Treasury Department Sanctions Dark Web Market Hydra and 100s of Its Cryptocurrency Addresses
Ukraine's CERT discovers new Russian phishing campaigns, Russian state gas giant Gazprom's site forced offline after hack, Block confirms data breach by former employee, much more
Check out my latest CSO column that discusses mounting concerns over Russian cyber threats addressed in a House Homeland Committee meeting yesterday and the role that the federal government has played to help organizations.
While the German government, in a joint operation with U.S. law enforcement, took down dark web marketplace Hydra, the U.S. Treasury Department simultaneously imposed new sanctions on the market and more than a hundred of its cryptocurrency addresses.
According to blockchain analysis firm Elliptic, Hydra has facilitated more than $5 billion in illicit cryptocurrency transactions since it launched in 2015. Around half of the roughly $2 billion in transactions going into Hydra's cryptocurrency addresses in 2021 and early 2022 were from illicit or “risky” sources, such as stolen funds, dark-web markets, ransomware, online gambling, scams, and individuals and organizations facing sanctions, according to cryptocurrency tracing firm Chainalysis. (Andy Greenberg / Wired)
Related: The Hacker News, The Hill, Treasury Department
The Computer Emergency Response Team of Ukraine (CERT-UA) has spotted new phishing attempts attributed to the Russian state-sponsored threat group tracked as Armageddon (Gamaredon).
The malicious emails try to trick the recipients with lures themed after the war in Ukraine and infect the target systems with espionage-focused malware. One campaign targets Ukrainian organizations, and the other focuses on government agencies in the European Union. (Bill Toulas / Bleeping Computer)
Related: Security Affairs, Wall Street Journal, CERT.gov.ua, CERT.gov.ua
The website of Gazprom Neft, the oil arm of Russian state gas giant Gazprom was forced offline after an apparent hack in what looked like the latest attack on government-linked sites following Russia's actions in Ukraine.
The website briefly showed a statement purporting to be from Gazprom chief executive Alexei Miller, a close ally of President Vladimir Putin, making critical comments about Russia's decision to send tens of thousands of troops into neighboring Ukraine. (Reuters)
In an SEC filing, Block, formerly known as Square, confirmed a data breach involving a former employee who downloaded Cash App reports containing some U.S. customer information.
“While this employee had regular access to these reports as part of their past job responsibilities, in this instance these reports were accessed without permission after their employment ended,” Block said. The information in the reports included users’ full names and brokerage account numbers, and for some customers, the accessed data also included brokerage portfolio value, brokerage portfolio holdings, and stock trading activity for one trading day. Block said it is contacting approximately 8.2 million current and former customers about the incident. (Carly Page / TechCrunch)
Related: Slashdot, Motley Fool, Security News | Tech Times, CNET News, Security Week, DataBreaches.net, Engadget, ZDNet Security, Digital Trends, iMore, The Verge, iTech Post, Reddit - cybersecurity, Mashable, The Hacker News
Microsoft said that it's currently tracking a "low volume of exploit attempts" targeting the critical Spring4Shell (aka SpringShell) remote code execution (RCE) vulnerability across its cloud services.
The company said that that attacker could exploit this Spring Core security flaw by sending specially crafted queries to servers running the Spring Core framework to create web shells in the Tomcat root directory. Admins can check their servers to determine if they are vulnerable to Spring4Shell attacks using this nonmalicious command. (Sergiu Gatlan / Bleeping Computer)
Related: The Daily Swig, Microsoft
Microsoft unveiled new and updated Windows 11 security features that will arrive later in 2022, including improved protection against phishing and malware that aim to reduce work for security teams.
One of the new features, the Microsoft Defender SmartScreen solution, will offer improved phishing detection starting with the next annual release of Windows 11, by alerting users when they enter Microsoft credentials into a malicious application or website. (Kyle Alspach / Venture Beat)
Related: Bleeping Computer, heise online News, Microsoft Security, Microsoft Security, xda-developers, Windows Central , Techradar, PCWorld, Cyber Kendra, VentureBeat, Engadget, Techradar, ZDNet Security
When Apple patched two “actively exploited” zero-day security vulnerabilities for macOS Monterey last week, it left an estimated 35–40% of all supported Macs in danger of actively exploited vulnerabilities.
After nearly a week, Apple still has not released corresponding security updates to address the same vulnerabilities in the two previous macOS versions, Big Sur (aka macOS 11) and Catalina (aka macOS 10.15). macOS Big Sur and macOS Catalina are likely both vulnerable to CVE-2022-22674, the other actively exploited vulnerability that was fixed for only macOS Monterey last week. (Joshua Long / The Mac Security Blog)
Related: The Register, The Mac Observer, Candid.Technology
Google has issued an emergency update that takes Chrome to version 100.0.4896.75. The update follows the landmark version 100 update issued last week that fixed around 28 security vulnerabilities.
