Attacks on your network are often meticulously planned operations launched by sophisticated threats. Sometimes your technical fortifications provide a formidable challenge, and the attack requires assistance from the inside to succeed. For example, in 2022, the FBI issued a warning1 that SIM swap attacks are growing: gain control of the phone and earn a gateway to email, bank accounts, stocks,

Insider Threats / Cybersecurity

Attacks on your network are often meticulously planned operations launched by sophisticated threats. Sometimes your technical fortifications provide a formidable challenge, and the attack requires assistance from the inside to succeed. For example, in 2022, the FBI issued a warning1 that SIM swap attacks are growing: gain control of the phone and earn a gateway to email, bank accounts, stocks, bitcoins, identity credentials, and passwords. This past spring, current and former T-Mobile and Verizon employees reported receiving unsolicited text messages asking if they would be interested in some side cash2 in exchange for intentionally enabling the "_SIM jacking."_

These headline-grabbing stories about the malicious insider are certainly real, but many external attacks stem from a much less conspicuous source: **the accidental insider**. These are career employees, contractors, partners, or even temporary seasonal workers who, through negligence or lack of awareness, enable the exploitation of internal weaknesses.

**Accidental insiders unintentionally compromise security due to:**

*   Lack of Awareness: Employees unfamiliar with cybersecurity best practices may fall victim to phishing campaigns, open malware-infected attachments, or click links to malicious sites. Awareness is tied to company culture and reflects the effectiveness of nontechnical controls, especially leadership.
*   Pressure to Perform: Your employees learn how and when to "bend" the rules or circumvent technical controls to get the job done or to meet a demanding deadline.
*   Poor Credential Handling: Weak passwords, password sharing, and password reuse across personal and business accounts make it easier for attackers to gain unauthorized access.
*   Sneakernets: Unauthorized and uncontrolled movement of data across security domains and to personal removable media or public cloud services.

**By unwittingly compromising security best practices, accidental insiders pave the way for external attacks in several ways:**

*   Initial Attack: Phishing emails can trick unwitting insiders into revealing network or application credentials, allowing attackers to gain access to internal systems. This initial attack vector becomes the foundation for future attacks.
*   Elevated Privileges: Accidental download of malware by an insider can grant attackers elevated privileges, allowing them to tamper with critical systems or steal large amounts of data.
*   Lateral Movement: Once inside, attackers will leverage the insider's access privileges to move laterally across the network, accessing sensitive data and applications or deploying malware to other systems.
*   Social Engineering: Social engineering tactics exploit human trust. Attackers can impersonate managers and colleagues to manipulate insiders into divulging sensitive information or exercising their privileges to the benefit of the external threat.

**The consequences of an accidental insider-facilitated attacks can be significant:**

*   Financial Losses: Data losses resulting from insider negligence and ambivalence leads to hefty fines, legal repercussions, and the cost of remediation.
*   Reputational Damage: Public disclosure of an insider event can severely damage the organization's reputation, leading to lost business and erosion of customer trust.
*   Operational Disruption: Attacks can disrupt business operations, leading to downtime, lost productivity, and hindered revenue generation.
*   Intellectual Property Theft: Foreign states and competitors may use stolen intellectual property to gain an unfair market advantage.

**The good news is that the risk posed by accidental insiders can be significantly reduced through proactive measures:**

*   Security Awareness Training: Regularly educate employees on cybersecurity best practices, including phishing awareness, password hygiene, and secure data handling techniques.
*   Culture of Security: Foster a culture of security within the organization where employees feel comfortable reporting suspicious activity and where managers are educated and empowered to leverage internal resources to address security concerns.
*   User Activity Monitoring (UAM): Monitor for compliance with acceptable use policies and increase the observation of privileged users with elevated access and the ability to manipulate security controls. Add behavioral analytics to examine UAM and other enterprise data to help analysts identify the riskiest users and organizational issues, such as hostile work environments revealed through sentiment analysis. Hostile work environments reduce employee engagement and increase disgruntlement, a dangerous recipe for insider risk.
*   Content Disarm and Reconstruction (CDR): Proactively defend against known and unknown threats contained in files and documents by extracting legitimate business content and discarding untrusted content, including malware and untrusted executable content.
*   Cross Domain Solutions: Eliminate sneaker nets and unauthorized cloud service usage and replace these practices with automated policy-driven deep inspection of content in an unencumbered user experience. Enable your employees to safely, securely, and quickly move data across security domains that enable business processes while protecting data and information systems.
*   Institutionalize Accepted Best Practices: Carnegie Mellon SEI CERT, MITRE, the NITTF, and CISA are examples of some of the organizations that have published best practices that incorporate organizational controls across leadership, human resources, and other elements affecting the employee lifecycle and coherent technical controls that act as guardrails protecting against accidental and malicious insiders.

Accidental insiders pose a significant threat that can leave organizations vulnerable to external attacks. However, by implementing proper training, technical and organizational controls, and fostering a security-conscious culture, organizations can significantly **reduce the risk.**

Defend against risks posed by trusted insiders with Everfox Insider Risk Solutions.

