• Search for:
    23Nov, 2023
    India emerges top-5 victim of cyber attacks in H1 CY23

    Cyber threat landscape in India is becoming more dangerous as the country emerged as a top-five geography in the world when it comes to the highest number of detections and malware detections; and online banking malware detections in the first half of 2023.

    “India is among the top five countries globally for malware detections, accounting for 5.5 per cent 90,945 ransomware detections in the first half,” a mid-year cybersecurity report prepared by Trend Micro said.

    Similarly, India is ranked number 4 globally in online banking malware detections, contributing to a concerning 8.2 per cent of all global threats. “In the first half of 2023, a substantial 5,609 online malware threats were identified,” the report said.

    “India has also emerged as a top-3 geography for the highest detections of risk events in the first half of 2023, after the US and Brazil.

    Affected sectors

    The government sector faced 18,862 malware attacks, while the banking sector faced 15,514 malware attacks.

    “Manufacturing, Government, and banking industries were the hardest hit in the country, with malware families like COIMINER, MIMIKATZ, and POWLOAD posing significant risks,” the report said.

    “India is at a crossroads in cybersecurity. As cybercriminals become more sophisticated, our digital defenses are constantly being challenged. The rise of ransomware and malware attacks has had a significant impact on key sectors of our economy,” Vijendra Katiyar, Country Manager for India & SAARC at Trend Micro, said.

    “To stay ahead of the curve, organisations need to be proactive in anticipating threats and bolstering their defenses with a unified cybersecurity platform,” he said.

    Globally, over 85 billion threats were blocked in the first half of 2023, including 37 billion email threats and 46 billion malicious files.

    “Globally, the top 3 industries that detected the highest number of ransomware attacks are banking, retail, and transportation,” the report said.

    Resource : https://www.thehindubusinessline.com/info-tech/india-emerges-top-5-victim-of-cyber-attacks-in-h1-cy23/article67412924.ece

    30Oct, 2023
    Four Things to Consider as You Mature Your Threat Intel Program

    When ESG recently asked security professionals to identify the attributes of a mature threat intelligence program, the top response was “information dissemination with reports customized for consumption by specific individuals and groups”. However, many organizations don’t have mature threat intelligence programs and have yet to achieve this. ESG’s Jon Oltsik cites the 80/20 rule, where “80% of organizations have basic threat intelligence programs while only 20% are more advanced.”

    Sharing customized threat intelligence with key users is not just a sign that your threat intel program is maturing, it’s a great way to build deeper understanding, demonstrate value, and garner broader support for the program. If you want to begin, or improve, sharing customized intelligence with key users, consider these four aspects as you develop your process.

    1. Function. The threat intelligence team’s role is to provide products or services to many different internal customers, and each has different threat intel requirements to support their specific use cases. For example:

    • The security operations center (SOC) needs indicators of compromise that have been contextualized to show they are relevant and high priority so they can add them to their SIEM watchlist for monitoring.
    • Threat hunters need details of campaigns being run and adversaries’ motivations, targets and tactics, techniques and procedures (TTP), so they can look for activity that has bypassed defenses.
    • The incident response (IR) team needs threat intel around adversaries, campaigns and the infrastructure used so they can accelerate comprehensive response.
    • Vulnerability management teams need threat intel to help them understand their threat landscape and the likelihood of a vulnerability being exploited by adversaries that target the organization so they can prioritize patching.
    • Executive leadership at the business unit, C-suite and board levels need metrics that matter to them and that instills confidence that the organization is taking the right steps to maintain a strong security posture and is able to mitigate damage when an attack happens.

    2. Form. There is no “one way” to communicate. Different teams speak different languages and will apply threat intelligence in different ways, so it’s important to take the time to learn what type of communication will be most effective. For many technical teams actual feeds and dashboards work well, directly delivering the threat intel they need to do their specific jobs. Meanwhile, for executives and boards, a customized dashboard may work well for some and a PDF may be better for others. Either way, the content itself could be easily digestible and relevant to business leaders. Sticking with the typical metrics generated around number of events, alerts and incidents per month has far less impact than an update that contains the “who, what, when, where and why” of a thwarted attack, or whether or not they should be concerned about a recent attack that made the headlines.

    3. Frequency. Each team also has very different expectations and requirements when it comes to how often they need to receive threat intelligence. In security, the more time that passes, the more damage can be done. Additionally, many security teams are focused on being proactive, so speed is of the essence. But sharing data that hasn’t been vetted and contextualized for relevance to the organization ends up wasting valuable time. Threat intel teams can use automation to augment and enrich data with context, so teams get the right data faster and can easily prioritize it for analysis and action. 

    Executives and board members have different requirements. Establishing a regular schedule for more formal communications, at a minimum quarterly, is a good start. However, threat intel teams should also be prepared to field ad hoc questions when a new vulnerability or threat is in the news and the CEO asks: “What is it?”, “Does it pertain to us?”, “How are we impacted?” or “What are we doing to defend ourselves?”. 

