By integrating environmental initiatives, social responsibility, and governance into their strategies, security helps advance ESG goals.

John Donegan, Enterprise Analyst at ManageEngine

June 19, 2024

4 Min Read

Source: Aleksandr Davydov via Alamy Stock Photo

COMMENTARY

Inadequate cybersecurity architecture can cause irreparable damage to an organization, which is why boards and C-suite executives are heeding recommendations to implement policies and procedures to mitigate risk. In addition, boardrooms are also paying attention to other hot topics, including diversity, equity, and inclusion (DEI) and sustainability. So it's worth asking what cybersecurity personnel can do to support these initiatives.

Security leaders are in a unique position to not only protect the organization, but also to help direct it toward a more sustainable future. There are several ways they can support the three pillars of ESG: environmental initiatives, social responsibility, and corporate governance.

**Cybersecurity & Environmental Initiatives**

By "environmental initiatives," we're talking about how organizations affect the environment, such as carbon emissions, resource consumption, and waste output. Security personnel can make a palpable, positive impact on their organization's environmental initiatives with a few key implementations.

Endpoint management solutions. At the beginning of the hardware and software life cycle, cybersecurity personnel should make judicious purchases. Endpoint management software, for example, can be helpful, as such tools save energy by automatically installing patches and putting endpoints into sleep mode when devices are idle or threatened. \[Editor's note: The author's company is one of many that sell endpoint management software.\]

E-waste management. Cybersecurity teams already monitor corporate devices to maintain compliance and robust network security; they should collaborate with IT personnel to prolong these devices' lifespans via patching and software updates. By reusing and refurbishing hardware, security personnel and IT folks can work together to lower operational costs and reduce their company's environmental footprint.

Supply chain audits. To reduce greenhouse gas emissions effectively, it is also necessary to conduct supply chain audits. Security personnel should periodically orchestrate environmental audits of all the vendors within their supply chain. This entails an assessment of vendors' energy consumption and waste management, among other things.

Energy-efficient data storage and processing. Security personnel should make data center cybersecurity a priority. Data centers use a ton of energy and often contain sensitive information. A successful cyberattack on a data center would likely result in fines, loss of trust, and a rise in energy consumption to get operations back on track.

**Cybersecurity & Social Responsibility**

This pillar is concerned with the relationships that one's company has with various people and communities. In addition to diversity and inclusion, we believe that companies should consider digital inclusion and the ability to contribute to economies in underdeveloped regions.

Eco-friendly product procurement. While procuring software and hardware, cybersecurity professionals are usually focused on robust security, compliance, and cost. However, they should also be cognizant of their potential vendors' sustainability practices. In addition to making sure that downstream vendors don't introduce any cyber-risks, security teams should assess the overall environmental and social impacts of their third-party products.

It's important to assess the average lifespan of third-party vendors' products, as well as any applicable energy efficiency ratings or environmental certifications. By choosing energy-efficient vendors that are committed to sustainable manufacturing practices, cyber personnel can bolster their own corporate reputation and attract environmentally conscious customers.

For organizations that sell cybersecurity tools, it's wise to consider digital inclusion. A component of social responsibility, digital inclusion is the idea that people of all socioeconomic backgrounds should have access to technologies. By keeping cybersecurity software prices affordable, security companies can provide more tools to more people.

Effective data management. Cybersecurity personnel are responsible for ensuring the confidentiality, integrity, and availability of their organization's data. Without adequate cybersecurity tools, such as endpoint management solutions, identity and access management tools, and security information and event management software, organizations cannot protect their customers' data, which, of course, they have a social responsibility to do.

**Cybersecurity & Governance**

Governance refers to an organization's internal procedures, its ability to comply with laws, and how well the company is managed. When it comes to governance, cybersecurity professionals' knowledge and guidance is indispensable.

Materiality assessments and regulatory compliance. Given that cybersecurity professionals are well-versed in dealing with compliance requirements, the executive branch should consult with them in their efforts to comply with regulations.

Besides helping establish cybersecurity compliance and data-handling protocols, security professionals can also ensure that the organization is in compliance with environmental legislation across the globe. To do so, they should help with their organization's ESG materiality assessments.

In addition to assessing sustainability from a financial angle, ESG assessments list how operations affect society and the environment. Organizations need to have cyber personnel on their steering committees to bring a risk management lens to the conversation. By sitting on these committees, cybersecurity team members remind upper management just how invaluable they are to the organization.

Adherence to data privacy laws. Again, organizations have a social — and legal — responsibility to adhere to all data privacy laws. By doing so, cybersecurity personnel help the organization properly manage customer data, while also mitigating threats from bad actors.

