• Search for:
    23Nov, 2023
    India emerges top-5 victim of cyber attacks in H1 CY23

    Cyber threat landscape in India is becoming more dangerous as the country emerged as a top-five geography in the world when it comes to the highest number of detections and malware detections; and online banking malware detections in the first half of 2023.

    “India is among the top five countries globally for malware detections, accounting for 5.5 per cent 90,945 ransomware detections in the first half,” a mid-year cybersecurity report prepared by Trend Micro said.

    Similarly, India is ranked number 4 globally in online banking malware detections, contributing to a concerning 8.2 per cent of all global threats. “In the first half of 2023, a substantial 5,609 online malware threats were identified,” the report said.

    “India has also emerged as a top-3 geography for the highest detections of risk events in the first half of 2023, after the US and Brazil.

    Affected sectors

    The government sector faced 18,862 malware attacks, while the banking sector faced 15,514 malware attacks.

    “Manufacturing, Government, and banking industries were the hardest hit in the country, with malware families like COIMINER, MIMIKATZ, and POWLOAD posing significant risks,” the report said.

    “India is at a crossroads in cybersecurity. As cybercriminals become more sophisticated, our digital defenses are constantly being challenged. The rise of ransomware and malware attacks has had a significant impact on key sectors of our economy,” Vijendra Katiyar, Country Manager for India & SAARC at Trend Micro, said.

    “To stay ahead of the curve, organisations need to be proactive in anticipating threats and bolstering their defenses with a unified cybersecurity platform,” he said.

    Globally, over 85 billion threats were blocked in the first half of 2023, including 37 billion email threats and 46 billion malicious files.

    “Globally, the top 3 industries that detected the highest number of ransomware attacks are banking, retail, and transportation,” the report said.

    Resource : https://www.thehindubusinessline.com/info-tech/india-emerges-top-5-victim-of-cyber-attacks-in-h1-cy23/article67412924.ece

    10Nov, 2022
    Several Cyber Attacks Observed Leveraging IPFS Decentralized Network

    A number of phishing campaigns are leveraging the decentralized Interplanetary Filesystem (IPFS) network to host malware, phishing kit infrastructure, and facilitate other attacks.

    “Multiple malware families are currently being hosted within IPFS and retrieved during the initial stages of malware attacks,” Cisco Talos researcher Edmund Brumaghin said in an analysis shared with The Hacker News.

    The research mirrors similar findings from Trustwave SpiderLabs in July 2022, which found more than 3,000 emails containing IPFS phishing URLs as an attack vector, calling IPFS the new “hotbed” for hosting phishing sites.

    IPFS as a technology is both resilient to censorship and takedowns, making it a double-edged sword. Underlying it is a peer-to-peer (P2P) network which replicates content across all participating nodes so that even if content is removed from one machine, requests for the resources can still be served via other systems.

    This also makes it ripe for abuse by bad actors looking to host malware that can resist law enforcement attempts at disrupting their attack infrastructure, like seen in the case of Emotet last year.

    “IPFS is currently being abused by a variety of threat actors who are using it to host malicious contents as part of phishing and malware distribution campaigns,” Brumaghin previously told The Hacker News in August 2022.

    This includes Dark Utilities, a command-and-control (C2) framework that’s advertised as a way for adversaries to avail remote system access, DDoS capabilities, and cryptocurrency mining, with the payload binaries provided by the platform hosted in IPFS.

    Furthermore, IPFS has been put to use to serve rogue landing pages as part of phishing campaigns orchestrated to steal credentials and distribute a wide range of malware comprising Agent Tesla, reverse shells, data wiper, and an information stealer called Hannabi Grabber.

    In one malspam delivery chain detailed by Talos, an email purporting to be from a Turkish financial institution urged the recipient to open a ZIP file attachment that, when launched, worked as a downloader to retrieve an obfuscated version of Agent Tesla hosted within the IPFS network.

    The destructive malware, for its part, takes the form of a batch file that deletes backups and recursively purges all directory contents. Hannabi Grabber is a Python-based malware that gathers sensitive information from the infected host, such as browser data and screenshots, and transmits it via a Discord Webhook.

    The latest development points to the growing use by attackers of legitimate offerings such as Discord, Slack, Telegram, Dropbox, Google Drive, AWS, and several others to host malicious content or to direct users to it, making phishing one of the lucrative primary initial access vectors.

    “We expect this activity to continue to increase as more threat actors recognize that IPFS can be used to facilitate bulletproof hosting, is resilient against content moderation and law enforcement activities, and introduces problems for organizations attempting to detect and defend against attacks that may leverage the IPFS network,” Brumaghin said.

    Resource : https://thehackernews.com/2022/11/several-cyber-attacks-observed.html