Snowflake breach escalates with ransom demands and death threats
As many as 10 companies are facing ransom payments between $300,000 and $5 million following a breach against cloud-based data analytics firm Snowflake earlier this month. According to Mandiant, who has helped lead Snowflake’s case, the hacking scheme has “entered a new stage” as the ransom demands flow in, as well as death threats against the cybersecurity experts investigating the breach. The hackers gained access to the information by targeting Snowflake users using single-factor authentication techniques. Mandiant has said it anticipates the ransomware group to “continue to attempt to extort victims.”
MITRE has a memo for the president
MITRE is weighing in on where the incoming administration should set its focus next year, regardless of who wins the 2024 election. The memo was broken into four different priorities, number one being protecting critical infrastructure followed by implementing zero trust and SBOMs, preparing for quantum computing, and clarifying cybersecurity leadership roles. These recommendations emphasize upgrading legacy systems, enhancing security practices at local and state levels, and ensuring readiness for post-quantum cryptography. Additionally, MITRE suggests making the Cybersecurity and Infrastructure Security Agency (CISA) an independent agency, mapping out roles and responsibilities of cybersecurity personnel within the first 90 days.
Velvet Ant maintains three-year cyber espionage campaign
This threat actor wasn’t going down without a fight. Researchers at Sygnia have uncovered a prolonged, sophisticated cyber-espionage campaign by China’s “Velvet Ant” group targeting a large company in East Asia. Despite repeated eradication attempts, the threat actor maintained persistence for about three years by exploiting legacy and unmonitored systems, particularly using an old F5 BIG-IP appliance for internal command and control (C&C).
(Dark Reading), (Sygnia), (The Hacker News)
Give me the credentials or else
The UNC3944 cyber gang, best known for its involvement in recent attacks on Snowflake and MGM entertainment, is now targeting SaaS applications. Mandiant researchers claim they personally eavesdropped on the threat actors calling help desks to ask staff to reset passwords with MFA; if that failed, the criminals would resort to fear-mongering tactics, including threats of physical harm to victims and their families, in an attempt to quickly find a way to gain persistent access. Mandiant reports that the group is targeting organizations including VMware’s vCenter management tool, CyberArk, Salesforce, Azure, CrowdStrike, AWS, and Google Cloud Platform.
Huge thanks to our sponsor, Vanta
Los Angeles Public Health breach impacts 200,000
All it takes is one person to click the bad guy’s link. We’ve all heard this story before, but the Los Angeles Department of Public Health (DPH) says the personal information of 200,000 individuals has been compromised after an employee fell victim to a phishing attack back in February. The attack led to the compromise of 53 public health employees’ login credentials, which allowed attackers to gain access to personal information including names, social security numbers, diagnoses, and prescriptions.
(Infosecurity Magazine), (Security Week), (LA County Public Health)
Empire Market operators face life for $430 million Scheme
Two of the suspected operators behind the prominent dark web marketplace, Empire Market, face life in prison for their part in facilitating more than $430 million in dark web sales. While users could buy everything from illicit drugs to counterfeit currency, the DOJ has charged the pair with helping cybercriminals conduct nearly four million transactions. 38-year-old Thomas Pavey and 28-year-old Raheim Hamilton operated the platform from 2018 to 2020. Prior to starting Empire Market, they sold counterfeit U.S. currency on the now-shut down AlphaBay.
The entire town has been breached
Every single household within an entire region of Scotland is receiving a letter warning them that their medical data was most likely stolen in a ransomware attack. The INC Ransom group, responsible for the attack, had threatened to release the data unless an extortion payment was made, which the health trust refused. NHS Dumfries and Galloway’s chief executive, Julie White, advises all 150,000 residents to assume their data has been compromised and to be vigilant against potential scams.
Insurance company Globe Life reports attack
The insurance company, Globe Life, which oversees more than 17 million policies, disclosed a data breach in a filing with the SEC last week. The company says they have launched an investigation into “potential vulnerabilities related to access permissions and user identity management for a company web portal.” It appears the vulnerabilities allowed access to consumer and policyholder information, but the report did not say how many people or what information may have been impacted. Globe Life says they have removed access to the affected portal and that all other systems remain operational.