**Cybersecurity Is ESG**

As the examples above show, corporate sustainability initiatives cannot be successful without the active participation of cybersecurity personnel. Whether we are talking about environmental initiatives, social responsibility issues, or governance, cybersecurity professionals need to take their seats at the table.

**About the Author(s)**

Enterprise Analyst at ManageEngine

John Donegan is an enterprise analyst at ManageEngine. He covers infosec and cybersecurity, addressing technology-related issues and their impact on business. John holds several degrees, including a B.A. from New York University, an M.B.A. from Pepperdine University, an M.A. from the University of Texas at Austin, and an M.A. from Boston University.

How Cybersecurity Can Steer Organizations Toward Sustainability

The service, likely a rebrand of a previous operation called "Caffeine," mainly targets financial institutions in the Americas and EMEA and uses malicious QR codes and other advanced evasion tactics.

Source: ronstik via Alamy Stock Photo

A highly organized phishing-as-a-service operation (PhaaS) is targeting Microsoft 365 accounts across financial firms with business email compromise (BEC) attacks that leverage a two-factor authentication (2FA) bypass, QR codes, and other advanced evasion tactics to maximize success, researchers have found.

Security analysts from EclecticIQ in February discovered a broad phishing campaign targeting financial institutions, in which threat actors used embedded QR codes in PDF attachments to redirect victims to phishing URLs, according to a blog post published June 18. Specific organizations targeted included banks, private funding firms, and credit union service providers across the Americas and Europe, Middle East and Africa (EMEA) regions.

EclecticIQ eventually tracked the origin of the campaign to a PhaaS platform called ONNX Store, "which operates through a user-friendly interface accessible via Telegram bots," Eclectic IQ threat intelligence analyst Arda Büyükkaya wrote in the post.

A key part of the ONNX service is a 2FA bypass mechanism that intercepts 2FA requests from victims using encrypted JavaScript code, to decrease the likelihood of detection and bolster the success rate of attacks, Büyükkaya noted. Moreover, the phishing pages delivered in the attacks use typosquatting to closely resemble Microsoft 365 login interfaces, making them more likely to trick targets into entering their authentication details.

**Snapshot of an ONNX Attack**

A typical email used in the attack shows a threat actor purporting to send the employee a human resources-related PDF document, such as an employee handbook or a salary remittance slip. The document impersonates Adobe or Microsoft 365 to try to trick a recipient into opening the attachment via a QR code that, once scanned, directs victims to a phishing landing page.

The use of QR codes is an increasingly common tactic for evading endpoint detection, Büyükkaya noted: "Since QR codes are typically scanned by mobile phones, many organizations lack detection or prevention capabilities on employees' mobile devices, making it challenging to monitor these threats."

The attacker-controlled landing page is designed to steal login credentials and 2FA authentication codes using the adversary-in-the-middle (AitM) method, analysts found.

"When victims enter their credentials, the phishing server collects the stolen information via WebSockets protocol, which allows real-time, two-way communication between the user's browser and the server," Büyükkaya wrote. In this way, attackers can quickly capture and transmit stolen data without the need for frequent HTTP requests, making the phishing operation more efficient and harder to detect, he noted.

Another PhaaS operator, Tycoon, also has used a similar AitM technique and a multifactor authentication (MFA) bypass involving a Cloudflare CAPTCHA, demonstrating how malicious actors are learning from each other and adapting strategies accordingly, Büyükkaya said.

ONNX also shares overlap in both Telegram infrastructure and advertising methods with a phishing kit called Caffeine (first discovered by researchers at Mandiant in 2022), the researchers found — so it could be a rebranding of that operation, according to ElecticIQ.

Another scenario is that the Arabic-speaking threat actor MRxC0DER, who is believed to have developed and maintained Caffeine, is providing client support to the ONNX Store, while the broader operation "is likely managed independently by a new entity without central management," Büyükkaya wrote.

**JavaScript Encryption Adds Level of Evasion**

Another anti-detection measure in the ONNX phishing kit is the use of encrypted JavaScript code that decrypts itself during page load, and includes a basic anti-JavaScript debugging feature. "This adds a layer of protection against anti-phishing scanners and complicates analysis," according to the analysis.

EclecticIQ researchers observed a functionality in the decrypted JavaScript code that's specifically designed to steal 2FA tokens entered by the victims and relay them to the attacker, who then uses the stolen credentials and tokens in real time to log in to Microsoft 365.