    4. Feedback. Finally, it’s important to ask your different customers for feedback to make sure they are getting what they need, how and when they need it. Advancing your threat intelligence program is a two-way street. You need to hear how your service is being used and if it isn’t you need to understand why and adjust accordingly. Tweak the format, further customize the threat intel, change the frequency – do whatever it takes to ensure the program is delivering value and considered a crucial tool for each of your organization’s security teams and leadership.

    We’re halfway through 2023 and for many teams this is a good time to step back and measure progress against goals set at the beginning of the year. If one of your goals was to mature your threat intelligence program, conduct an honest assessment of how well you are doing at sharing threat intelligence with your different internal customers. There’s time to make relatively easy but high impact adjustments to showcase the value the threat intelligence program provides and turn it into a go-to resource that will strengthen your case for additional investment when budgeting season rolls around.

    Resource : https://www.securityweek.com/four-things-to-consider-as-you-mature-your-threat-intel-program/

    10Oct, 2023
    List of Data Breaches and Cyber Attacks in 2023

    1. DarkBeam

    The three elements of information security are confidentiality, integrity and availability. In other words, data has to be reliable and up to date, and accessible only to those who need it.

    Instances of data being exposed to the Internet – more often than not via configuration errors – clearly breach the confidentiality principle, but are often viewed as somehow less serious than information that’s made its way into criminals’ possession via sophisticated cyber attacks or phishing campaigns, as if human error is less of an issue than criminal hacking.

    This is, of course, an erroneous position to take. Search engines such as Shodan – theoretically, at least – let anyone find anything that’s connected to the Internet, not just websites that are indexed by Google. This, obviously, includes opportunistic criminals as well as civic-minded security researchers who identify exposed services and warn their operators.

    This brings us to DarkBeam. According to Cybernews, the CEO of SecurityDiscovery, Bob Diachenko, discovered on 18 September that the digital risk protection firm DarkBeam had “left an Elasticsearch and Kibana interface unprotected, exposing records with user emails and passwords from previously reported and non-reported data breaches”.

    Diachenko informed DarkBeam, which closed the vulnerability immediately.

    Although most of the 3.8 billion exposed data records come from previous data breaches, ironically having been assembled by DarkBeam in order to alert its customers to security incidents affecting their personal information, the extent of the information held by DarkBeam, as well as the way it was organised, means anyone who managed to access it has the opportunity to create very plausible phishing campaigns.

    It’s not yet known whether anyone did access it but, as Benjamin Franklin said, distrust and caution are the parents of security. So, it’s worth checking your credentials via haveibeenpwned.com and taking the usual precautions, such as changing your password where it’s been reused, implementing multifactor authentication where possible and not clicking on any links unless you’re absolutely sure of their source.

    2. MOVEit

    As with last month (see below), the MOVEit breach continues to claim victims, among which the most significant – at least in terms of the number of individual victims – was Better Outcomes Registry & Network, which discovered that “personal health information of approximately 3.4 million people – mostly those seeking pregnancy care and newborns who were born in Ontario between January 2010 and May 2023” had been compromised.

    Other recently identified MOVEit victims include:

    The scale of the MOVEit breach remains unquantified, but some estimates now put the number of affected organisations at over 2,000 and the number of individual victims at over 60 million.

    It’s likely that we’ll continue to see breach disclosures related to MOVEit Transfer in the weeks and months to come.

    3. Undisclosed restaurant database

    The personal information of 2.2 million Pakistani citizens, including their contact numbers and credit card details, has been offered for sale online on the dark web for 2 Bitcoin. The data was apparently compromised when criminal hackers accessed a database used by more than 250 restaurants.

    Indolj – a popular food ordering app – has taken the step of denying any involvement, saying in a press release reported by Pro Pakistani: “We have conducted a detailed audit of the sample data and determined that the data records do not match the current transactional records of customers on the Indolj platform. Furthermore, Indolj does not store any credit card or payment-related information and therefore it is impossible for any customer payment data to be breached from our platform.”

    According to Geo News, the criminals provided a sample of the stolen data as part of their online listing, while naming “dozens of food outlets”.

    However, having analysed the available data, the security company CTM360 confirms Indolj’s analysis. In a comment published by Pakstani Pro, the company claims that the data in fact comes from a 2022 leak, and says it will continue to monitor the post “and will notify impacted organizations urgently if any credible data is released”.

    Resource : https://www.itgovernance.co.uk/blog/list-of-data-breaches-and-cyber-attacks-in-2023#:~:text=See%20the%20full%20list%20of%20data%20breaches%20for%20September%202023&text=September%20saw%20the%20biggest%20data,misconfigured%20Elasticsearch%20and%20Kibana%20interface.