_**Note:** This article is written by Dan Velez, Sr. Manager of Insider Risk Services at Everfox, with over 16 years of experience in insider risk and threat at Raytheon, Amazon, Forcepoint, and Everfox._

1.  https://www.ic3.gov/Media/Y2022/PSA220208
2.  https://www.bloomberg.com/news/newsletters/2024-04-19/t-mobile-verizon-find-cracking-down-on-sim-card-scams-is-hard-to-do

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Navigating Insider Risks: Are your Employees Enabling External Threats?

A China-linked threat actor called APT17 has been observed targeting Italian companies and government entities using a variant of a known malware referred to as 9002 RAT.
The two targeted attacks took place on June 24 and July 2, 2024, Italian cybersecurity company TG Soft said in an analysis published last week.
"The first campaign on June 24, 2024 used an Office document, while the second

Cyber Espionage / Threat Intelligence

A China-linked threat actor called **APT17** has been observed targeting Italian companies and government entities using a variant of a known malware referred to as 9002 RAT.

The two targeted attacks took place on June 24 and July 2, 2024, Italian cybersecurity company TG Soft said in an analysis published last week.

"The first campaign on June 24, 2024 used an Office document, while the second campaign contained a link," the company noted. "Both campaigns invited the victim to install a Skype for Business package from a link of an Italian government-like domain to convey a variant of 9002 RAT."

APT17 was first documented by Google-owned Mandiant (then FireEye) in 2013 as part of cyber espionage operations called DeputyDog and Ephemeral Hydra that leveraged zero-day flaws in Microsoft's Internet Explorer to breach targets of interest.

It's also known by the monikers Aurora Panda, Bronze Keystone, Dogfish, Elderwood, Helium, Hidden Lynx, and TEMP.Avengers, not to mention shares some level of tooling overlap with another threat actor dubbed Webworm.

9002 RAT, aka Hydraq and McRAT, achieved notoriety as the cyber weapon of choice in Operation Aurora that singled out Google and other large companies in 2009. It was also subsequently put to use in another 2013 campaign named Sunshop in which the attackers injected malicious redirects into several websites.

The latest attack chains entail the use of spear-phishing lures to trick recipients into clicking on a link that urges them to download an MSI installer for Skype for Business ("SkypeMeeting.msi").

Launching the MSI package triggers the execution of a Java archive (JAR) file via a Visual Basic Script (VBS), while also installing the legitimate chat software on the Windows system. The Java application, in turn, decrypts and executes the shellcode responsible for launching 9002 RAT.

A modular trojan, 9002 RAT comes with features to monitor network traffic, capture screenshots, enumerate files, manage processes, and run additional commands received from a remote server to facilitate network discovery, among others.

"The malware appears to be constantly updated with diskless variants as well," TG Soft said. "It is composed of various modules that are activated as needed by the cyber actor so as to reduce the possibility of interception."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

China-linked APT17 Targets Italian Companies with 9002 RAT Malware

PRSS RELEASE

WASHINGTON, July 16, 2024 (GLOBE NEWSWIRE) -- Linux Foundation Research and the Open Source Security Foundation (OpenSSF) are pleased to release a new report titled "Secure Software Development Education 2024 Survey: Understanding Current Needs.” Based on a survey of nearly 400 software development professionals, the analysis explores the current state of secure software development and underscores the urgent need for formalized industry education and training programs.  

Attackers consistently discover and exploit software vulnerabilities, highlighting the increasing importance of robust software security. Despite this, many developers lack the essential knowledge and skills to effectively implement secure software development. Survey findings outlined in the report show nearly one-third of all professionals directly involved in development and deployment — system operations, software developers, committers, and maintainers — self-report feeling unfamiliar with secure software development practices. This is of particular concern as they are the ones at the forefront of creating and maintaining the code that runs a company’s applications and systems.

“Time and again we’ve seen the exploitation of software vulnerabilities lead to catastrophic consequences, highlighting the critical need for developers at all levels to be armed with adequate knowledge and skills to write secure code,” said David A. Wheeler, director of open source supply chain security for the Linux Foundation. “Our research found that a key challenge is the lack of education in secure software development. Practitioners are unsure where to start and instead are learning as they go. It is clear that an industry-wide effort to bring secure development education to the forefront must be a priority.” OpenSSF offers a free course on developing secure software (LFD121) and encourages developers to start with this course.

Survey results indicate that the lack of security awareness is likely due to most current educational programs prioritizing functionality and efficiency while often neglecting essential security training. Additionally, most professionals (69%) rely on on-the-job experience as a main learning resource, yet it takes at least five years of such experience to achieve a minimum level of security familiarity.

Other key findings of the survey include the following:

*   Lack of time (58%) and lack of awareness and training (50%) are the top two most common challenges in implementing secure software development practices within organizations.
    
*   The top reason (44%) for not taking a course on secure software development is lack of knowledge about a good course on the topic.
    