"This real-time relay of credentials allows the attacker to gain unauthorized access to the victim's account before the 2FA token expires, circumventing multifactor authentication," Büyükkaya wrote.

**Mitigating and Preventing ONNX Phishing Attacks**

ElecticIQ provided countermeasures for combatting specific tactics used by ONNX Store. To mitigate threats from embedded QR codes in PDF documents, organizations should block PDF or HTML attachments from unverified external sources in email server settings. They also can educate employees on the risks associated with scanning QR codes from unknown sources.

To combat the typosquatted domains used by the threat actor to impersonate Microsoft, organizations can implement domain name system security extensions (DNSSEC), which protects domains from multiple cyber threats, including typosquatting.

There are also measures that defenders can take to combat the theft of 2FA tokens, such as implementing FIDO2 hardware security keys for 2FA; setting a short expiration time for login tokens that limits a cyberattacker's window of opportunity to use them; and using security monitoring tools to detect and alert for any unusual behavior, such as multiple failed login attempts or logins from unusual locations.

**About the Author(s)**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

'ONNX' MFA Bypass Targets Microsoft 365 Accounts

By offering to buy Atos' big data and cybersecurity operations. Paris is trying to make sure key technologies do not fall under foreign control.

Source: Aleksandar Malivuk via Shutterstock

The government of France's recent bid to acquire the big data and cybersecurity division of Atos for some $750 million is an indication of the financially beleaguered company's vital importance to the country's defense interests.

It's a move that analysts say is about retaining domestic control over technology integrated into sensitive government, defense industrial base systems, supercomputers for simulating nuclear bomb tests, and a range of other critical infrastructure. Atos is also the primary cybersecurity provider to the upcoming Olympic Games in Paris.

The French government has similar stakes in multiple other entities such as Air France, Airbus, Renault, and aviation, space, and defense giant Safran. So, the move to invest in Atos is not unprecedented.  Even so, it demonstrates the French government's keen interest in keeping information technology of strategic national security importance out of foreign hands.

**Atos: A Pivotal Govt. Player in France**

Atos is a pivotal entity in France, says Morgan Wright, chief security advisor at SentinelOne: "It has constructed the supercomputers for the nuclear-deterrent program, secured a 2019 contract to establish a big-data platform for the armed forces, and is a driving force in the development of the Scorpion combat-information system." Wright adds, "the French government's \[planned\] acquisition of these assets \[is\] a strategic move to maintain control and prevent potential competitors from developing technology that could be used against the country or its allies."

Atos last week disclosed that it had received what it described as a non-binding offer from the French government for its advanced computing, mission-critical systems and cybersecurity products businesses. Atos' board of directors and the company's top management will discuss the $750 million offer, but there is no guarantee that negotiations will lead to a definitive agreement between both parties, the company said in the statement.

The nearly $12 billion Atos provides a wide range of information technology products and services worldwide. In recent years the company has struggled financially and has accumulated a debt load that currently stands at over $5 billion. Airbus earlier this year offered between $1.65 billion and $2 billion to buy Atos' big data and cybersecurity business for between $1.65 billion and $2 billion — or more than twice what the French government has currently offered. But the aerospace giant abruptly walked out of the deal midway through discussions, tanking Atos' already degraded stock values in the process. Some European analysts had perceived Airbus as acting as sort of proxy for the French government when it made the offer.

**A Bid to Protect Self Interests**

The French government's subsequent direct bid to buy Atos' cybersecurity business is not entirely unsurprising in that context. Some in France had actually called for the government to nationalize Atos prompting a government denial.

"Atos delivers critical services to multiple departments within the French government, some of which are highly critical or require a specific skill set or authorization — \[like\] top secret security clearance," says Luigi Lenguito, founder and CEO, BforeAI. "Ensuring the know-how and workforce Atos has built, stays as consolidated as possible, is a primary concern," for the French government, he says.

In Europe, moves by the government to take a direct stake in companies deemed as providing critical value are not unusual, he says pointing to examples such as Air France and ITA (formerly Alitalia). Italy's Leonardo SpA — which like Atos provides a wide range of IT and security services — is an example even within the technology realm, he notes. The Italian government currently holds a 30% stake in Leonardo.

"This is not new; other large security organizations in Europe have some form of public 'golden share,'" as well, Lenguito says. "These arrangements have already been established in other critical sectors like telecommunication and utilities."

In other cases, governments have used legislation limiting who can tender specific services, he says.

**The US Approach to "PubSec"**

The chances of the US government stepping in to buy a stake in a critically important private sector IT or cybersecurity company are significantly lower. However, the government does have close oversight over foreign investments through the Committee of Foreign Investments in the United States (CFIUS), says SentinelOne's Wright.

