The LogicHub Security Roundup: March 2022 Edition

In summary, a cyber risk management and disclosure rule set was proposed. Among these rules is one that would require publicly traded companies to disclose breach info within 4 days of discovery. It would also require disclosure of risk management policies and is awaiting public comment before final approval.

The Medusa and FluBot Android malware strains share tactics in stealing sensitive data from phones, including passwords and banking details. Spread via SMS and replicated through user contacts, the FluBot strain did not go unnoticed in its success and was most likely used as inspiration for Medusa.

The IsaacWiper malware and HermeticWizrd malware strains have not yet been attributed to known threat actors and have been deployed in separate campaigns. Microsoft President Brad Smith has described the attacks as ‘precisely targeted’ and there is no other indication that any other countries have been targeted.

For the third consecutive year, social media phishing attacks have been rising the ranks as the most used phishing campaigns. Attack sophistication has also risen sharply, with attackers using well-known brands for their impersonation techniques.

Homomorphic encryption, though still mostly in the research phases, has a lot of potential applications in cloud storage and computing and it doesn’t require secret keys to work.This is the first known successful side-channel attack for this encryption method, and is set to be presented at DATE22.

Related in part to the war with Ukraine according to defacement on the website, the compromise actors claimed to be under the handle of ‘v0g3lsec’ on Twitter. A series of files from the Russian space agency were posted by the attackers, including specific documentation on lunar missions. The attackers claimed to have accessed the files by bruteforcing the password for the ‘admin’ username on the space research institute’s file sharing service.

The malware is comprised of a Powershell and Python implant for scripting, a Windows metadata gathering technique, a series of backdoors for command and control, and obfuscated powershell scripts. Organizations should be on the lookout for zip archives with Excel or PDF documents that are transmitted via spearphishing techniques.

Including input from yours truly, this is an in-depth analysis of the industry understanding of Russian ransomware. Russia commonly uses ransomware to help bolster government funding, and with the Russian economy struggling due to war efforts, it’s highly likely that we’ll see expensive attacks in greater numbers from Russian APTs.

Recently updated, this catalog keeps track of commonly exploited vulnerabilities seen in the wild. They include patch-by dates that illustrate how quickly federal contractors and enterprises must patch them. Included in this set are a series of Cisco small business router vulnerabilities (included in our CVE section), Microsoft Exchange and Excel vulnerabilities, and a series of Adobe vulnerabilities. Many of these are not new, but are still very commonly exploited. Among them includes the SeriousSam vulnerability fixed in July 2021.