*   Self-directed learning methods were most prevalent, with 74% of respondents reporting using such resources as online tutorials, videos, and books as their main learning method.
    
*   Emerging security concerns such as AI (57%) and supply chain (56%) are seen as critical future areas for innovation and attention.
    

“The first step in addressing secure software development is recognizing the existing knowledge gap and identifying priority areas for creating additional training,” said Christopher “CRob” Robinson, Intel, co-chair of the OpenSSF Education Special Interest Group (SIG) and chair of the OpenSSF Technical Advisory Council (TAC). “Based on these findings, OpenSSF will create a new course on security architecture which will be available later this year which will help promote a ’security by design’ approach to software developer education.”

View the full report to learn more about OpenSSF’s training materials and guides on secure software development. Industry professionals are encouraged to sign up for the OpenSSF’s free course Developing Secure Software (LFD121).

About the OpenSSF

The Open Source Security Foundation (OpenSSF) is a cross-industry initiative by the Linux Foundation that brings together the industry’s most important open source security initiatives and the individuals and companies that support them. The OpenSSF is committed to collaborating and working upstream and with existing communities to advance open source security. For more information, please visit us at openssf.org.

About the Linux Foundation

The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects are critical to the world’s infrastructure, including Linux, Kubernetes, Node.js, ONAP, OpenChain, OpenSSF, PyTorch, RISC-V, SPDX, and more. The Linux Foundation focuses on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

The Linux Foundation and OpenSSF Release Report on the State of Education in Secure Software Development

SOC analysts should also cultivate skills like incident handling and response, threat hunting, digital forensics, Python, and bash scripting.

Source: Artem Samokhvalov via Shutterstock

Though artificial intelligence is poised to drastically transform enterprise security operations centers (SOCs), for the moment at least, the top three technologies for new hires to be familiar with remain SIEM, host-based extended detection and response, and vulnerability remediation.

But a trio of other hard skills scored highly in a survey of some 400 cybersecurity practitioners that the SANS Institute conducted on behalf of Torq. These include a knowledge of cloud security issues, PowerShell expertise, and the ability to automate repetitive tasks and systems management functions.

**Core Hard Skills**

Besides the top three skills, "the core hard skills that are currently essential for SOC analysts include: incident handling and response, threat hunting, cloud security, digital forensics, Python, PowerShell, and bash scripting," says Dallas Young, senior technical product manager at Torq.

"As for soft skills, those include critical thinking and creative, informed problem solving, attention to detail in rapidly changing environments, and communication skills at both a technical and interpersonal level," he says.

The SANS survey polled respondents from small, medium, and large companies in the US and other countries about their top SOC challenges. The responses showed that many organizations continue to struggle with issues that have plagued them for years. These include a lack of automation and orchestration of key SOC functions, high-staffing requirements, a shortage of skilled staff, and a lack of visibility. They also reported a pervasive silo mentality among security, incident response, and operations teams.

**SOC Retention Rates Improve**

On the positive side though, the survey showed a surprising uptick in staff retention rates at many SOCs. Some 30% of respondents — a plurality — identified the average SOC tenure at their organization as being between three and five years, compared to the one-to-three year tenures that respondents indicated in previous SANS surveys.

Young chalks up the trend to the increasing automation of Tier-1 triage and analysis at more organizations. This has enabled SOC analysts to focus on more strategic and intellectually stimulating activities, such as threat hunting and advanced incident response. It's also helped alleviate the analyst burnout problem, he says.

Other factors that appear to have contributed to the increased retention rates include better work environments, with remote and flexible hours and management-track leadership training for high performers. "In addition, for security analysts who want to maintain a technical focus, organizations are paying for more training and certification opportunities in areas of interest such as penetration testing, reverse malware engineering, and cloud security subject matter areas as examples," Young says.

Jake Williams, faculty at IANS Research and vice president of R&D at Hunter Strategy, says current job market conditions have allowed many organizations to secure more experienced SOC analysts at the same budget than they could a few years ago. "This is a good thing for organizations short term, but they should be making plans now for when the job market rebounds," Williams says. "Many organizations are camouflaging a lack of process with the skills these more senior analysts bring to the table."

**Cloud Knowledge, ID Management, PowerShell Are Hot Skills**

Like Young, Williams says the biggest in-demand SOC skills — outside of the obvious core skills of SIEM and XDR — are knowledge of cloud platforms such as AWS and Azure, and understanding of Active Directory and Entra ID. "I've seen a lot more expectation of baseline cloud knowledge, especially for senior SOC analysts," Williams notes. Given the prolific use of M365 in enterprise, there's an expectation that many senior SOC analysts know PowerShell to query GraphAPI, he says, "PowerShell experience and cloud platform knowledge were niche skills a few years ago. For midtier to senior SOC analysts today, it seems like table stakes."

The SANS survey showed that many SOC practitioners aren't thrilled with their initial usage of artificial intelligence and machine learning tools for SOC analysis purposes. In fact, respondents gave AI and ML tools the lowest rating when asked to rate SOC tools. However, there's little doubt that AI and GenAI technologies are set to fundamentally change the SOC and, in the process, the skills landscape as well.

