By Waqas
Check Point reports hackers are targeting its VPN as the company releases new security measures to prevent unauthorized…
This is a post from HackRead.com Read the original post: Hackers Target Check Point VPNs, Security Fix Released

Check Point reports hackers are targeting its VPN as the company releases new security measures to prevent unauthorized access. Enhance your VPN security with multi-factor authentication and Check Point’s latest solutions.

Over recent months, cybercriminals have increasingly targeted remote-access VPN environments, using them as entry points to infiltrate enterprises. These attackers aim to identify valuable assets and users within organizations, exploiting vulnerabilities to establish persistence on critical enterprise systems.

The Israel-based cybersecurity giant Check Point has observed a troubling trend of compromised VPN solutions across various cybersecurity vendors. Specifically, Check Point’s monitoring has detected unauthorized access attempts targeting its VPNs available for Windows and macOS customers globally

According to the company’s report shared with Hackread.com ahead of publishing on May 27, 2024. By May 24, 2024, a small number of login attempts using outdated VPN local accounts, which relied solely on password-based authentication, were identified.

In response, Check Point assembled specialized teams comprising Incident Response, Research, Technical Services, and Product professionals to investigate these and other potential threats. Through customer notifications and comprehensive analysis, these teams discovered similar unauthorized access attempts within 24 hours among a few potential customers.

It is important to mention that relying on password-only authentication is a significant security risk. Check Point strongly advises against using this method for network infrastructure login. To counteract these unauthorized remote access attempts, Check Point has released a preventative solution.

**Enhancing VPN Security: Recommendations from Check Point**

1.  **Audit Local Accounts**: Review your local accounts to determine their usage and identify any unauthorized access.
2.  **Disable Unused Accounts**: If local accounts are not in use, it is best to disable them to eliminate potential entry points for attackers.
3.  **Implement Multi-Factor Authentication (MFA)**: For local accounts that are necessary and currently rely on password-only authentication, add layer of security, such as certificates, to enhance IT security.
4.  **Deploy Check Point’s Solution**: Check Point customers should deploy the newly released solution on their Security Gateways. This measure will automatically prevent unauthorized access attempts on VPNs using password-only authentication.

****Industry Expert’s Insight****

Venky Raju, Field CTO at ColorTokens, emphasizes the urgency for organizations to transition from legacy VPNs to Zero Trust Network Access (ZTNA) solutions. He notes, _“_This is a stark reminder for organizations to make urgent plans to shift from legacy VPNs to ZTNA solutions._“_

_“_ZTNA solutions have several advantages over VPNs, chief of which is that ZTNA inherently limits what the end user can access using the principles of least privilege. Additionally, ZTNA solutions better integrate with the enterprise’s identity management system, reducing the risk of compromised passwords or misconfiguration,_”_ Raju advises.

1.  NSA, CISA Release Guidelines to Secure VPNs
2.  Hackers dump login data of Fortinet VPN users in plain-text
3.  Ivanti VPN Flaws Exploited to Spread KrustyLoader Malware
4.  Chinese Hackers Stole Ivacy VPN Certificate To Sign Malware
5.  Akira Ransomware Targets Businesses via Exploited CISCO VPNs

Hackers Target Check Point VPNs, Security Fix Released

By Waqas
A tale of emerging cybercrime and embarrassment for the world's premier law enforcement agency.
This is a post from HackRead.com Read the original post: Breach Forums Return to Clearnet and Dark Web Despite FBI Seizure

Breach Forums returns to the clearnet and dark web just two weeks after the FBI seized its infrastructure and arrested two administrators. One of the admins, ShinyHunters, regained domains despite the FBI’s efforts, highlighting significant operational setbacks and security lapses.

The notorious cybercrime and hacking forum, Breach Forums, has returned to the clearnet and dark web just two weeks after the FBI seized its entire infrastructure. The FBI arrested two administrators in the process.

The operation began on May 15, 2024, when the FBI seized all domains belonging to Breach Forums in a coordinated international effort. The next day, Hackread.com published an exclusive report revealing how ShinyHunters, the hacker and main administrator of Breach Forums, managed to regain the seized domain from right under the nose of the FBI by contacting the Hong Kong-based domain registrar, NiceNIC.

Breach Forums domain urging users to register to view its content (Screenshot: Hackread.com)

****But how did ShinyHunters regain the clearnet domains?****

While the forum has adopted a new domain for the dark web, as the original could not be regained from the FBI, it is back online with the original clearnet domain (breachforums.st). Other associated clearnet domains, including escrow.breachforums.st, breached.in, and two other parked domains, have also been regained from the FBI’s seizure.