"China has been blocked several times from acquiring certain US companies for national security reasons, because of the technology they are involved with," he says, i.e., Huawei's blocked bid to become a top 5G infrastructure provider for US telecoms. But for the federal government to buy a private cybersecurity company would be an exceptional circumstance, he notes.

"It could happen in the US, but I think the company would have to be so strategic that the transfer of ownership to an adversarial interest would harm the national security of the country," he says.

Dave Gerry, CEO at Bugcrowd, says that while the government buying a cybersecurity provider isn't exactly commonplace in the US, there is some precedent for it reviewing what technologies and companies can end up being owned by foreign buyers. He too points to the role by the CFIUS in reviewing transactions that could impact a national security interest.

"Recently, we've seen this play out in the non-cyber world when Japan's Nippon Steel attempted to acquire US Steel," he says. "In this case, it appears the French government has a strong reason to believe that Atos' acquisition by a foreign buyer would jeopardize France's national security interests."

Importantly, if the deal goes through, the French government will have a direct stake in a company that can help significantly bolster its technology and cybersecurity capabilities. "It makes sense for the French government to upgrade its defenses," says Mike Janke, co-founder of DataTribe. "For years, we have seen governments invest in critical companies through numerous means, but it has been rare for them to buy a company. We'll see if this emerges as a trend."

**About the Author(s)**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

France Seeks to Protect National Interests With Bid for Atos Cybersec

Cops decimate cybercrime infrastructure used to steal data from nearly 2,000 people in Singapore last year.

Source: dpa picture alliance via Alamy

Singapore police scored a win with the arrests of two men accused of operating servers that enabled cybercrimes against Singaporeans and the dismantling of their supporting infrastructure.

In 2023, nearly 2,000 victims in Singapore downloaded malicious Android applications that allowed the scammers to steal device data, including bank information, according to a statement from the Singapore police.

Following a deep analysis of the malware by cybersecurity officials in Singapore, Hong Kong, and Malaysia, where the arrests were made, police were able to track the entire organization behind the attacks, including a syndicate accused of operating a fraudulent customer service center in Taiwan.

"In addition, the HKPF (Hong Kong Police Force) successfully took down 52 malware-controlling servers in Hong Kong and arrested 14 money mules who had allegedly facilitated the malware-enabled scam cases by relinquishing the use of their bank accounts to the scammers for monetary reward," the Singapore police added.

The two arrests included a 26-year-old man who faces up to seven years in prison. The other, a 47-year-old man, will stand trial for the same crimes, plus an additional charge carrying up to 10 years in prison, police said.

**About the Author(s)**

Singapore Extradites Suspected Cybercrime Scammers from Malaysia

The consortium of private companies and academia will focus on ways to protect hardware memory from attacks.

Source: Science Photo Library via Alamy Stock Photo

A new chip security consortium named CHERI Alliance is focused on protecting data stored in hardware memory from cyberattackers.

The alliance backs a protection model that isolates the hardware and software to prevent hackers from injecting code into memory that would allow them to take over systems or steal data.

"Memory issues represent approximately 70% of the routes taken by cyber attackers," said CHERI Alliance in a statement.

CHERI is an acronym for Capability Hardware Enhanced RISC Instructions. The alliance will formally launch in September.

Memory issues are usually addressed through software techniques or coarse-grained hardware memory protection, says alliance spokesperson Tora Fridholm.

"These methods either leave holes or are not very practical," Fridholm says. "What is unique about CHERI is that the technology adds fine-grained memory protection, with the ability to prevent these issues completely without adding a major overhead."

The alliance focuses on securing memory in ARM, MIPS, and RISC-V architectures, which dominate edge devices.

The backing entities include University of Cambridge, the FreeBSD Foundation, Capabilities Limited, lowRISC, and SCI Semiconductor. While ARM dominates the microcontroller and mobile markets, the company is currently not part of the consortium.

ARM has been victim to many memory-bound vulnerabilities, including one earlier this month that allows hackers to access GPU memory. ARM-based processors also had vulnerabilities related to Meltdown and variants of Spectre, which allowed hackers to take over memory.

**Research on Memory Protection**

The CHERI program originally started off in 2010 as a research program between the University of Cambridge and SRI International; and was funded by DARPA's CRASH.

As part of the program, researchers developed CHERI-based hardware with memory protection features. ARM's prototype Morello board with CHERI extensions was reviewed by the Microsoft Security Response Center, which provided recommendations to improve the design. CHERI was described in a research paper published earlier this year as a "hardware-software capability-based system that extends the ISA, toolchain, programming languages, operating systems, and applications in order to provide complete pointer and memory safety."

