CERT-SE:s veckobrev v.47
Blandade nyheter från veckan som gått. Idag är det många som handlar klappar inför jul och vi vill uppmana alla läsare att vara lite extra vaksamma. Som alltid så är ett erbjudande som är för bra för att vara sant ofta falskt.
Trevlig helg önskar CERT-SE!
Nyheter i veckan
More than 330,000 Medicare recipients affected by MOVEit breach (17 nov)
https://therecord.media/more-than-hundreds-thousands-medicare-moveit
…
185,000 Individuals Impacted by MOVEit Hack at Car Parts Giant AutoZone (22 nov)
https://www.securityweek.com/185000-individuals-impacted-by-moveit-hack-at-car-parts-giant-autozone/
Canadian government discloses data breach after contractor hacks (20 nov)
https://www.bleepingcomputer.com/news/security/canadian-government-discloses-data-breach-after-contractor-hacks/
Danska mäklaren EDC utpressas att betala lösensumma för att undvika att 700 000 kunders data publiceras (på danska) (20 nov)
https://finans.dk/erhverv/ECE16613128/edc-afpresses-betal-eller-700000-kunders-data-laegges-paa-internettet/
Greater Paris wastewater agency dealing with cyberattack (20 nov)
https://therecord.media/paris-wastewater-agency-hit-cyberattack
British Library: Employee data leaked in cyber attack (22 nov)
https://www.bbc.com/news/entertainment-arts-67484639
US Cybersecurity Lab Suffers Major Data Breach (21 nov)
https://www.infosecurity-magazine.com/news/us-cybersecurity-lab-major-data/
Hacktivists breach U.S. nuclear research lab, steal employee data (21 nov)
https://www.bleepingcomputer.com/news/security/hacktivists-breach-us-nuclear-research-lab-steal-employee-data/
Kansas officials blame 5-week disruption of court system on “sophisticated foreign cyberattack” (21 nov)
https://apnews.com/article/kansas-courts-cyberattack-hack-network-offline-097a11cfa9de552ec5a9ea49b500d3d6
Svenska kyrkan drabbad av allvarlig it-störning (23 nov)
https://www.svt.se/nyheter/inrikes/svenska-kyrkan-drabbad-av-allvarlig-it-storning--wej89e
Rapporter och analyser
Mitigation Guide: Healthcare and Public Health (HPH) Sector (17 nov)
https://www.cisa.gov/resources-tools/resources/mitigation-guide-healthcare-and-public-health-hph-sector
A deep dive into Phobos ransomware, recently deployed by 8Base group (17 nov)
https://blog.talosintelligence.com/deep-dive-into-phobos-ransomware/
Researchers extract RSA keys from SSH server signing errors (19 nov)
https://www.bleepingcomputer.com/news/security/researchers-extract-rsa-keys-from-ssh-server-signing-errors/
Konni Campaign Distributed Via Malicious Document (20 nov)
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits (20 nov)
https://www.trendmicro.com/en_us/research/23/k/cve-2023-46604-exploited-by-kinsing.html
Is this the real life? Is this just fantasy? Caught in a landslide, NoEscape from NCC Group (20 nov)
https://research.nccgroup.com/2023/11/20/is-this-the-real-life-is-this-just-fantasy-caught-in-a-landslide-noescape-from-ncc-group/
The ‘Gram Scam: Meta Phishing Attack Lures Victims via Spoofed Copyright Infringement Policy (20 nov)
https://perception-point.io/blog/the-gram-scam-meta-phishing-attack-lures-victims-via-spoofed-copyright-infringement-policy/
New “Agent Tesla” Variant: Unusual “ZPAQ” Archive Format Delivers Malware (21 nov)
https://www.gdatasoftware.com/blog/2023/11/37822-agent-tesla-zpaq
Navigating the SMB Threat Landscape: Key Insights from Huntress’ SMB Threat Report (21 nov)
https://www.huntress.com/blog/navigating-the-smb-threat-landscape-key-insights-from-huntress-smb-threat-report
PlayCrypt Ransomware-as-a-Service Expands Threat from Script Kiddies and Sophisticated Attackers (21 nov)
https://adlumin.com/post/playcrypt-ransomware-as-a-service-expands-threat-from-script-kiddies-and-sophisticated-attackers/
Digitalisering i vården skapar nya risker (21 nov)
https://www.foi.se/nyheter-och-press/nyheter/2023-11-21-digitalisering-i-varden-skapar-nya-risker.html
StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (21 nov)
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a
A Touch of Pwn - Part I (21 nov)
https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/
Comparative Study Results on Linux and Windows Ransomware Attacks, Exploring Notable Trends and Surge in Attacks on Linux Systems (21 nov)
https://blog.checkpoint.com/security/comparative-study-results-on-linux-and-windows-ransomware-attacks-exploring-notable-trends-and-surge-in-attacks-on-linux-systems/
Atomic Stealer distributed to Mac users via fake browser updates (21 nov)
https://www.malwarebytes.com/blog/threat-intelligence/2023/11/atomic-stealer-distributed-to-mac-users-via-fake-browser-updates
InfectedSlurs Botnet Spreads Mirai via Zero-Days (21 nov)
https://www.akamai.com/blog/security-research/new-rce-botnet-spreads-mirai-via-zero-days
Cyberattackerna allt fler – svenska vården extra utsatt (22 nov)
https://computersweden.idg.se/2.2683/1.780449/cyberattackerna-okar-varden-extra-utsatt
Malware dev says they can revive expired Google auth cookies (21 nov)
https://www.bleepingcomputer.com/news/security/malware-dev-says-they-can-revive-expired-google-auth-cookies/
Informationssäkerhet och blandat
Reflecting on 20 years of Patch Tuesday (17 nov)
https://msrc.microsoft.com/blog/2023/11/reflecting-on-20-years-of-patch-tuesday/
Radioinslag: Angripare riktar in sig mot svenskt näringsliv – vill slå ut verksamhet (20 nov)
https://sverigesradio.se/artikel/angripare-riktar-in-sig-mot-svenskt-naringsliv-vill-sla-ut-verksamhet
Radioinslag: Dålig koll på cybersäkerhet - så kan företag skydda sig (20 nov)
https://sverigesradio.se/avsnitt/dalig-koll-pa-cybersakerhet-sa-kan-foretag-skydda-sig--2
Var vaksam i julhandeln – bedragare lurar med paketbluffar (20 nov)
https://internetstiftelsen.se/nyheter/var-vaksam-i-julhandeln-bedragare-lurar-med-paketbluffar/
EU cybersecurity exercise: foster cooperation, secure free and fair EU elections (21 nov)
https://www.enisa.europa.eu/news/eu-cybersecurity-exercise-foster-cooperation-secure-free-and-fair-eu-elections
Will Quantum Computing change the way we use encryption? (23 nov)
https://betanews.com/2023/11/23/will-quantum-computing-change-the-way-we-use-encryption/
CERT-SE i veckan
Flera sårbarheter i Citrix Netscaler ADC och Netscaler Gateway (uppdaterad 2023-11-20)