X-Industry

Recently, a US federal magistrate judge recommended the dismissal of a female’s lawsuit against famous soccer player - Cristiano Ronaldo.  The recommended dismissal is largely because her attorneys relied on confidential documents obtained through a hacker.  In the 6 October ruling, the federal magistrate warned of “far-reaching, dangerous consequences on the legitimacy of the judicial process” if “hacked privileged documents” become “fair game for an attorney to use to create and prosecute the

Activity Summary - Week Ending 8 October 2021:

• Red Sky Alliance identified 45,583 connections from new IP’s checking in with our Sinkholes
• Analysts identified 1,245 new IP addresses participating in various botnets
• Researchers observed 10 unique email accounts compromised with keyloggers
• Ranion is a Ransom-as-a-Service
• Ransomware Operations are Short-Lived
• Cyber-Attack turns Fatal
• Indiana hospital and Ransomware
• Protecting the Healthcare Sector
• What’s a Slacktivist?
• The Anthropocene Period

Lin

Port industry leaders recently submitted cybersecurity guidelines to the United Nations International Maritime Organization (IMO) for consideration.  The IMO Member States should seize this opportunity and amend the International Ship and Port Facility Security (ISPS) Code to enact cybersecurity standards for ports and port facilities.  Specifically, IMO Member States should amend the code, using the new industry guidelines as a model, to require port facilities to conduct regular cybersecurity

Facebook has been having its share of problems.  From a global outage to a Whistleblower gone public with claims that Instagram causes youth-based psychological issues, the social media giant is now on the defensive.  US Congress is currently taking another, yet closer, look at oversight of social media platforms. 

Facebook and its Instagram and WhatsApp platforms are finally back in operation after a worldwide outage hit the services and the businesses and people who rely on its platforms.  Fac

An Android Trojan has now achieved a victim count of over 10 million in at least 70 countries.  Researchers say the infections are generating millions of dollars a month in recurring revenue.  According to Zimperium zLabs, the new malware has been embedded in at least 200 malicious applications, many of which have managed to circumvent the protections offered by the Google Play Store, the official repository for Android apps.

The researchers say that the operators behind the Trojan have managed

Ever think about scamming the harassing telephone scammers?  Three to four days a week, a US Los Angeles based voice actor calls back telephones thieves and messes with their heads.  For the past two years, this champion of anti-scamming, runs a sort of reverse call center, deliberately ringing the people most of us hang up on those scammers who pose as tax agencies or tech-support companies or inform you that you’ve recently been in a car accident you somehow do not recall.  When the actor gets

Cyber threat hunting is an active cyber defense activity.  It is "the process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions."  This contrasts with traditional threat management measures, such as firewalls, intrusion detection systems, malware sandbox, and SIEM systems, which typically involve an investigation of evidence-based data after there has been a warning of a potential threat.

To maximize the chance

Many believe that the Mafia of old has long since been active.  Not so, says Europol.  The new and improved Mafia organized crime ring thrived on violence, intimidation and $12 million in online fraud profits; all specialties of the Mafia.  International law enforcement has busted up an extensive cybercrime operation run by a gang with ties to the Italian Mafia.

The group allegedly used phishing attacks to defraud hundreds of victims. The suspects used various lures to convince victims (mostly I

Activity Summary - Week Ending 1 October 2021:

• Red Sky Alliance identified 28,292 connections from new IP addresses connecting to Sinkholes
• Analysts identified 482 new IP addresses participating in various botnets
• Amazon Data Services Canada has a compromised IP
• #1 Malware for 29 Sept, FoggyWeb
• Blackmatter Ransomware, Again
• iTerm2 App
• German Elections and Russia
• South Africa Ransomware Attack
• French Shipper hit Again
• British Giant Group hit with a ‘sophisticated’ cyber-attack
• Lithuania and Chin

Cybersecurity is always low on upper management's priorities during a merger or acquisition, but it shouldn’t be.  "Companies that are being bought and sold are often prime targets for cyberattacks," explained the CEO of cybersecurity solutions provider Industrial Defender, during a recent interview.[1] "By enacting Operational Technology (and proactive cyber intelligence) security measures, organizations can avoid an exciting company milestone from becoming an infrastructure and security nightm

The Quadrilateral Security Dialogue (Quad) has signaled its commitment to cybersecurity by announcing a dedicated new group that will promote best practices and shared standards.  The announcement came after the first-ever in-person meeting of the Quad, which comprises the US, India, Japan, and Australia in an alliance of democratic nations designed to counter Chinese aggression.