CHERI researchers also provide toolkits so C and C++ programmers can add memory protection to code. C++ doesn't have automatic memory protection mechanisms, unlike newer development tools, such as Rust, which leaves space for coders to inject malicious code. Coders need to add specific code to protect memory.

**About the Author(s)**

Agam Shah has covered enterprise IT for more than a decade. Outside of machine learning, hardware, and chips, he's also interested in martial arts and Russia.

CHERI Alliance Aims to Secure Hardware Memory

The US passenger rail giant said attackers used previously compromised credentials to crack accounts and access a freight train of personal data.

Source: Peter Titmuss via Alamy Stock Photo

Amtrak has disclosed a data breach affecting train travelers' Guest Rewards accounts.

In a breach-disclosure notice filed with the state of Massachusetts, the national passenger rail service noted that an unknown third party gained unauthorized access to users' account information during the time period of May 15-18.

The transport giant determined that compromised usernames and passwords from prior breaches were likely used to access certain accounts, and stressed in the breach notice that there was no hack of Amtrak systems.

Even so, the information that the threat actor accessed includes a social engineering bonanza of data, including "name, contact information, Amtrak Guest Rewards account number, date of birth, payment details (such as partial credit card number and expiration date), gift card information (such as card number and PIN) and/or information about your transactions and trips."

In some cases, the hackers took over accounts and changed emails and passwords to lock legitimate users out. Amtrak was able to nip that in the bud, though: "We have changed the email address for your Amtrak Guest Rewards account back to your email address and initiated a reset of your account password."

Amtrak didn't elaborate on how many rail aficionados are affected, but urged riders to rotate their passwords and implement multifactor authentication to prevent account access and takeovers.

"Threat actors have realized the high rewards of stealing from travel loyalty programs, which can easily be sold on the Dark Web or converted to tickets that they later sell," said Stuart Wells, Jumio CTO, in an emailed statement shared with media. "It's a reality that's particularly tough on travelers who have worked for months, or even years, to accumulate loyalty points and status through regular trips. Customers who are less frequent travelers may not notice their points disappearing for a long time."

**Multiple Cyber Incidents for Amtrak Customers**

This isn't the first time the data breach engine has left the Amtrak station. In 2020, it disclosed a Guest Rewards breach in which "some personal information may have been viewed," according to the notification, where the threat actor was noticed and booted out of the system "within a few hours."

Jumio's Wells noted that, given the weaknesses known to be present in most mainstream MFA techniques, businesses could go further to protect consumer accounts.

"As cyber threats evolve, businesses must adopt advanced verification technologies to enhance the protection of sensitive user data. Implementing a robust identity verification system is crucial to effectively combat fraud in all forms," he said.

For instance, "utilizing biometric verification methods ensures that illegitimate users and hackers are hindered before causing further harm, as they would need more than just credentials to gain access. This approach protects consumers from having their personal details disclosed from compromised accounts and provides a very effective solution to combat fraud."

**About the Author(s)**

Tara Seals has 20+ years of experience as a journalist, analyst and editor in the cybersecurity, communications and technology space. Prior to Dark Reading, Tara was Editor in Chief at Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.

Hackers Derail Amtrak Guest Rewards Accounts in Breach

A trio of bugs could allow hackers to escalate privileges and remotely execute code on virtual machines deployed across cloud environments.

Source: Schoening via Alamy Stock Photo

Broadcom has released fixes for three vulnerabilities affecting VMware vCenter, two of which are of critical severity and allow remote code execution (RCE). The disclosures come as virtual machines (VMs) continue to attract the notice of hackers, thanks to the rich repositories of sensitive data and applications they tend to house. Patching immediately is a good idea.

vCenter is the centralized management console for VMware virtual environments, and is used to view and manage VMs, multiple ESXi hosts, and all dependent components from a single centralized location. CVE-2024-37079 and CVE-2024-37080 are heap overflow vulnerabilities in vCenter's implementation of DCERPC — short for Distributed Computing Environment/Remote Procedure Call — used for calling a function on a remote machine as if it were a local one.

DCERPC is useful for engaging with remote machines, especially if you're a remote hacker. Using a specially crafted network packet, an attacker with network access can take advantage of these vulnerabilities to remotely execute their own code on VMs managed by vCenter. The potential for harm has earned both vulnerabilities critical 9.8 out of 10 scores on the CVSS scale.