Young says AI will fundamentally continue moving forward to enhance automated threat detection, proactive threat hunting, automation of repetitive and time-consuming tasks, alert fatigue reduction, and predictive analytics. Increasingly, SOC analysts are going to need to be familiar with machine learning algorithms and data analysis techniques to interpret AI-generated insights, Young says. They will also need skills to handle complex security incidents identified by AI systems and be willing to continuously learn and adapt to new AI technologies and methodologies, he says.

**"Why Does That Matter?"**

Williams expects AI tools to reduce the need for analysts whose sole role has been to respond to basic alarms. "Junior analysts should be looking now at what tasks AI does — and doesn't — do well and educating themselves in the places they can't be replaced by AI, such as critical thinking," he says. "The SOC of the future will be less about knowing that port 3389 is RDP — AI will provide that context on demand — and more about providing the 'why does that matter in this context?'"

Creative thinking when it comes to interesting problems and correlations will remain a key asset for SOC professionals, says Sajeeb Lohani, senior director of cybersecurity at Bugcrowd. "Nowadays, SIEMs are capable of raising alerts, so it is quite easy to fall into a rut and churn tickets," he says. "However, in my opinion, the most successful professionals are able to correlate events and understand business context when triaging and responding to such alerts. That context is key."

Lohani expects that some threats that are considered relatively niche issues in the SOC will become more important over the next few years. "Currently, a large portion of SOCs haven't had to deal with more niche threats like supply chain security issues," he says. "I believe, over time, that will start to change, and more mature practices will \[be needed\] to prepare and adapt."

**About the Author(s)**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Cloud Security, PowerShell Expertise Emerge as Key SOC Analyst Skills

PRESS RELEASE

ATLANTA, July 16, 2024 /PRNewswire/ -- Secureworks® (NASDAQ: SCWX), a global leader in cybersecurity, today announced the launch of Taegis™ ManagedXDR Plus, a new Managed Detection and Response (MDR) offering that liberates the mid-market from indistinct, cookie cutter security solutions that don't meet their unique security requirements. Today's announcement means that this market sector will no longer be forced to use homogenous cybersecurity solutions that don't align to unique environments or the AI-fueled attacks that target them. Taegis ManagedXDR Plus empowers companies with the tailored use cases, compliance reports, and alerting they need to tackle the rising tide of cyberattacks and regulations with limited budget and people.

Nearly one in three (30%) mid-market companies experienced at least one ransomware attack in 20231 highlighting the need for organizations to strengthen their cyber resiliency with a proactive approach, tailored to their environment. Taegis ManagedXDR Plus addresses the evolving needs of this market sector with greater customization and flexibility on alerting, workflows, and reports to address their specific environment, industry regulations, and risk profile. These personalized configurations are supported by expanded threat hunting and access to proactive services to further increase their vigilance against threats. Organizations can see more, detect better, and respond faster by leveraging Secureworks security operations expertise and threat intelligence to fortify their cyber resiliency and exposure management.

"Until today, the mid-market has had to make do with security solutions that do little to bolster their cyber posture. Yet as the economic driving force for countries around the world, the butterfly effect of a cyberattack on organizations in this sector can often be felt far and wide, testing the digital resilience of the wider global economy. It is imperative for our collective defense that organizations of all sizes have access to cybersecurity that improves their security posture within the reality of their budget," said Kyle Falkenhagen, Chief Product Officer, Secureworks. "The cost of building a SOC in-house quickly escalates when you consider the breadth and depth of expertise required for these advanced challenges, let alone the costs of hiring, training and retaining a robust staff for 24/7 coverage. Taegis ManagedXDR Plus enables mid-market customers to take full advantage of the Taegis platform and our in-house experts to up-level their security to an enterprise level without breaking their budget."

Delivered using the Secureworks Taegis XDR platform, Taegis ManagedXDR Plus expands upon the capabilities of Secureworks Taegis ManagedXDR solution in several areas:

*   Tailored AI Enriched Use Cases: Taegis ManagedXDR Plus customers can leverage customization options tailored to their specific needs.
    
*   Expanded Threat Hunting: This new tier quadruples the number of AI assisted threat hunts available as part of Taegis ManagedXDR, and allows for customized requests to more rapidly uncover emerging and undiscovered threat actors targeting their environments.
    
*   Premium Support with Named Experts: Customers can also tap into the knowledge of Secureworks experts to further optimize Taegis in their environment, including 1x1 guidance to help efficiently build their security posture over time.
    
*   Proactive Security Services: Customers can select from a range of proactive security services to further raise their resiliency, identify gaps in posture, and deepen Taegis knowledge.
    