ShinyHunters shared an email claiming it was an official conversation between an FBI computer scientist from the agency’s Cyber Division and NiceNIC, the domain registrar. The email, seen by Hackread.com, provides an in-depth background into the incident and how the hacker admin regained access to the seized domains.

****The FBI’s Email****

According to the letter, the FBI’s Cyber Division conducted an operation on May 15, 2024, against Breach Forums, seizing several domains, including breachforums.st, hosted by NiceNIC. The domains were seized legally via a court-ordered warrant.

However, a few hours after the seizure, the breachforums.st domain was returned to the original owner, ShinyHunters, and the FBI’s NiceNIC account, registered as “bf\_fbi,” was suspended.

The FBI then requested NiceNIC to reactivate their account and return the seized domains, citing NiceNIC’s terms of service, which prohibit the promotion of cybercrime. The agency urged that if the domains could not be returned, the nameservers should be changed to FBI-owned servers or the domains should be suspended to prevent further harm.

NiceNIC’s response to the FBI remains unknown. However, the fact that the domain has returned in its original form suggests that the company did not comply with the FBI’s request.

****Email Conversation****

Here is the email conversation as seen by Hackread.com: (Note: The name of the FBI agent has been removed from the email due to security and privacy reasons).

FBI Mail to Registrar: 

I'm a Computer Scientist within the FBI's Cyber Division, and I'm one of the primary point-of-contacts for any domain operations for the FBI. Earlier this week, on May 15th, 2024, the FBI had conducted an operation against the illicit forum and marketplace 'BreachForums'. 

Some public cybersecurity outlets caught wind of the actions, and posted articles on the domain seizure and subsequent splash page. On the morning of the operation, the FBI seized control of a few domains associated with BreachForums, including breachforums.st and others, that were hosted by NiceNic. We were able to lawfully seize them by serving a court-ordered seizure warrant on an account owner located in the United States. 

All of the websites that we seized from the account were dedicated to the theft, sale, and sharing of data stolen from victims around the world. Ultimately, our efforts to take down BreachForums were done to prevent any further damage done by the website to countless victims globally.

However, a few hours after the seizure of the domains, around May 15th at 9PM PST, we noticed that the breachforums.st domain was released from our custody and given back to the original threat actor. We also noticed that we were unable to log into our official FBI account at NiceNic, which was registered with the email \[email protected\] (username: bf\_fbi), leading us to believe that the account was suspended.

As such, I was wanting to provide some additional context around the situation to hopefully overturn the account suspension, in addition to returning the lawfully-seized domains back to the FBI NiceNic account.

Additionally, within your domain registration terms of service, you reference that the services will not be used to "promote hacking, cracking, or other cyber crimes or activities", which is a common activity found within and associated with BreachForums. 

If the domains cannot be returned to the FBI, we would kindly request that the nameservers be changed to FBI-owned nameservers or suspended via a clientHold to prevent further harm in accordance to your terms of service. The NiceNic account which currently holds the domains, 'vincenzotroia', has actively disregarded and broken your service agreements by continuing to host these domains.

I look forward to hearing back from you - we would all really appreciate any help or guidance that you might be able to provide on the situation.

Respectfully,

S\*\*\*

****Embarrassing Situation for The FBI****

The situation is quite embarrassing for the FBI. Despite their efforts to seize the domains of Breach Forums and take down its infrastructure, the fact that the forum was able to quickly regain its original clearnet domains highlights several issues including operational setbacks, security lapses, public perception, and legal and procedural concerns.

This also explains why, despite two weeks having passed, the FBI or the DoJ has not published press releases detailing the seizure. Nevertheless, this situation is a win-win for cybercriminals, but the next move from the FBI and other law enforcement agencies involved in the operation will be crucial to watch.

1.  New Soap2day Domains Emerge Despite Legal Challenges
2.  Data Breach at New BreachForums: 4,000 members’ data leaked
3.  AT&T breach? ShinyHunters selling AT&T database with 70M SSN
4.  FBI Seizes RaidForums, Arrests Alleged Founder Diogo Santos Coelho
5.  BreachForums Owner Pompompurin Gets 20-Year Supervised Sentence

Breach Forums Return to Clearnet and Dark Web Despite FBI Seizure

By Cyber Newswire
Cary, United States, 28th May 2024, CyberNewsWire
This is a post from HackRead.com Read the original post: INE Security Enables CISOs to Secure Board Support for Cybersecurity Training

If there is a single theme circulating among Chief Information Security Officers (CISOs) right now, it is the question of how to get stakeholders on board with more robust cybersecurity training protocols.