Broadcom also patched a number of local privilege escalation vulnerabilities resulting from a misconfiguration of sudo within vCenter. Short for "superuser do" or "substitute user do," sudo allows users in Unix systems to run commands with the privileges of another user — at the root level by default. An authenticated local user can take advantage of the bug labeled CVE-2024-37081 to obtain administrative privileges on a vCenter Server appliance. It has been assigned a high CVSS score of 7.8.

As yet, there is no evidence that any of these three vulnerabilities have been exploited in the wild — though that could quickly change. Remediations can be found here, and an accompanying Q&A page here.

**The Risk in Cloud VMs**

According to its own documentation, VMware sports more than 400,000 customers, including 100% of all Fortune 500 and Fortune Global 100 companies. Its technology supports more than 80% of virtualized workloads and a good chunk of business critical applications.

"The increasing popularity of cloud computing has led to a corresponding surge in VM usage, consolidating multiple applications onto a single physical server," explains Patrick Tiquet, vice president of security and architecture at Keeper Security. "This consolidation not only enhances operational efficiency but also presents attackers with the opportunity to compromise a variety of services through a single breach."

vCenter Server epitomizes this risk. As the centralized management software supporting the VMWare vSphere and Cloud Foundation platforms, it provides a launch point for both IT administrators and hackers to reach many VMs running across organizations.

"Successful breaches not only disrupt services and dole out financial losses, but can also lead to the exposure of sensitive data and violations of regulatory requirements, severely damaging an organization’s reputation," Tiquet warns, so patching new vulnerabilities as they crop up is both necessary and insufficient for organizations to be at ease.

Besides network segmentation, vulnerability audits, and other security hardening tactics like incident response planning and maintaining robust backups, he says, it's the job of network administrators to lead from the front: "Administrators should always ensure they’re using a secure vault and secrets management solution, they must apply necessary updates as soon as possible, and they should also check their cloud console’s security controls to ensure they’re following the latest recommendations."

**About the Author(s)**

Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes "Malicious Life" -- an award-winning Top 20 tech podcast on Apple and Spotify -- and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts "The Industrial Security Podcast," the most popular show in its field.

Critical VMware Bugs Open Swaths of VMs to RCE, Data Theft

Threat actors were able to breach Blackbaud's systems and compromise sensitive data, largely because of the company's poor cybersecurity practices and lack of encrypted data, the AG said.

Source: SOPA Images Limited via Alamy Stock Photo

Blackbaud, a South Carolina-based software company, has been ordered by the California Attorney General's Office to pay $6.75 million to settle a ransomware attack that took place in May 2020.

The attack occurred due to poor security practices, the AG's office said.

After Blackbaud revealed that the threat actors compromised unencrypted Social Security numbers, bank account details, and login credentials, the company "then made misleading statements about the sufficiency of its data security efforts prior to the breach and about the extent of the breach to its nonprofit customers and the public," stated the Attorney General's press release. "These actions violated the Reasonable Data Security Law, Unfair Competition Law, and the False Advertising Law related to data security."

Private information from 13,000 nonprofits, universities, hospitals, and other organizations were compromised through Blackbaud, according to a government-led investigation, leading the company to pay a ransom of 24 bitcoins or $250,000.

The fine is part of a broader set of penalties. Blackbaud initially was fined $3 million in March 2023 before agreeing to a $49.5 million settlement with 49 states and Washington, DC. At the beginning of this year, however, the Federal Trade Commission ordered Blackbaud to also develop an information security program, as well as delete data that is no longer necessary for its services. 

The FTC argued that though the company paid the ransom demanded by the threat actors, it did not take additional steps to ensure that the data was deleted, nor did it step up its security practices, including implementing multifactor authentication, monitoring its network, and encrypting sensitive data, among other things. 

"Not only did Blackbaud fail to protect consumers' personal information, but they misled the public of the full impact of the data breach," stated Attorney General Bonta. "This is simply unacceptable. Today's settlement will ensure that Blackbaud prioritizes safeguarding consumers' personal information and enhances security measures to prevent future incidents."

**About the Author(s)**

Blackbaud Fined $6.75M After 2020 Ransomware Attack

"ClearFake" and "ClickFix" attackers are tricking people into cutting and pasting malicious PowerShell scripts to infect their own machines with RATs and infostealers.

Source: Nico El Nino via Shutterstock

Threat actors are using fake browser updates and software fixes to trick users into cutting/copying and pasting PowerShell scripts loaded with various malware strains — including remote access Trojans (RATs) and infostealers — to infect their computers.