Secureworks now offers three tiers within its Taegis ManagedXDR portfolio - Taegis ManagedXDR, Taegis ManagedXDR Plus and Taegis ManagedXDR Enhanced - delivering on the company's commitment to meet customers wherever they are on their security journey. Regardless of the tier, Taegis ManagedXDR customers enjoy transparent pricing in an inclusive model which includes direct access to security experts within 90 seconds, one year of log retention to assist in threat hunting and compliance needs, hundreds of integrations to unify their existing ecosystem, and more to provide mid-market customers peace of mind and predictability in their cybersecurity budget.

"In an increasingly sophisticated cybersecurity landscape, enterprises find it challenging to handle security operations by themselves. These organizations have distinct needs. Secureworks acknowledges this and provides increased flexibility with Taegis ManagedXDR Plus," said Lucas Ferreyra, cybersecurity industry analyst, Frost & Sullivan. "This new MDR service tier delivers additional capabilities that multiply the value of Secureworks MDR service, further enhancing prevention, detection and response, and showing why Secureworks is one of the leaders in the MDR space."

For more information, please visit the Taegis ManagedXDR Plus web page.

About Secureworks

Secureworks (NASDAQ: SCWX) is a global cybersecurity leader that secures human progress with Secureworks® Taegis™, a SaaS-based, open XDR platform built on 20+ years of real-world detection data, security operations expertise, and threat intelligence and research. Taegis is embedded in the security operations of thousands of organizations around the world who use its advanced, AI-driven capabilities to detect advanced threats, streamline and collaborate on investigations, and automate the right actions.

Secureworks Elevates State of Cybersecurity for Mid-Market Customers With Managed Detection and Response Offering

The gang already uses varied tools in its attacks, such as phishing, SIM swapping, and MFA fatigue.

Source: Stephen Street via Alamy Stock Photo

Octo Tempest, a threat actor also known as Scattered Spider, has added RansomHub and Qilin to its repository for use in attacks, Microsoft's Threat Intelligence Team is warning.

The gang, which first arrived on the scene in 2022, is known for its social engineering techniques, which Microsoft describes as sophisticated, as well as identity compromises, targeting of VMware ESXi servers, and deployment of BlackCat ransomware. It was also infamously behind the massive ransomware attacks on Caesars Palace and MGM Entertainment last year.

Other tactics, techniques, and procedures (TTPs) the group is known to use include impersonating IT employees to deceive company staff into providing credentials or gaining persistence using remote access tools, as well as phishing, MFA bombing, and SIM swapping.

Qilin ransomware also surfaced in 2022 under a different name, "Agenda," but quickly rebranded. The group is known to have targeted and claimed more than 130 companies, demanding ransoms from as low as $25,000 and well into millions, and is developing a customizable Linux encryptor to target VMware ESXi servers, according to Microsoft. RansomHub, meanwhile, is a ransomware-as-a-service (RaaS) offering that is becoming increasingly favored by threat actors, "making it one of the most widespread ransomware families today," the tech giant said via X.

Octo Tempest accounts for a significant number of the investigations that the Microsoft team covers, it said, and has dominated incident response engagements it has received since first gaining attention through its "oktapus" campaign, which targeted over 130 well-known organizations.

Microsoft: Scattered Spider Widens Web With RansomHub &amp; Qilin

As attackers set their sights on infrastructure, security teams need to reduce risk levels without compromising operational agility.

Amir Hirsh, SVP & General Manager of OT Security, Tenable

July 16, 2024

4 Min Read

Source: ElenaBs via Alamy Stock Photo

COMMENTARY

Hackers affiliated with the Chinese government have reportedly maintained access to US critical infrastructure for years, several agencies warned in February. The revelation is, at least on the surface, a heel-turn for Chinese cyber behavior — moving from espionage to the potential compromise or destruction of infrastructure via operational technology (OT). This includes the programmable systems and devices connected to physical environments.

Last December, a supply chain-focused attack against ShipManager software from maritime advisory company DNV reportedly disrupted operations for dozens of its clients — affecting as many as 1,000 vessels. In November, the Cybersecurity and Infrastructure Security Agency warned of Iranian actors actively exploiting Unitronics equipment used in water and wastewater systems, prompting a later warning from the Environmental Protection Agency (EPA) and the White House. The EPA also warned in May that a whopping 70% of US water systems fail its cybersecurity standards.

Similar OT systems have been connected to the Internet to enable remote monitoring and control, but that convenience has opened up avenues for attackers. These systems were often built for reliability before widespread connectivity. They are often implemented with niche solutions and can be difficult to audit and protect.

OT attacks, along with IT attacks on infrastructure supporting these operational environments, can take down customers' supply chains, damage equipment, and result in costly production disruptions: According to a study by ITC, four in 10 enterprise organizations said one hour of downtime can cost from $1 million to over $5 million.

Keeping the lights on in these increasingly complex environments is no easy feat. OT needs even higher levels of protection than that afforded to IT, since a single OT breach can cascade across multiple systems. Here, I'll outline three key steps for defending these environments, which begins with understanding OT's cyber-physical impacts and complexities.

