In today’s cybersecurity news…
IRS Identity Protection PIN now available for filing season
The IRS has relaunched its Identity Protection Personal Identification Number (IP PIN) program. The IP PIN is a six-digit number assigned to an individual taxpayer and must be used when filing a tax return. It number is only valid for the current year. A new one is assigned each tax year. The goal is to “prevent scammers from filing a tax return using a stolen Social Security Number and personal information. As BleepingComputer points out, this program “is even more critical this year, with over 100 million people’s Social Security Numbers exposed in the massive National Public Data data breach.”
CISA sees enrollment surge in cyberhygiene for critical infrastructure
A report released by CISA on Friday says that after analyzing “7,791 critical infrastructure organizations enrolled in the agency’s vulnerability scanning service from Aug. 1, 2022, through Aug. 31, 2024,” there were “significant increases in enrollment in the agency’s Cyber Hygiene (CyHy) service enrollment,” a program that helps organizations reduce their exposure to threats through proactive monitoring and attack mitigation plans. Organizations from communications, emergency services, critical manufacturing, and water and wastewater systems registered in large numbers. As a result, CISA says, it has found improvements across its six cybersecurity performance goals: mitigating known vulnerabilities, no exploitable services on the internet, strong and agile encryption, limit OT connections on the public internet, deploy a security.txt file, and email security.
City services in Winston-Salem affected by cyberattack
Residents of Winston-Salem, North Carolina, are currently unable to pay their utility bills online following a post-Christmas cyberattack on the city. Officials announced the attack on December 30, after discovering issues with their systems on December 26. Computer systems for digital payment of water and electricity bills have been taken offline, but there have been no disruptions to fire and police abilities. Officials reiterated that “there will be no service interruptions or late penalties charged to accounts. Residents can still pay in person with cash or checks.”
Huge thanks to our sponsor, Dropzone AI
Marijuana dispensary STIIIZY warns of data breach
The breach affected the California-based company’s vendor of point-of-sale processing services for some of its retail locations. Data and customer IDs from its locations at Union Square and Mission in San Francisco, as well as Alameda, and Modesto, California were exposed between October 10 and November 10, 2024. The data consisted of drivers’ licenses, medical cannabis cards, and other personal information, but this varies per individual. “In November the Everest cybercrime group claimed responsibility for the attack, initially setting a ransom deadline of December 8, later it “announced the leak of the stolen data, likely after a failed negotiation.”
Slovakia’s land registry hit by biggest cyberattack in country’s history
The land registry agency, the UGKK shut its systems down, and closed its physical offices last week following this alleged ransomware attack. The country’s Agriculture Minister Richard Takac said in a press conference that the systems would be restored with backups, and that there is “no risk of changes or fraudulent transcriptions of ownership data.” Although there are no solid details as of yet regarding the group behind the attack, Takac said “there were strong indications it originated from Ukraine.” This may be due to rising tensions between Slovakia and Ukraine “following Kyiv’s suspension of Russian gas transit through Slovakian territory.”
Four thousand hijacked backdoors neutralized by WatchTowr
Following up on a story we covered last week regarding the shadow IT and the problem of backdoors, researchers at WatchTowr Labs, working in conjunction with The Shadowserver Foundation registered more than 4,000 abandoned but still active web backdoors, sinkholing their communication infrastructure. These backdoors contained live malware and were “deployed on web servers of high-profile targets, including government and university systems, and were ready to execute commands from anyone who took control of the communication domains.” The registration prevents these domains from falling into the hands of malicious actors.
Microsoft sues hacking group exploiting Azure AI for harmful content creation
The legal action is against a “foreign-based threat–actor group” which has been operating a hacking-as-a-service infrastructure to “intentionally get around the safety controls of Microsoft’s generative artificial intelligence (AI) services and produce offensive and harmful content.” The threat actors allegedly developed software that exploited exposed customer credentials scraped from public websites, used services such as Azure OpenAI Service, monetizing the access by selling the creds to other malicious actors, along with them with detailed instructions as to how to use these custom tools to generate harmful content. Microsoft said it has since revoked the threat-actor group’s access, implemented new countermeasures, and fortified its safeguards to prevent such activity from occurring in the future.