Researchers from Proofpoint observed the socially engineered technique employed by initial access broker tracked as TA571, as well as an unidentified actor in the last three months, starting as early as March 1, they revealed in a blog post published June 17.

There appear to be two methods of social engineering used in the activity — one that offers fake browser updates in yet another ClearFake campaign, and the other that delivers error messages related to Word, Google Chrome, and OneDrive dubbed "ClickFix" by the researchers. Malware delivered in the campaign includes the DarkGate and NetSupport RATs, the malware loader Matanbuchus, and various information stealers, including Lumma and Vidar.

"Whether the initial campaign begins via malspam or delivered via web browser injects, the technique is similar," Proofpoint researchers Tommy Madjar, Dusty Miller, Selena Larson, and the Proofpoint Threat Research Team explained in the post.

The campaigns show users are a pop-up textbox that suggests an error occurred when trying to open the document or webpage, and further instructions to copy and paste a malicious script into either the PowerShell terminal or the Windows Run dialog box to eventually execute the script via PowerShell, they said.

Attackers use "clever" and "authoritative" social engineering in the fake error messages delivered to users in the campaign, and also "provides both the problem and a solution so that a viewer may take prompt action without pausing to consider the risk," the researchers noted.

The activity reflects a trend among cybercriminals to adopt "increasingly creative attack chains" that ensure the success of campaigns that employ nested PowerShell and other technical tactics that are not easily detected by users, they said.

**ClearFake for Malware Delivery**

Proofpoint first observed the cut-and-paste technique with a ClearFake campaign in early April as well as "every other ClearFake campaign since then," the researchers noted. ClearFake is a previously identified fake browser update activity cluster that compromises legitimate websites with malicious HTML and JavaScript.  

In the latest campaigns, when a user visited a compromised website, the injection caused the website to load a malicious script hosted on the blockchain via Binance’s Smart Chain contracts, using a technique known as EtherHiding. The initial script then loaded a second script from a domain to eventually present a fake warning warning instructing them to install a "root certificate" to view the website correctly.

The message included instructions to click a button to copy a PowerShell script and then provided steps on how to manually run this script on the victim's computer. If this is done, the user effectively executes the PowerShell by pasting it into the PowerShell command line interface window. Proofpoint observed at least five types of malware being delivered in this way, including the Lumma stealer, Amadey Loader, and JaskaGo.

**ClickFix Baits With Error Messages**

Proofpoint first began to observe what it calls the ClickFix campaign in mid-April when its researchers found compromised sites containing an inject leading to an iframe on pley\[.\]es displayed as an overlay error message. The messaged claimed that a faulty browser update needed to be fixed and asked the victim to open “Windows PowerShell (Admin)”–which will open an User Account Control (UAC) prompt–and then right-click to paste the code.

If users take the bait, PowerShell runs another remote PowerShell script that downloads and runs an executable, eventually leading to Vidar stealer. While the payload domain used in the PowerShell was taken offline just a few days after the researchers discovered the activity, the custom content of the iframe was replaced with the ClearFake injection that was still active earlier this month. The researchers remain unclear if the same actor is behind ClearFake and ClickFix, however.

**TA571 Attribution**

Proofpoint observed TA571 using cut-and-paste PowerShell against victims as early as March 1 in a campaign that included more than 100,000 messages and targeted thousands of organizations globally. The threat actor employed emails containing an HTML attachment that displayed a page resembling Microsoft Word as well as error message claiming that "the Word Online" extension is not installed.

The message presented users with two options to continue, either "how to fix" or "auto-fix," both of which led them down to malicious paths to install malware, including Matanbuchus or DarkGate, using PowerShell or DLL files.

TA571's use of similar attack chains throughout the spring using "various visual lures and varying between instructing the victim to either open the PowerShell terminal or using the Run dialog box" demonstrates a link between the actor and the ClickFix campaign, the researchers noted.

**Mitigating Malware Compromise**

Proofpoint included a list of indicators of compromise (IoCs) in recent campaigns, acknowledging that it is not an "exhaustive list" but merely a snapshot of websites, email addresses, and other processes related to the malicious activity that its researchers have observed.

Overall the attack chain requires "significant user interaction" to be successful, which means the most practical way for organizations to help avoid compromise on their network is employee awareness and training, the researchers noted.

"Organizations should train users to identify the activity and report suspicious activity to their security teams," the researchers wrote. "This is very specific training but can easily be integrated into an existing user training program." 

**About the Author(s)**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

Cut &amp; Paste Tactics Import Malware to Unwitting Victims

Forcing Microsoft to compete fairly is the most important next step in building a better defense against foreign actors.