**1\. Eliminate Gaps Across Environments**

Convergence of security between IT and OT is accelerating, but the two cannot be completely independent workstreams. Managing OT security is not a "set it and forget it" or reactive process, and vulnerability management cannot be lax. An effective strategy meant to reduce OT risk and protect operational uptime requires full asset visibility, and oftentimes there is crossover with IT.

With greater visibility, defenders can gather accurate and continuous telemetry data. Acquiring it, however, will entail ongoing communication and collaboration with the IT teams who have traditionally overseen Internet-facing devices.

IT and OT defenders can establish cross-functional teams and carry out joint risk assessment exercises. This open line will generate a better understanding about how assets communicate with each other, which apps are running (and where), and how user privileges are configured. The visibility gives teams greater control over their organizational infrastructure and can inform critical decision-making processes.

**2\. Develop Comprehensive OT Playbooks**

Once assets are mapped and better understood, the next step is a standardization of security practices. Defenders should create or evolve OT security playbooks and consider a range of scenarios.

Plans should draw from the organization's existing knowledge base, outline step-by-step incident response protocols, and define reactive steps among all business units and executives — for instance, documenting which teams or partners must respond in the event of a sector-specific worst-case scenario, such as a critical pipeline being held for ransom.

OT defenders should also regularly monitor guidance disseminated by the National Institute of Standards and Technology (including the new governance pillar of the NIST CSF framework) and intelligence agencies, along with industry groups and vendors.

**3\. Implement Robust Controls**

With more systems coming online, the general widening of the OT attack surface necessitates powerful exposure management technology. In fact, this is a point my colleagues and I continue to raise in different forums, as threat actors, like China-backed entities, continue to shift their tactics.

Sophisticated advanced persistent threats (APTs), like China's Volt Typhoon, increasingly rely on living-off-the-land techniques — using legitimate, embedded services to carry out their crimes. This can cloak their network activity and make traditional indicators of compromise highly difficult to detect. This ultimately dilutes the impact of more traditional security technologies.

Defenders simply cannot overlook this threat. They must be able to contextualize data and resolve issues before they can be exploited, performing functions like high-speed asset discovery and malware detection.

**Moving Away From Reactive Policies**

Given the rise of ransomware attacks in OT environments — more than half of polled industrial firms confirming they've suffered a related incident — there is new urgency tied to this domain. In fact, these events have created space for security teams to advocate internally for more robust controls.

Luckily, as part of this effort, organizations are steadily moving away from the reactive policies that once guided OT and instead are looking more holistically at the intricate web of networks and devices across their operations.

By using these tips, security teams can effectively reduce risk levels without compromising operational agility. OT infrastructure demands time and attention, but greater security will help protect physical environments from the advances of prominent APTs.

**About the Author(s)**

SVP & General Manager of OT Security, Tenable

Amir Hirsh is a technological entrepreneur based in Israel with over 20 years of experience. He has been instrumental in the creation, growth and sale of numerous companies covering cyber, AI, and media.

Amir leads Tenable's platform, exposure management, and operational technology (OT) business units, driving continued product innovation and development to address both present and future market needs. He also oversees Tenable's go-to-market, marketing, and engineering teams. He is a creative thinker and an innovative tech and business leader with an execution-focused management style.

As a key leader at Tenable, Amir speaks regularly at various industry events and conferences, and his views on market trends and the technology innovation driving them have been covered in many media outlets.

Defending OT Requires Agility, Proactive Controls

The threat group used CVE-2024-38112 and a "zombie" version of IE to spread Atlantida Stealer through purported PDF versions of reference books.

Source: Ezyjoe via Alamy Stock Photo

New details have emerged about how an advanced persistent threat (APT) group exploited an unpatched Microsoft zero-day in a spear-phishing campaign to spread the Atlantida Stealer, which lifts system information and sensitive data such as passwords and cookies from various applications.

A blog post published July 15 by Trend Micro sheds new light on how the APT, dubbed Void Banshee, which used the flaw (CVE-2024-38112)against victims in North America, Europe, and Southeast Asia. The bug exists in the MSHTML (Trident) engine for the now retired Internet Explorer (IE) browser, but it can be exploited on a victim's machine even if IE is disabled or not the default browser.

It's an "alarming" attack given that IE has "historically been a vast attack surface but now receives no further updates or security fixes," Trend Micro senior threat researcher Peter Girnus and malware reverse engineer Aliakbar Zahravi wrote in the post.

The Void Banshee campaign lured victims via zip archives containing malicious files disguised as book PDFs that were disseminated via cloud-sharing websites, Discord servers, and online libraries, among others sectors, the researchers found. This is a typical tactic of the group, which tends to target victims both for information stealing and financial gain, they noted.

"\[Atlantida\] malware focuses on extracting stored sensitive and potentially valuable data, such as passwords and cookies, and it can also collect files with specific extensions from the infected system's desktop," the researchers wrote. "Moreover, the malware captures the victim's screen and gathers comprehensive system information."

**New Details on Zero-Day Exploitation**

Separately, security researchers already had revealed that unidentified threat groups were exploiting the IE flaw — which was patched in Microsoft's July Patch Tuesday update— to spread Atlantida and other malware in malicious PDF files.

