Cyber Security Briefing: Fancy Bear, Ransomware, Data Brokers, and Zero Trust

Fancy Bear Targets Western Entities

• 🎯 A joint advisory warns of Russia's GRU unit AP28 (Fancy Bear) targeting Western logistics and technology firms, particularly those supporting Ukraine.
• 🎣 Tactics include password spraying, spear phishing, and exploiting vulnerabilities in Microsoft Exchange and Winar, with compromised IP cameras used for monitoring aid deliveries.

Ransomware Disrupts Hospital Network

• 🏥 Kettering Health Network in Ohio suffered a ransomware attack by the Interlock Group, causing a systemwide outage that disrupted electronic health records and elective procedures.
• ⚠️ Attackers threatened to leak stolen data, and scammers impersonated hospital staff to solicit payments, leading the organization to suspend payment-related calls.

Data Broker Regulations Dropped

• 📉 The Consumer Financial Protection Bureau (CFPB) has dropped plans to subject data brokers to tighter regulations, citing that further rulemaking is not necessary.
• 🔒 Critics warn this leaves Americans vulnerable as data brokers collect sensitive information, with past breaches exposing billions of records.

Record-Breaking DDoS Attack and Phishing Campaigns

• 💥 Krebs on Security was hit by a record-breaking DDoS attack peaking at 6.3 terabits per second, mitigated by Google's Project Shield.
• 📧 A phishing campaign used SEO poisoning to trick users into entering credentials on fake mobile payroll sites, rerouting employee paychecks to attacker accounts.

Vulnerabilities and Exploits

• 💻 Atlassian and VMware have issued security advisories for multiple high-severity vulnerabilities in their data center and virtualization products, urging immediate patching.
• 🎓 A 19-year-old student will plead guilty to hacking PowerSchool, a major education software firm, and demanding a ransom of nearly $2.9 million in Bitcoin.

Zero Trust and Deliberate Simplicity with ThreatLocker

• 🛡️ Rob Allen of ThreatLocker discusses the principle of deny by default, permit by exception for endpoint protection and network access.
• 💡 This approach focuses on fundamental controls rather than signature-based or behavioral detection, blocking unauthorized actions like PowerShell accessing the internet, even for sophisticated exploits.
• ☁️ ThreatLocker addresses token theft by using dynamic IP address tracking for conditional access policies in cloud environments, ensuring only trusted devices can connect.
• ⚙️ The onboarding process involves a learning period to build policies based on existing software, with options for company-wide or individual policies to avoid undue friction.
• 🏢 ThreatLocker aims to consolidate security tools within a single agent and portal, offering features like allow listing, ring fencing, network control, web filtering, and patch management to reduce complexity for administrators.

O2 UK Privacy Leak

• 📞 Security researcher Daniel Williams uncovered a privacy leak in O2 UK's 4G calling system, where SIP messages exposed IMSIs, IMIEs, and cell tower IDs, enabling geolocation of call recipients.
• 🔒 O2 has since resolved the issue, but the vulnerability highlighted risks associated with metadata exposure during calls.