malware, which has recently undergone major overhauls, making it even more dangerous to the financial and logistics industries.

What is Chaes Malware?

Chaes is a malware that first emerged in 2020, known for targeting e-commerce customers in Latin America, particularly Brazil, to steal sensitive financial information. 

The malware has undergone significant transformations and enhancements, including being rewritten entirely in Python, resulting in lower detection rates by traditional defense systems. 

The latest iteration of the malware, dubbed Chae$ 4, packs in an expanded catalogue of services targeted for credential theft and clipper functionalities.

How Does Chaes Malware Work?

Chaes malware targets banking and logistics industries, stealing sensitive financial information from customers. The malware has undergone a comprehensive redesign and an enhanced communication protocol, making it even more effective at evading detection. 

Once the malware has infected a system, it can steal login credentials, credit card information, and other sensitive data.

What's next?

The rise of Chaes malware is a serious threat to the financial and logistics industries. With its enhanced capabilities and ability to evade detection, it is important for businesses to take proactive measures to protect themselves from this dangerous malware. 

By staying informed about the latest threats and implementing strong cybersecurity measures, businesses can help protect themselves and their customers from the dangers of Chaes malware.

Read more »
Subscribe to: Posts (Atom)