Microsoft described CVE-2024-38112 as a spoofing vulnerability that could have a high impact on system confidentiality, integrity, and availability if successfully exploited, but only gave it a moderately high severity rating of 7.5 out of 10 on the CVSS vulnerability-severity scale. That's because that for an attack to be successful, an attacker would need to convince a victim to interact with the weaponized URL file, among other factors.

Trend Micro's report provides new details about how Void Banshee was able to get Windows users to do this by convincing targets in a spear-phishing campaign to open URL shortcut files designed to look like PDF copies of a book — specifically, textbooks and reference materials such as "Clinical Anatomy."

This "suggests the campaign is targeting highly skilled professionals and students who often use reference materials and places where digital copies of books are collected," the researchers wrote.

**CVE-2024-38112 Exploitation & Payload Behavior**

A previously revealed attack vector described by Check Point security researcher Haifei Li detailed how malicious shortcuts when could use IE — even if it's not the default browser — to open an attacker-controlled URL by calling the defunct browser instead of a more secure browser such as Chrome or Edge. The vector hid dangerous HTML application (HTA) files in PDF documents that looked safe to users.

Trend Micro's report describes how Void Banshee did this by distributing URL files that contained the MHTML protocol handler and the x-usc! directive, which allowed the group to access and run HTA files directly through the disabled IE process. When a victim opens what looks like an innocuous PDF, it instead opens the URL target in the native IE through the iexplore.exe process.

"The Internet shortcut file that exploits CVE-2024-38112 points to an attacker-controlled domain where an HTML file downloads the HTA stage of the infection chain," the researchers explained. "Using this HTML file, the attacker can also control the window view size of the website through IE. This is used by the threat actor to hide browser information and to mask the downloading of the next stage of the infection chain from the victim."

As mentioned, the attack ultimately delivers the Atlantida stealer, which is built from open source stealers NecroStealer and PredatorTheStealer. It targets sensitive information from various applications, including Telegram, Steam, FileZilla, various cryptocurrency wallets, and Web browsers. The malware then compresses the stolen data into a zip file and sends it back to an attacker-controlled command-and-control (C2) site over TCP port 6655.

**"Zombie Relics" Like IE Remain Dangerous**

Overall, the attacks on CVE-2024-38112 demonstrate how even technology like IE that is no longer supported or even in active use at an organization can still pose a major threat, according to Trend Micro.

"Even though users may no longer be able to access IE, threat actors can still exploit lingering Windows relics like IE on their machine to infect users and organizations with ransomware, backdoors, or as a proxy to execute other strains of malware," the researchers wrote.

Furthermore, the ability of threat actors to access unsupported and disabled system services to circumvent modern Web sandboxes, such as IE mode for Microsoft Edge, poses "a significant industry concern," they wrote.

Patching the flaw is the most obvious way to thwart current exploitation of the IE issue, the researchers noted. Trend Micro also included a list of MITRE ATT&CK techniques and a link to indicators of compromise (IoCs) in its post.

According to Trend Micro, organizations also should take a proactive approach and engage in advanced threat intelligence as well as adopt a security posture that is constantly monitoring scanning software and other corporate network assets for potential flaws and other attack surfaces that potentially can be exploited.

**About the Author(s)**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

Void Banshee APT Exploits Microsoft Zero-Day in Spear-Phishing Attacks

Rabbit has introduced an option to erase all data from the r1 device before selling it on, but what if you lose it or it gets stolen?

Rabbit, the manufacturer of the Artificial Intelligence (AI) assistant r1 has issued a security advisory telling users it’s found a potential security risk. If a user loses or sells their device, a person in possession of the r1 could potentially jailbreak the device and gain access to files that contain logging information, chats, and photos.

To tackle the potential problem with sensitive data being left behind on the r1, Rabbit has taken the following measures:

*   A factory reset option is now available in the settings menu that lets you erase all data from the r1 prior to transferring ownership.
*   Pairing data is no longer logged to the device.
*   The amount of log data that gets stored on the device has been reduced.
*   Pairing data can no longer be used to read from the user’s Rabbithole journal section. It can only trigger actions.

Rabbit also says it is performing a full review of device logging practices to check whether additional technical controls are needed.

If you have an r1, you don’t need to do anything as the fix will be downloaded and installed automatically. While most updates to the r1 do not require any action of the user, updates that require you to accept them, including new features and more supported apps, will happen via over-the-air updates. For these, follow the prompt on your r1, make sure you’re connected to WiFi and a power source, and wait for it to update.

For those not familiar with the concept, the Rabbit r1 is an AI-powered gadget that can manage the use of your apps for you. It’s a standalone gadget with a 2.88-inch touchscreen, a rotating camera for taking photos and videos, and a scroll wheel/button designed to navigate the menu or allow you to talk to the built-in AI.

The Rabbithole mentioned earlier is an all-in-one web portal to manage the relationship with rabbit OS, and the device that you pair the r1 to. The Rabbit r1 uses a Large Action Model (LAM) to translate the user’s voice into actions on the device it’s paired with, whether that’s a handheld device, like a phone, or a desktop computer.

