Cyber Threats Targeting Africa, Memory Safe Languages, and Federal Cyber Insurance

Cybercrime in Africa and Open-Source Abuse

• 🎯 Cybercriminals are targeting financial institutions across Africa using open-source tools like Posh C2, Chisel, and Classroom Spy, repurposing them for lateral movement, persistence, and data exfiltration.
• ⚠️ Attackers disguise these tools with forged signatures and names resembling legitimate software, shifting from Mesh Agent to Classroom Spy for enhanced remote control.
• 🛡️ A technique called authenticode stuffing is being used to hide malware within ConnectWise remote access software's digital signatures, allowing it to pass security checks.

Credential Theft and Printer Vulnerabilities

• 🔑 A fake version of SonicWall's Net Extender VPN app is distributing malware to steal user credentials, including VPN login details, usernames, passwords, and domain information.
• 🖨️ Researchers have identified eight security vulnerabilities affecting numerous Brother printer, scanner, and label maker models, as well as devices from other manufacturers, potentially exposing millions of devices.
• 🚨 The most critical flaw allows attackers to bypass authentication by generating a default admin password based on the device's serial number.

AI-Themed Malware and Signup Fraud

• 🤖 Fake AI-themed websites are being used to spread malware, exploiting interest in tools like ChatGPT and Luma AI through Blackhat SEO tactics.
• 💻 These malicious sites deploy JavaScript to collect browser data, perform fingerprinting, and deliver malware such as Var stealer, Luma Steeler, and Legion Loader.
• 📈 Signup fraud is on the rise, with bots accounting for 46% of customer registration attempts in 2024, driven by AI-driven attack workflows.

Cybersecurity Support and Federal Backstops

• 🌐 A new Common Good Cyber Fund has been launched to support nonprofits providing essential cybersecurity services for public benefit, backed by the UK and Canadian governments.
• 🤝 The fund aims to strengthen the resilience of civil society groups working to counter threats like transnational repression, managed by the Internet Society.
• 🏛️ A proposal suggests creating a federal cyber insurance backstop for the U.S., potentially tied to the expiring terrorism risk insurance law, to address the growing liabilities in the cyber insurance market.

Legal Developments and Industry Insights

• ⚖️ A Moscow court sentenced four REvil gang members to five-year sentences for trafficking stolen credit card data but released them due to time served in pre-trial detention.
• 📉 The SEC has withdrawn proposed cyber rules for investment companies that would have required notification of major incidents and development of written security procedures.
• 💡 The adoption of memory safe languages like Rust, Java, Go, and Python is urged by CISA and the NSA to reduce software vulnerabilities, as memory-related bugs account for a significant portion of CVEs.