Som du ser är vår webbplats inte anpassad för äldre webbläsare. Vi rekommenderar att du uppgraderar till en nyare webbläsare.
!!

Vi söker systemutvecklare och systemadministratör till CERT-SE, centrala roller i arbetet med att utveckla Sveriges förmåga att hantera it-incidenter. Sista ansökningsdag för båda rollerna är den 21 december.

Publicerad - Veckobrev

CERT-SE:s veckobrev v.20

Efter en nyhetsrik vecka kommer här ett lite extra spännande veckobrev. Det rapporteras bland annat om Darkside efter attacken mot Colonial Pipelines och om attackerna mot den irländska sjukvårdssektorn. Några uppiggande nyheter blir det också, MSB har lanserat verktyget Infosäkkollen som ska förbättra informationssäkerhetsarbetet och CERT-SE har fått ett bättre samarbete med Have I Been Pwned.

Trevlig helg önskar CERT-SE!

Nyheter i veckan

Trading scheme resulting in €30 million in losses uncovered (12 maj)
https://www.europol.europa.eu/newsroom/news/trading-scheme-resulting-in-%E2%82%AC30-million-in-losses-uncovered

Ransomware Is Getting Ugly (14 maj)
https://www.schneier.com/blog/archives/2021/05/ransomware-is-getting-ugly.html

Insurer AXA hit by ransomware after dropping support for ransom payments (16 maj)
https://www.bleepingcomputer.com/news/security/insurer-axa-hit-by-ransomware-after-dropping-support-for-ransom-payments/

47% of Criminals Buying Exploits Target Microsoft Products (17 maj)
https://www.darkreading.com/vulnerabilities---threats/47--of-criminals-buying-exploits-target-microsoft-products/d/d-id/1341037

Överbelastningsattacker mot Region Gotland kostade 1,6 miljoner kronor (17 maj)
https://sverigesradio.se/artikel/overbelastningsattacker-mot-region-gotland-kostade-1-6-miljoner-kronor

Welcoming the Swedish Government to Have I Been Pwned (18 maj)
https://www.troyhunt.com/welcoming-the-swedish-government-to-have-i-been-pwned/

Gov reveals plans to boost supply chain cyber resilience (18 maj)
https://nationaltechnology.co.uk/Gov_Explores_Measures_To_Boost_Supply_Chain_Cyber_Reslience.php

Irish internet service providers hit by cyber attacks (18 maj)
https://www.independent.ie/business/technology/irish-internet-service-providers-hit-by-cyber-attacks-40441177.html

Email attachment believed to have opened door to cyber-attack on Waikato hospitals (19 maj)
https://www.stuff.co.nz/national/125175283/email-attachment-believed-to-have-opened-door-to-cyberattack-on-waikato-hospitals

Cybercriminals scanned for vulnerable Microsoft Exchange servers within five minutes of news going public (19 maj)
https://www.zdnet.com/article/cybercriminals-scanned-for-vulnerable-microsoft-exchange-servers-within-five-minutes-of-news-going-public/
..
Rapport: 2021 Cortex Xpanse Attack Surface Threat Report
https://start.paloaltonetworks.com/asm-report

This is how the Cobalt Strike penetration testing tool is being abused by cybercriminals (19 maj)
https://www.zdnet.com/article/this-is-how-the-cobalt-strike-penetration-testing-tool-is-being-abused-by-cybercriminals/

SolarWinds CEO apologizes for blaming an intern, says attack may have started in January 2019 (19 maj)
https://therecord.media/solarwinds-ceo-apologizes-for-blaming-an-intern-says-attack-may-have-started-in-january-2019/

The future of Internet Explorer on Windows 10 is in Microsoft Edge (19 maj)
https://blogs.windows.com/windowsexperience/2021/05/19/the-future-of-internet-explorer-on-windows-10-is-in-microsoft-edge/

SVT avslöjar: Polisen kan inte söka fingeravtryck i sitt eget register (19 maj)
https://www.svt.se/nyheter/inrikes/svt-avslojar-polisen-kan-inte-soka-fingeravtryck

MountLocker ransomware uses Windows API to worm through networks (19 maj)
https://www.bleepingcomputer.com/news/security/mountlocker-ransomware-uses-windows-api-to-worm-through-networks/

Nätbankens säkerhetsmiss – gick att identifiera kunder (20 maj)
https://sverigesradio.se/artikel/natbankens-sakerhetsmiss-gick-att-identifiera-kunder

The Full Story of the Stunning RSA Hack Can Finally Be Told (20 maj)
https://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/

UK data regulator fines American Express up to 0.021p per email after opted-out folk spammed 4.1 million times (20 maj)
https://www.theregister.com/2021/05/20/amex_fine_50m_spam/

Bizarro Banking Trojan (20 maj)
https://www.schneier.com/blog/archives/2021/05/bizarro-banking-trojan.html