It’s still pretty much a project under development. Right now, the Rabbit r1 can answer questions, call an Uber, order DoorDash, play music on Spotify, translate speech, generate images on Midjourney, identify nearby objects with its camera and record voice memos. Nothing your phone can’t do, but Rabbit promises more options on the horizon and claims that all these actions are easier to accomplish when you’re using the r1.

The journal section of the Rabbithole web portal shows any visual searches you’ve conducted using the r1’s camera and voice memos you’ve recorded.

Rabbit says there’s no indication that pairing data has been abused to retrieve Rabbithole journal data belonging to a former device owner. Yet the possibility exists, and it’s good that users now have the ability to erase all data before selling the device. However, this doesn’t solve the issue if the r1 is stolen or lost.

**We don’t just report on threats – we help safeguard your entire digital identit**y

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

**Summer mega sale**

Go into your vacation knowing you’re much more secure: This summer you can get a huge **50% off a Malwarebytes Standard subscription** or **Malwarebytes Identity bundle**. Run, don’t walk!

 AI device Rabbit r1 logged user interactions without an option to erase them before selling 

Details have emerged about a "massive ad fraud operation" that leverages hundreds of apps on the Google Play Store to perform a host of nefarious activities.
The campaign has been codenamed Konfety – the Russian word for Candy – owing to its abuse of a mobile advertising software development kit (SDK) associated with a Russia-based ad network called CaramelAds.
"Konfety represents a new form of

Mobile Security / Online Security

Details have emerged about a "massive ad fraud operation" that leverages hundreds of apps on the Google Play Store to perform a host of nefarious activities.

The campaign has been codenamed **Konfety** – the Russian word for Candy – owing to its abuse of a mobile advertising software development kit (SDK) associated with a Russia-based ad network called CaramelAds.

"Konfety represents a new form of fraud and obfuscation, in which threat actors operate 'evil twin' versions of 'decoy twin' apps available on major marketplaces," HUMAN's Satori Threat Intelligence Team said in a technical report shared with The Hacker News.

While the decoy apps, totaling more than 250 in number, are harmless and distributed via the Google Play Store, their respective "evil twins" are disseminated through a malvertising campaign designed to facilitate ad fraud, monitor web searches, install browser extensions, and sideload APK files code onto users' devices.

The most unusual aspect of the campaign is that the evil twin masquerades as the decoy twin by spoofing the latter's app ID and advertising publisher IDs for rendering ads. Both the decoy and evil twin sets of apps operate on the same infrastructure, allowing the threat actors to exponentially scale their operations as required.

That having said, not only do the decoy apps behave normally, a majority of them do not even render ads. They also incorporate a GDPR consent notice.

"This 'decoy/evil twin' mechanism for obfuscation is a novel way for threat actors to represent fraudulent traffic as legitimate," HUMAN researchers said. "At its peak, Konfety-related programmatic volume reached 10 billion requests per day."

Put differently, Konfety takes advantage of the SDK's ad rendering capabilities to commit ad fraud by making it a lot more challenging to distinguish malicious traffic from legitimate traffic.

The Konfety evil twin apps are said to be propagated via a malvertising campaign promoting APK mods and other software like Letasoft Sound Booster, with the booby-trapped URLs hosted on attacker-controlled domains, compromised WordPress sites, and other platforms that allow content uploads, including Docker Hub, Facebook, Google Sites, and OpenSea.

Users who end up clicking on these URLs are redirected to a domain that tricks them into downloading the malicious evil twin app, which, in turn, acts as a dropper for a first-stage that's decrypted from the assets of the APK file and is used to set up command-and-control (C2) communications.

The initial stager further attempts to hide the app's icon from the device's home screen and runs a second-stage DEX payload that performs fraud by serving out-of-context, full-screen video ads when the user is either on their home screen or using another app.

"The crux of the Konfety operation lies in the evil twin apps," the researchers said. "These apps mimic their corresponding decoy twin apps by copying their app ID/package names and publisher IDs from the decoy twin apps."

"The network traffic derived from the evil twin applications is functionally identical to network traffic derived from the decoy twin applications; the ad impressions rendered by the evil twins use the package name of the decoy twins in the request."

Other capabilities of the malware include weaponizing the CaramelAds SDK to visit websites using the default web browser, luring users by sending notifications that prompt them into clicking on the bogus links, or sideloading modified versions of other advertising SDKs.

That's not all. Users installing the Evil Twins apps are urged to add a search toolbar widget to the device home screen, which surreptitiously monitors their searches by sending the data to domains named vptrackme\[.\]com and youaresearching\[.\]com.

"Threat actors understand that hosting malicious apps on stores is not a stable technique, and are finding creative and clever ways to evade detection and commit sustainable long term fraud," the researchers concluded. "Actors setting up mediation SDK companies and spreading the SDK to abuse high-quality publishers is a growing technique."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Tag

#intel