There are key points debated about why you should provide cybersecurity training to your IT professionals, like the alarming increase in cyberattacks (an increase of 72% over the all-time high in 2021, according to the Identity Theft Research Center’s 2023 Data Breach Report), or the rapid evolution in technology, creating a constant game of catch-up.

But it isn’t a question of ”if” an organization will be targeted, but “when.” CISOs are increasingly anxious because while they realize the axe will fall on them when the inevitable breach occurs, securing boardroom support for heavy investment in preventative measures, like training, is challenging in a world where revenue is demanded each dollar spent.

“The path to securing the boardroom’s buy-in is more complex than simply having the right statistics and studies on paper,” says Dara Warn, the CEO of INE Security, a global cybersecurity training and certification provider. “To bridge the gap between CISOs and stakeholders, CISOs must adopt a strategic approach that combines financial impact data, relevant case studies, and compelling narratives. Framing cybersecurity training as an essential investment rather than an optional expense is critical.”

****The Human Factor in Cybersecurity****

Cybersecurity is not just about technology; it’s about people. Human error remains one of the leading causes of security breaches. A study by Verizon in their 2023 Data Breach Investigations Report found that 68% of breaches involved a human element, such as social engineering, misuse of privileges, or simple mistakes. This highlights the importance of equipping employees with the knowledge and skills to recognize and respond to potential threats.

****Case Study: Capital One Data Breach****

In 2019, Capital One experienced a data breach that exposed the personal information of over 100 million customers. The breach was caused by a misconfigured web application firewall, which allowed an attacker to access sensitive data stored on Amazon Web Services (AWS). This incident underscores the importance of training employees on cloud security practices and the proper configuration of security tools. In response, Capital One enhanced its cybersecurity training programs to include cloud security, emphasizing the need for regular audits and configuration checks. This case illustrates how specialized training can prevent costly breaches and protect sensitive data.

****The ROI of Cybersecurity Training****

Investing in cybersecurity training is not just a defensive measure; it’s a strategic investment that can yield significant returns. A well-trained workforce, not just security awareness but the SOC and networking teams, can serve as the first line of defense against cyber threats, reducing the likelihood of breaches and minimizing potential damages. According to the Ponemon Institute’s 2023 Cost of Data Breach Report, organizations with extensive incident response planning and testing programs saved $1.49 million compared to those with lower levels.

****Case Study: Maersk NotPetya Attack****

In 2017, shipping giant Maersk was hit by the NotPetya malware, which spread rapidly through its global network, causing a complete shutdown of its IT systems. The attack was initiated by a compromised software update, exploiting poor cybersecurity hygiene and a lack of employee training on identifying malicious software. The incident cost Maersk over $300 million in losses.

In response, Maersk implemented a comprehensive cybersecurity training program focusing on recognizing malicious software, securing software updates, and responding to cyber incidents. This case highlights the necessity of training employees on the latest cyber threats and best practices.

****Crafting a Compelling Narrative for the Boardroom****

The company’s financial data and case studies are important to secure, but communicating that to the boardroom remains a challenge for CISOs. To get the message across, CISOs must also craft a compelling narrative that resonates with the board members. Here are some key strategies:

****1\. Speak the Board’s Language****

Board members are often more attuned to financial metrics and business outcomes than technical jargon. CISOs should frame cybersecurity training as a business enabler that protects the organization’s bottom line. Highlighting the potential financial losses from breaches and the ROI of training programs can make a compelling case.

****2\. Use Real-World Examples****

Real-world case studies, like the attacks on Maersk NotPetya and Capital One, can illustrate the tangible impact of cybersecurity training. These examples provide relatable scenarios that underscore the importance of investing in employee education.

****3\. Leverage Data and Statistics****

Presenting data from reputable sources can lend credibility to the argument. Statistics that demonstrate the prevalence of human error in breaches and the financial benefits of training can be powerful tools in persuading the board.

****4\. Emphasize Regulatory Compliance****

Regulatory requirements, such as GDPR and CCPA, mandate stringent data protection measures. Failure to comply can result in hefty fines and reputational damage. Emphasizing how cybersecurity training can help meet these regulatory requirements can be an effective angle to secure board buy-in.

****5\. Highlight Competitive Advantage****

In an increasingly competitive market, robust cybersecurity measures can be a differentiator. Companies known for their strong security posture are more likely to attract and retain customers. CISOs can highlight how a comprehensive training program can enhance the organization’s reputation and competitive edge.

