X-Industry

North Korea has some decent cyber operations aimed against its foes but can’t seem to figure out rocket propulsion.  North Korea’s attempt to send a military spy satellite into orbit has failed for a second time.  A North Korean representative reported that the launch took place in the early hours of 24 August 2023, the first day of a week-long launch window, but failed because of a problem with the rocket's third stage carrying the satellite.  North Korea will try again in October 2023.  “The f

Protecting your online safety has never been more crucial in today’s digital age, where cybercriminals and hackers lurk around every virtual corner.  The reality of cybersecurity threats, ranging from identity theft to malicious software attacks, can leave us feeling vulnerable and exposed.  However, there is hope! In this blog post, we will explore some of the common cyber threats you may encounter and delve into the crucial role that online security consultants play in safeguarding your digita

As the use and dependence on computers and software grow, so do the threats facing businesses of being hacked or becoming a victim of ransomware, where a company is locked out of a system until they pay a ransom.  In some cases, even if a company pays the ransom, it may still experience irreparable damage to its systems, network and reputation.

According to the Federal Bureau of Investigation’s Cyber Crime Compliant Center (IC3), ransomware is one of the biggest and most frequent threats to busi

Articles on cyber warfare have consistently seen cyberattacks as a first-strike weapon for attacking countries before or at least at the onset of a moving conflict.  The speed with which these attacks occur and the difficulty in allowing for sufficient indications and warning for defenders to mitigate their intensity and volume successfully have bolstered cyberattacks as a legitimate capability for degradation, disruption, and destruction.  Cyberattacks in a moving conflict are synonymous with a

Our friends at FortiGuard Labs, recently detected a new injector written in Rust—one of the fastest-growing programming languages—to inject shellcode and introduce XWorm into a victim’s environment.  While Rust is relatively uncommon in malware development, several campaigns have adopted this language since 2019, including Buer loader, Hive, and RansomExx.  FortiGuard Labs analysis also revealed a significant increase in injector activity during May 2023, where the shellcode can be encoded with

The United States Space Force has activated its first and only unit dedicated to targeting other nations' satellites and the ground stations that support them.  The 75th Intelligence, Surveillance and Reconnaissance Squadron (ISRS) was activated on 11 August at Peterson Space Force Base in Colorado.  This unit is part of Space Delta 7, an element of the US Space Force tasked with providing intelligence on adversary space capabilities.  It will do things like analyze the capabilities of potential

DoDo ransomware was first reported last February of 2023.  It is a variant of the widely reported and observed Chaos ransomware.  Because it is a derivative, the DoDo ransomware is not considered new and recent.  However, a slightly different version of the DoDo ransomware has recently emerged, described below.[1]

Infection Vector - DoDo ransomware samples have the “Mercurial Grabber” file icon, which indicates the ransomware was likely distributed as such.  Mercurial Grabber is an open-source m

The US intelligence community is warning the domestic space industry of the growing risk of espionage and satellite attacks from China, Russia, and other adversaries.  In coordination with the FBI, the National Counterintelligence and Security Center (NCSC), and the Air Force Office of Special Investigations, the Office of the Director of National Intelligence released a warning about the growing threat of foreign intelligence entities (FIEs) as they continue to launch cyberattacks to gain acces

The US Justice Department (DOJ) on 23 August 2023 unsealed an indictment against two founders of the now-sanctioned Tornado Cash cryptocurrency mixer service, charging them with laundering more than $1 billion in criminal proceeds.  Both the individuals, Roman Storm and Roman Semenov, have been charged with conspiracy to commit money laundering, conspiracy to commit sanctions violations, and conspiracy to operate an unlicensed money-transmitting business.

Storm is said to have been arrested in t

The UK’s National Cyber Security Centre (NCSC) issued a warning this week about the growing danger of “prompt injection” attacks against applications built using AI.  While the warning is meant for cybersecurity professionals building large language models (LLMs) and other AI tools, prompt injection is worth understanding if you use any kind of AI tool, as attacks using it are likely to be a major category of security vulnerabilities going forward.