Steve Weber, Professor of the Graduate School, UC Berkeley School of Information

June 18, 2024

4 Min Read

Source: Michael Urmann via Alamy Stock Photo

COMMENTARY

This month, Microsoft president Brad Smith was confronted by the US House Committee on Homeland Security, in a hearing over the cybersecurity woes that have plagued the government as a direct result of the company's security shortcomings. These issues, however, don't just come down to insecure products. They're symptoms of a larger disease — a lapse in market and competition policy that has allowed Microsoft to dominate virtually all of the public sector technology market. And the US government's failure to properly diagnose the deeper cause puts us all at risk. 

Microsoft, by its own admission, is ground zero for state-sponsored hacking groups, and flaws in the company's software have been responsible for a huge proportion of cyber breaches affecting the US government in recent memory. Our country's cyber watchdogs — the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) and Cyber Safety Review Board (CSRB) — have spent considerable resources assessing these incidents and trying to assess and address Microsoft's vulnerabilities.

There's a fundamental problem with this process. The government is confusing symptoms — persistent hacks, breaches, and vulnerabilities — with an underlying disease: the lack of competition around cybersecurity. Microsoft has systematically exploited weaknesses in procurement processes to stifle competition and lock government customers into its insecure technology. That confusion ultimately leaves the government's tools to enhance competition on the sidelines, when those tools are the best remedy for cyber insecurity.

Microsoft holds an 85% market share of government collaboration and communications technology and now is awarded at least a quarter of its contracts without any meaningful competition. It's reached this position through a series of deliberate, anticompetitive moves the government has largely neglected. Stretched government procurement officers and chief information security officers (CISOs) are taking the path of least resistance. That's not their fault; it's a difficult consequence of their job. But Microsoft exploits this by making it expensive and difficult to run its software on a competitor's cloud, including charging a five-times premium just to use Word on Amazon's cloud instead of its own Azure cloud service. Microsoft bundles dozens of ancillary applications with its Office productivity apps in its licenses (including Access, Delve, Viva, and others), which stifles competition by linking basic, widely used services with less popular ones and pricing them as free.

The result? A software monoculture with a simple attack surface for the United States' adversaries with nearly a single point of failure: Microsoft. This is a major threat to national security. The potential harm is real and expensive. The US government spent more than $11.1 billion on cybersecurity in 2023, in large part trying to compensate for and respond to the Microsoft incidents that left it vulnerable to intrusion. 

Some lawmakers are ready to take action. Senator Ron Wyden recently drafted legislation that would require the government to set new standards for collaboration software in response to a CSRB report. It's a good step, but it solves only part of the problem. Even if the government can collaborate with other providers while using Microsoft's software, the company's licenses still make it very expensive, all at a major cost to the taxpayer.

**A Better Solution Is Needed**

The government must use all the tools at its disposal to create a more comprehensive solution that immediately targets the root cause of its cybersecurity woes: Microsoft's anticompetitive licensing restrictions. These tools include using the General Services Administration (GSA) to modify procurement processes as a means of bolstering national security. The GSA is responsible for providing agencies with cost-effective, high-quality products from diverse vendors, and the evidence is clear that Microsoft doesn't meet these standards. The GSA can take action by either negotiating better licensing conditions with the company or by looking at other vendors to help diversify the government's tech infrastructure. That would be a strong and timely step to set the stage for more comprehensive and sweeping competition policy action by the Federal Trade Commission (FTC) or the Department of Justice. It's also a step that wouldn't take years to implement — which is vital given the current and future costs of Microsoft's efforts to lock government customers into long-term contracts. The longer the government waits, the harder the lock-in will be to reverse.

It can't settle for identifying symptoms. Microsoft's licensing is responsible for a debilitating disease that has infected our government's tech infrastructure. Allowing major government contracts to be awarded to any one company — in this case, Microsoft — is only plausible if procurement officials believe they really don't have any other choice. But we already have the remedies necessary to level the playing field and make enterprise software vendors accountable for weak cybersecurity. Forcing Microsoft to compete fairly is the most important next step to build a better defense against foreign actors. We have multiple tools to create a level playing field. We just need to use them. 

**About the Author(s)**

Professor of the Graduate School, UC Berkeley School of Information

Steve Weber works at the intersection of technology markets, intellectual property regimes, and international politics He has published numerous books, including The Success of Open Source and, most recently, Bloc by Bloc: How to Build a Global Enterprise for the New Regional Order, and serves as Professor of the Graduate School, School of Information, UC Berkeley. He has worked with and received research funding from a number of technology firms, including Google and Microsoft.

Source

DARKReading