****Overcoming Common Objections****

Board members may raise objections regarding the cost and time required for cybersecurity training. CISOs should be prepared to address these concerns with data-driven arguments and strategic insights.

****Cost Concerns****

While the initial investment in training programs may seem significant, CISOs can emphasize the long-term cost savings from preventing breaches. According to the Ponemon Institute, the average cost of a data breach in 2023 was $4.45 million. Investing in training can mitigate these costs by reducing the likelihood and severity of breaches.

****Time Constraints****

Board members may worry about the time employees will spend on training. CISOs can advocate for flexible, modular training programs that allow employees to learn at their own pace without disrupting productivity. Additionally, emphasizing the efficiency of targeted training programs can alleviate concerns about time investment.

CISOs are key players in protecting their organizations from cyber threats. Getting the boardroom to buy into an investment in cybersecurity training is no easy task, but utilizing some of these strategies can make it more successful. Including these steps in the process of communicating your needs to stakeholders will help secure the support and resources needed to roll out effective training programs and ultimately better safeguard the organization’s digital and physical assets. The stakes are high, and having all stakeholders on the same team is critical to the long-term success and security of an organization.

****About INE Security****

INE Security is the premier provider of online technical training and cybersecurity certifications. Harnessing the world’s most powerful hands-on lab platform, cutting-edge technology, global video distribution network, and world-class instructors, INE is the top training choice for Fortune 500 companies worldwide, and for IT professionals looking to advance their careers. INE’s suite of learning paths offers an incomparable depth of expertise across cybersecurity, cloud, networking, and data science. INE is committed to delivering advanced technical training, while also lowering the barriers worldwide for those looking to enter and excel in an IT career.

**Contact**

**Press Team**  
**INE**  
**\[email protected\]**

INE Security Enables CISOs to Secure Board Support for Cybersecurity Training

By Deeba Ahmed
Trellix research exposes the dangers of fake antivirus websites disguised as legitimate security software but harbouring malware. Learn…
This is a post from HackRead.com Read the original post: Fake Antivirus Sites Spread Malware Disguised as Avast, Malwarebytes, Bitdefender

Trellix research exposes the dangers of fake antivirus websites disguised as legitimate security software but harbouring malware. Learn how to identify these scams and protect yourself from threats like identity theft and ransomware attacks.

Imagine searching online for an antivirus program to protect your computer, only to stumble upon a website that infects your device with information stealers. This is the deceptive tactic employed by fake antivirus (AV) sites, a growing threat detailed in Trellix’s research titled “A Catalog of Hazardous AV Sites – A Tale of Malware Hosting.”

****Deception Disguised as Security****

In April 2024, Trellix Advanced Research Center team members discovered several fake antivirus sites hosting sophisticated malicious files like APK, EXE, and Inno setup installers. These sites are used to distribute SpyNote trojan, Lumma malware, and StealC malware. The malware hosts include avast-securedownload.com, bitdefender-app.com, and malwarebytes.pro.

****Avast-securedownload.com:****

It hosts a sophisticated APK called Avast.apk that delivers SpyNote Trojan, which can install and delete packages, read call logs, SMS, contacts, storage data, phone state, and more. It also has a recorder, touch activity tracker, and update capabilities.

****Bitdefender-app.com:****

This website delivers a zip file with an EXE named “setup-win-x86-x64.exe.zip” with a discreet TLS callback function. It delivers Lumma malware, targeting sensitive information like PC name, username, HWID, screen resolution, CPU, installed memory, running process, login data, history, cookies, tokens, and user profile information.

****Malwarebytes.pro:****

The website delivers RAR files containing legitimate DLLs, Inno Setup, and StealC infostealing malware. The contents are compressed in gzip and transferred to the attacker’s C2 server. The stolen information includes account tokens, Steam tokens, saved card details, system profiles, Telegram logins, running process names, installed browser lists, and common system information.

****Malicious Binaries****

According to Trellix’s blog post, researchers also discovered a binary called AMCoreDat.exe, which facilitates the deployment of stealer malware. The attacker uses a sophisticated method to obfuscate the payload, stealing victim information, including PC name, username, browsing history, cookies, tokens, etc., and sends it to a C2 server.

Fake Avast, Malwarebytes and Bitdefender sites reported by Trellix

****Possible Dangers****

Unaware users, seeking to safeguard their devices, get easily tricked into downloading malicious software disguised as antivirus programs because these sites appear professional, complete with logos, fake testimonials, and urgency-inducing language about potential threats.