Prompt injection is a kind of attack against LL

Pick your industry and you will quickly conclude that cyber-attacks on their systems are an empirical threat to commercial and industrial operations.  Cyber risk now slices through almost every type of business activity, and the maritime industry is no exception.  According to US Coast Guard Cyber Command statistics, maritime cyber incidents increased 68% in 2021 alone.

Cyber-insecurity not only poses increased risks to maritime operations but also to general planning, which more and more has be

A criminal ransomware network connected to a cyber-attack inside numerous US hospitals has been taken down by the FBI, according to a US Department of Justice press release.  The attack hit over 200,000 computers across the US and cost hundreds of millions of dollars in damage.  The FBI called it a duck hunt taking down the hacking network called Qakbot.  “Qackbot is one of the most successful persistent and notorious botnets in the globe,” said US Attorney Martin Estrada. “Stopping cybercrime i

North Korean threat actors have caught Sentinel Lab's attention over the past year, providing us with fruitful insight into a variety of campaigns, such as new reconnaissance tools, (multiple) new supply chain intrusions, elusive multi-platform targeting, and new sly social engineering tactics.  To add to that list, analysts looked at an intrusion into what might be considered a highly desirable strategic espionage mission, supporting North Korea’s contentious missile program.[1]

The Target Orga

Microsoft spokesmen disclosed on 17 August 2023 that it found a new version of the BlackCat ransomware (aka ALPHV and Noberus) that embeds tools like Impacket and RemCom to facilitate lateral movement and remote code execution.  "The Impacket tool has credential dumping and remote service execution modules that could be used for broad deployment of the BlackCat ransomware in target environments," the company's threat intelligence team said in a series of posts on X (formerly Twitter).  "This Bla

Threat actors' use of Cloudflare R2 to host phishing pages has witnessed a 61-fold increase over the past six months.  The majority of the phishing campaigns target Microsoft login credentials, although some pages are targeting Adobe, Dropbox, and other cloud apps, was recently reported by security researchers.   Cloudflare R2, analogous to Amazon Web Service S3, Google Cloud Storage, and Azure Blob Storage, is a data storage service for the cloud.[1]

Cloudflare R2 is a zero-egress distributed o

Cybersecurity researchers have detailed an updated version of an advanced fingerprinting and redirection toolkit called WoofLocker, engineered to conduct tech support scams.  The sophisticated traffic redirection scheme was first documented by Malwarebytes in January 2020, leveraging JavaScript embedded in compromised websites to perform anti-bot and web traffic filtering checks to serve next-stage JavaScript that redirects users to a browser locker (Browlock).[1]

This redirection mechanism, in

The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the National Institute of Standards and Technology (NIST) have published new guidance to encourage organizations to begin early planning for post-quantum cryptography migration.

Titled Quantum-Readiness: Migration to Post-Quantum Cryptography https://www.cisa.gov/sites/default/files/2023-08/Quantum%20Readiness_Final_CLEAR_508c%20%283%29.pdf , the document details the impact of quantum capabilitie

The leaked data encompassed a vast array of information from the logging database containing around 14.7 million records, totaling a size of approximately 19.17 GB, to the AWS cloud storage which held over 3.5 million files, collectively amounting to 700 GB.

The cybersecurity Jeremiah Fowler has recently uncovered a major data breach affecting a prominent Brazilian escort service and application known as the Fatal Model.  Fowler, who brought the breach to the attention of cybersecurity resource

A known ransomware group on 21 August 2023 started publishing data allegedly stolen from the systems of Japanese watchmaking company Seiko https://www.seikowatches.com.  Seiko revealed on 10 August 2023 that it had identified a possible data breach on 28 July 2023, with someone gaining access to at least one server.  An investigation showed that some information may have been compromised.   “The Company and all our Group companies kindly ask our customers and business partners to contact us imm

A newly identified espionage operation run by hackers linked to China’s government has targeted dozens of organizations in Taiwan since the middle of 2021.  Microsoft on Thursday attributed the campaign to a previously unidentified group it named Flax Typhoon.  The goal of the campaign is to not only perform espionage on targeted Taiwanese entities but “maintain access to organizations across a broad range of industries for as long as possible,” the tech giant said.

The group is mainly targeting