US insurer paid $40 million ransom after March cyber attack: report (20 maj)
https://thehill.com/policy/cybersecurity/554635-us-insurer-paid-40-million-ransom-after-march-cyber-attack-report

Mobile app developers’ misconfiguration of third party services leave personal data of over 100 million exposed (20 maj)
https://research.checkpoint.com/2021/mobile-app-developers-misconfiguration-of-third-party-services-leave-personal-data-of-over-100-million-exposed/

DarkSide och Colonial Pipelines

Darkside ransomware gang says it lost control of its servers & money a day after Biden threat (14 maj)
https://therecord.media/darkside-ransomware-gang-says-it-lost-control-of-its-servers-money-a-day-after-biden-threat/

DarkSide Ransomware Gang Says It Has Shut Down (14 maj)
https://www.bankinfosecurity.com/darkside-ransomware-gang-says-has-shut-down-a-16620

DarkSide Ransomware Gang Quits After Servers, Bitcoin Stash Seized (14 maj)
https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/

U.S. Pipeline Ransomware Attackers Go Dark After Servers and Bitcoin Are Seized (17 maj)
https://thehackernews.com/2021/05/us-pipeline-ransomware-attackers-go.html

DarkSide Hits Toshiba; XSS Forum Bans Ransomware (17 maj)
https://threatpost.com/darkside-toshiba-xss-bans-ransomware/166210/
..
Cyber attack on European subsidiaries of the Toshiba Tec Group (14 maj)
https://www.toshibatec.com/information/20210514_01.html

Hacker gangs show few signs of slowing after pipeline attack (18 maj)
https://www.nbcnews.com/tech/security/hacker-gangs-show-signs-slowing-pipeline-attack-rcna951

Update to CISA-FBI Joint Cybersecurity Advisory on DarkSide Ransomware (19 maj)
https://us-cert.cisa.gov/ncas/current-activity/2021/05/19/update-cisa-fbi-joint-cybersecurity-advisory-darkside-ransomware

Colonial Pipeline boss confirms $4.4m ransom payment (20 maj)
https://www.bbc.com/news/business-57178503

Colonial-hackarna har utpressat många fler – dragit in hundratals miljoner (20 maj)
https://computersweden.idg.se/2.2683/1.751144/colonial-hackarna-har-pressat-ut-manga-fler--dragit-in-hundratals-miljoner

Attackerna mot irländska sjukvårdssektorn

NCSC Alert: Ransomware Attack on Health Sector - UPDATE (16 maj)
https://www.ncsc.gov.ie/pdfs/HSE_Conti_140521_UPDATE.pdf

HSE cyber attack: Govt says risk data will be abused (17 maj)
https://www.rte.ie/news/ireland/2021/0517/1222019-cyber-attack/

Conti ransomware also targeted Ireland's Department of Health (17 maj)
https://www.bleepingcomputer.com/news/security/conti-ransomware-also-targeted-irelands-department-of-health/

What’s going on with the HSE cyberattack? (18 maj)
https://www.siliconrepublic.com/enterprise/hse-cyberattack-explainer-conti-ransomware

Informationssäkerhet och blandat

CISA Publishes Eviction Guidance for Networks Affected by SolarWinds and AD/M365 Compromise (14 maj)
https://us-cert.cisa.gov/ncas/current-activity/2021/05/14/cisa-publishes-eviction-guidance-networks-affected-solarwinds-and

Verktyget Infosäkkollen ska förbättra informationssäkerhetsarbetet (17 maj)
https://www.msb.se/sv/aktuellt/nyheter/2021/maj/nya-verktyget-infosakkollen-ska-forbattra-informationssakerhetsarbetet/

CVE-2021-31166: A Wormable Code Execution Bug in HTTP.sys (18 maj)
https://www.zerodayinitiative.com/blog/2021/5/17/cve-2021-31166-a-wormable-code-execution-bug-in-httpsys

Recycle Your Phone, Sure, But Maybe Not Your Number (19 maj)
https://krebsonsecurity.com/2021/05/recycle-your-phone-sure-but-maybe-not-your-number/

Ransomware attacks are not a matter of if, but when (19 maj)
https://www.techrepublic.com/article/ransomware-attacks-are-not-a-matter-of-if-but-when/

BazarCall Method: Call Centers Help Spread BazarLoader Malware (19 maj)
https://unit42.paloaltonetworks.com/bazarloader-malware/

Ransomware: Should paying hacker ransoms be illegal? (20 maj)
https://www.bbc.com/news/technology-57173096

How to gain added security in Firefox with the site isolation feature, Fission (20 maj)
https://www.techrepublic.com/article/how-to-gain-added-security-in-firefox-with-the-site-isolation-feature-fission/

Phishing for Finance
https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/soti-security-phishing-for-finance-report-2021.pdf

CERT-SE i veckan

Allvarlig sårbarhet i Pulse Connect Secure

Microsofts månatliga säkerhetsuppdateringar för maj 2021 (uppdaterad 2021-05-18)

Sårbarhet i Dell-produkter - avinstallera nu!