The consequences of falling victim to these scams can be severe, including identity theft, financial loss, sensitive data breaches, ransomware attacks and potentially hefty ransom demands.

Researchers suspect these website addresses are distributed by malicious advertising and SEO poisoning strategies. To mitigate risks, it is recommended to follow security measures like using strong cybersecurity solutions, avoiding pirated software, and verifying software legitimacy with your end-point provider.

1.  Malicious Android Apps Masked as Anti-virus Software
2.  Fake Popular Software Ads Deliver MadMxShell Backdoor
3.  Fake Skype, Zoom, Google Meet Sites Spread Multiple RATs
4.  Hackers steal source code of top anti-virus firms to sell online
5.  Fake LastPass Password Manager App Lurks on iOS App Store

Fake Antivirus Sites Spread Malware Disguised as Avast, Malwarebytes, Bitdefender

By Uzair Amir
Uncover IT security weaknesses and ensure compliance with infosec audits. Regular audits protect your data from breaches &…
This is a post from HackRead.com Read the original post: What is an Infosec Audit and Why Does Your Company Need One?

Uncover IT security weaknesses and ensure compliance with infosec audits. Regular audits protect your data from breaches & meet regulations. Learn more about infosec audits for your business!

With cyber threats continuing to grow in scale and sophistication, companies of all sizes face serious risks of data breaches, hacking attacks, and vulnerabilities in their IT systems. To protect sensitive customer and business data as well as maintain compliance with regulations, regular information security (infosec) audits are a must. But what exactly is an infosec audit and why is it so crucial for organizations in today’s environment?

****What is an Infosec Audit?****

An infosec audit is a thorough examination and evaluation of a company’s information security policies, procedures, and systems. The goal is to identify potential weaknesses, gaps, and risks so they can be addressed before a security incident occurs.

Infosec audits are typically performed by either internal IT security staff or third-party cybersecurity firms. The audit may evaluate:

*   Incident response and disaster recovery plans
*   Security policies and procedures
*   Employee security training and awareness
*   Vulnerability scanning and penetration testing results
*   Vendor, contractor, and third-party security practices
*   Physical security of data centers, servers, laptops, etc.
*   Compliance with regulations like HIPAA, PCI DSS, GDPR, etc.
*   Security controls like firewalls, encryption, malware protection, access controls, etc.

The audit report will outline findings, assign risk ratings, and provide actionable recommendations for strengthening defences based on best practices.

****Why Your Company Needs Infosec Audits****

There are several compelling reasons why organizations should conduct periodic infosec audits:

1.  **Identify Gaps Before Hackers Do:** Skilled cybercriminals are constantly probing networks for any crack in security they can exploit. An audit finds weaknesses so the IT team can address them before attackers infiltrate the system.
2.  **Meet Compliance Requirements:** Most industry regulations include stipulations around infosec controls and best practices. Audits verify those requirements are met, avoiding fines for non-compliance.
3.  **Improve Security Posture:** An audit provides a clearer picture of vulnerabilities and how to tackle them. Taking action on the findings enhances overall security and reduces risk.
4.  **Protect Reputation and Customer Trust:** If a breach does occur, audits show regulators and customers the company has taken steps to lock down data security. This helps maintain reputation and public trust.
5.  **Support Cyber Insurance Claims:** Audits give insurers confidence in a company’s security posture. Having audit documentation also smooths cyber insurance claims if a breach happens.

Regular audits ensure security controls and procedures are keeping pace as the company adds new technologies and digital initiatives. Audits also benchmark security performance compared to industry best practices and compliance frameworks. Well-documented audits demonstrate due diligence to customers, business partners, regulators, and cyber insurance providers in the event of a breach.

****Leverage Automation to Streamline Audits****

New compliance automation software is emerging to simplify audit processes. Features like automated policy scanning, evidence collection, and control mapping reduce manual effort so audits can be performed more frequently.

Regular infosec audits provide immense value for understanding security gaps, achieving compliance, and ultimately protecting critical business systems and data. Leveraging automation software can help companies cost-effectively scale and streamline auditing. Given the ever-present risk of cyber threats, audits are a must-have component of every organization’s cyber risk management strategy.

1.  Network Pentesting Checklist
2.  What Is Incident Management Software?
3.  Best Practices for Cloud Computing Security
4.  Top 9 Compliance Automation Software in 2024
5.  How to Recover Deleted Emails from Exchange Server?
6.  Cybersecurity risk assessment: Does Your Company Need It?

Source

HackRead