Monthly Cybersecurity News February 2024

Here are some interesting updates about cybersecurity threats and new trends.

‍AnyDesk Confronts Major Cyberattack: Source Code and Keys Exposed

AnyDesk, a popular remote desktop application, recently disclosed a serious cyberattack. The attack, which did not involve ransomware, gave hackers access to the company's production systems. This granted access to sensitive components such as source code and private code signing keys. Following the discovery of the event on its production servers, AnyDesk implemented a detailed response strategy with the support of cybersecurity firm CrowdStrike. The organization implemented many corrective actions, including revoking all security-related certificates and replacing systems as needed. In addition, AnyDesk is in the process of withdrawing and changing its previous code signing certificate for its binaries. It also encouraged users to change their passwords, especially if they were used elsewhere, despite the fact that there was no evidence that end-user devices had been compromised.

The consequences of the breachare severe, considering the potential for access to sensitive consumer information. Threat actors could possibly get licensing keys, the number of active connections, session durations, customer IDs, contact information, account emails, and the total number of hosts running remote access control software. This information could be used to conduct technical support scams, phishing, and other illicit actions.

Source: Infosecurity Magazine

Deepfake Deception: $25 Million Scammed from Finance Worker in High-Tech Fraud

A finance staffer at a multinational organization in Hong Kong was deceived into sending $25 million to scammers who used deepfake technology to impersonate the company's chief financial officer (CFO) during a video conference call. The complex scheme used artificial intelligence to build incredibly convincing fake copies of the CFO and several other staff members, persuading the employee to make the large financial transaction. The employee only detected the scam after verifying the transaction with the company's corporate office. This incident has raised serious worries about the growing sophistication of deepfake technology and its potential for fraudulent use. Hong Kong police have made six arrests in connection with such scams and are looking into the use of deepfakes to mislead facial recognition systems. The authorities are also encouraging the public to be cautious, particularly during online meetings with several participants, and to confirm the facts of any business deals using normal communication channels to prevent falling victim to similar AI frauds.

Source: CNN

Love at a High Cost: Unveiling the Reality of Romance Scams in Canada

The CBC News article dives into the world of romance scams, focusing on the personal experience of a reporter who was targeted by a scammer posing as "Bobby Brown," an oil drilling expert residing in Scotland. The scammer, who contacted us via Instagram, followed the traditional description of a romance scammer: he claimed to be a widower professional. This incident was used as a springboard to examine the larger issue of romance scams in Canada, particularly around Valentine's Day, which is a high time for such fraudulent activity.

The Canadian Anti-Fraud Centre (CAFC) released shocking figures on the prevalence of romantic scams, emphasizing the huge financial and emotional toll they exact on victims. Romance scams are among the leading causes of financial fraud losses in 2023, costing 945 victims more than $50 million.

Source: CBC

Operation Cronos: Uniting Forces Against the LockBit Ransomware Threat

LockBit, a prominent cybercrime group known for ransomware attacks, was stopped by the UK National Crime Agency, the FBI, Europol, and other foreign enforcement agencies as part of 'Operation Cronos'. The gang's website was taken over by the UK's NCA, with assistance from the FBI. This operation sought to combat LockBit's extortion tactics, which included stealing sensitive data and demanding ransom payments. LockBit has targeted big companies worldwide, with the United States classifying it as a top ransomware threat after affecting over 1,700 organizations. Notably, LockBit released internal Boeing data, causing Royal Mail to experience problems. The gang organized affiliates to carry out cyberattacks with its tools. The operation included law enforcement organizations from France, Japan, Switzerland, Canada, Australia, Sweden, the Netherlands, Finland, and Germany. Despite the outage, LockBit maintained that its backup servers were unaffected by the attack. This takedown is a huge step in combating cybercrime on a global basis.

Source: The Guardian

The Rise of Deepfake Threats: Navigating the Future of Biometric Verification

The serious issue of AI-generated phony biometric photos has grown to the point that Gartner experts project that by 2026, 30% of businesses will require extra verification methods beyond facial recognition for identity identification. This transition is necessary by the advancement of deepfake technology, which current security mechanisms cannot reliably detect. Gartner recommends Chief Information Security Officers (CISOs) to choose providers who can combat these advanced risks.

In a related cybersecurity worry, vulnerabilities identified in Ivanti Connect Secure and Policy Secure gateways have prompted urgent recommendations for American government organizations to deactivate these devices right now. Before reconnection, a full reset and software upgrade are required, as well as a password and API key reset. It is assumed that linked domain accounts have been compromised, causing immediate action to protect and monitor any potentially vulnerable IT systems.

Furthermore, Cado Security's examination into the "Commando Cat" cryptojacking campaign uncovered the use of insecure Docker containers. Attackers use these containers to deliver payloads that steal cloud service credentials and install bitcoin mining software, highlighting the crucial importance of secure Docker API endpoints.

Finally, a study conducted by Resecurity emphasizes the serious effects of poor digital hygiene among IT and network professionals in diverse countries. The dark web markets are already filled with over 1,500 login credentials for telecom network managers and engineers, highlighting the critical need for multifactor authentication to prevent unwanted access and potential telecom infrastructure manipulation.

Source: IT World Canada

‍

‍