A White House briefing on the leaders’ summit detailed multiple areas of cooperation between the four nations, from C

The US Department of Commerce is currently requesting public input on a previous administration cybersecurity executive order that requires cloud providers to verify the identities of certain users.  The goal of the executive order is to identify malicious cyber actors operating abroad and leveraging US technologies. 

Executive Order (EO) 13984 was signed on 19 January 2021 by President Trump, along with other mandates focused on national security.  While incumbent President Joe Biden has revers

Outer space and cyberspace have something in common, they are both new frontiers for national security.  This confuses what has been traditional ideas of defense strategy, borders, and sovereignty.  These two areas are national critical infrastructure and are essential for any country to be secure and able to defend itself.  This ‘use’ means cyber and space can both be utilized for civilian and military purposes.

As a political and legal concept, sovereignty defines as a country’s authority to c

A Russian-linked group known as Turla has been deploying a secondary backdoor against numerous targets to maintain persistence within compromised devices even after the primary malware has been discovered and removed from the infrastructure, according to a research report released by Cisco Talos this week.

The newly discovered backdoor, which the researchers call "TinyTurla," has been deployed against targets in the U.S. and Germany over the last two years. More recently, however, Turla has used

Last week Microsoft Security issued a detailed report on a massive phishing-as-a-service operation named BulletProofLink that offered as a subscription and all the tools needed to conduct a campaign.  The phishing-as-a-service, or PHaaS, model differs from the phishing kits that many gangs have used in that it is more expansive and handles many of the small details that could befuddle a less tech-savvy attacker.

"It's worth noting that some PhaaS groups may offer the whole deal - from template c

With approximately 90% of all finished and bulk products traveling through maritime ports, it is a bit unnerving that a major US port network was breached.  The US Coast Guard recently reported that a suspected foreign government-backed hackers breached a computer network at the Port of Houston, one of the largest ports on the US Gulf Coast.  Early detection of the incident last month resulted in the cyber criminals stopping any disruption of shipping operations. 

The incident at the Port of Hou

Activity Summary - Week Ending 24 September 2021:

• Red Sky identified 28,838 connections from new unique IP addresses connecting to our Sinkholes
• Analysts identified 1,253 new IP addresses participating in various botnets
• Zeppelin Ransomware
• Russian TinyTurla
• CloudAtlas
• WSL Malware Loaders
• AT&T network hacker – Convicted
• Suex & Ransomware Laws
• Fake Vaccine Passports
• Real Estate Brokerage Firm Hit

Report link: IR-21-267-001_weekly_267_FINAL.pdf

Malwarebytes Intelligence Team is reporting the MSHTML vulnerability classified as CVE-2021-40444 has become the focus of threat actors targeting Russian government entities.  Its researchers intercepted phishing email attachments revealing that attackers were trying to target Russian organizations.

The CVE-2021-40444 vulnerability involves ActiveX and is an old flaw, but it was discovered recently, and soon enough, threat actors started sharing its PoCs, tutorials, and exploits on hacking forum

The US government is reportedly set to announce new measures, including sanctions to deter cryptocurrency businesses from getting involved in laundering and facilitating ransomware payments.  People familiar with the matter told the Wall Street Journal that the US Treasury Department could enact the new sanctions as early as the week of 20 September 2021. They will reportedly target cryptocurrency exchanges and traders who either knowingly or unwittingly enable cybercrime transactions.  Among ot