In a Chrome stable channel update announcement, Google confirms that the security patch will roll out for Chrome's Windows, Mac and Linux users over the coming days and weeks. The vulnerability patched is listed as the high-severity CVE-2022-1232 although Google has yet to release any details. (Davey Winder / Forbes)
Related: Google Chrome, The Sun
A nonprofit association that promotes social responsibility among corporations called Business for Social Responsibility has concluded in a new report that Meta’s planned expansion of strong encryption to its Messenger and Instagram services will do more good than harm for human rights.
The report should provide the company with more ammunition as it fights efforts in the United Kingdom and other countries to carve out exceptions to make police work easier. (Joseph Menn / Washington Post)
Related: BSR
Despite some experts’ opinions that Russia has not engaged in a predicted high level of cyberattacks concomitant with its invasion of Ukraine, all available evidence indicates that Russia has employed a coordinated cyber-campaign intended to provide its forces with an early advantage during its war in Ukraine.
Preconceived notions of the role of cyberattacks on the battlefield have made it hard for analysts to see cyber-operations in Ukraine for what they are and for the role they play within Russia’s military campaign. But a full accounting of the cyber-operations reveals the proactive and persistent use of cyberattacks to support Russian military objectives. For example, in the hours before the invasion, Russia hit a range of important targets in Ukraine, rendering the computer systems of multiple government, military, and critical infrastructure sectors inoperable. Cities under siege from Russian shelling, including Kharkiv and Kyiv, have experienced cyber-enabled disruptions to Internet services. Ukraine’s national cyber-authorities continue to expose intrusion attempts by Russian and Belarussian cyber-units. (David Cattler and Daniel Black / Foreign Affairs)
During testimony before the Senate Armed Services Committee, General Paul Nakasone, who directs U.S. Cyber Command, said that his organization has been active in addressing security concerns regarding Russia’s invasion of Ukraine, from assisting the Ukrainians to providing intelligence to hardening networks domestically and globally.
Since Russia’s invasion in February, Cyber Command has conducted additional “hunt forward” operations bolstering the resilience of Ukraine and other NATO allies, Nakasone testified. On the domestic front, Nakasone said that elite cyber teams have taken numerous actions to combat ransomware in partnership with other federal entities in the law enforcement realm and industry over the past year. These actions have sought to disrupt and degrade the operations of ransomware groups. (Mark Pomerleau / FedScoop)
Related: The Record by Recorded Future
Since Russia’s invasion began in late February, hackers have repeatedly broken into the social media accounts and broadcasting systems of trusted information sources in Ukraine, like government officials and prominent media outlets, to promote false messages about Ukraine’s surrender.
Experts say the hackers’ intention is not to fool anyone with false news but to erode confidence in Ukrainian institutions and show that the government and news media cannot be relied upon for information or keep hackers out of their systems. (Kate Conger / New York Times)
Ecommerce platform Shopify faces a class-action lawsuit filed by users of the Ledger hardware wallet stemming from a major data breach in 2020. The data breach resulted in a leak of information on around 272,000 Ledger users and more than one million email subscribers to the Ledger newsletter.
The lawsuit alleges that Shopify failed to protect its customers' identities and holds Shopify and TaskUs, a third-party data consultant, responsible for leaking personally identifiable information (PII) of Ledger customers. (Ali Raza / Invezz)
Related: Law Street, Cryptopotato, Cointelegraph
All-purpose, mid-market cybersecurity company Coro raised $60 million in a Series B venture funding round.
Balderton Capital led the round with participation from Jerusalem Venture Partners, a previous backer. (Ingrid Lunden / TechCrunch)
Related: No Camels, CTech, FinSMEs, Globes, Jerusalem Post, Venture Capital Journal
Cybersecurity startup Corsha, which aims to bring multi-factor authentication (MFA) to machine-to-machine API traffic, has raised $12 million in a Series A venture funding round.
Eleven Ventures and Razor’s Edge Ventures led the round with participation from 1843 Capital. (Carly Page / TechCrunch)
Related: Help Net Security, Venture Beat, Security Week
Airgap Networks, a provider of an agentless zero trust segmentation platform, raised $13.4 million in a Series A funding round that brings the total raised by the company to $18.6 million.
Storm Ventures led the round, with participation from Cervin Ventures, Engineering Capital, Sorenson Ventures, and various angel investors. (Eduard Kovacs / Security Week)
Related: FinSMEs
Security-minded user behavior shaping company Nudge Security raised $7 million in a venture funding seed round.
Ballistic, the new VC firm solely dedicated to advising and funding early-stage cybersecurity startups, led the round. (Kelly Jackson Higgins / Dark Reading)
Related: FinSMEs, PR Newswire
Image by woodley wonderworks, CC BY 2.0 via Wikimedia Commons