Cybersecurity news headlines trending on Happy New Year 2025

Harley-Davidson Faces Data Breach, Customer Information Leaked

Harley Davidson, the iconic American motorcycle manufacturer, has become the latest victim of a cyberattack. A hacking group known as “888” is reportedly responsible for the breach, which exposed sensitive customer information. The stolen data, which is now being sold on the dark web, includes email addresses, phone numbers, physical addresses, and full names, putting affected customers at risk of phishing and identity theft.

According to sources from Telegram, the group accessed Harley-Davidson’s servers in December 2024, obtaining personal details of over 66,700 individuals. In response, the company has engaged a forensic team to investigate the breach. Harley-Davidson has promised to release further details about the 888 group once the investigation is complete.

US Government Bans Transfer of Citizens’ Data to Foreign Countries

In a significant move to safeguard national security, the U.S. government has enacted Executive Order 14117, which prohibits the transfer of American citizens’ personal data to foreign servers. The new law aims to mitigate rising cyber threats and blocks the export of data to countries like China, Russia, Iran, North Korea, Venezuela, Cuba, and regions such as Hong Kong and Macao.

The executive order was initially set to take effect in February of the previous year, but its implementation was delayed. With the law now in effect, U.S. citizens’ data is better protected from foreign cyber threats.

NoName Hackers Target French Websites After Attacks in Italy

The cybercriminal group NoName57 (also known as NoName57(16)) has escalated its activities, shifting its focus from Italy to France. Following successful attacks on Italian government websites, including airport-related platforms, NoName hackers have now launched DDoS (Distributed Denial of Service) attacks on several French municipal sites.

The group, which aligns with pro-Russian sentiments, stated on their social media channels that these cyberattacks were in retaliation for France’s support of Ukraine. NoName continues to target the digital infrastructure of countries they consider adversaries to Russia.

Sri Lanka’s Police Website and Social Media Accounts Hacked

In an unprecedented cyberattack, Sri Lanka’s police department became the target of hackers, who compromised the department’s website and social media accounts. The attack, which marked the first of its kind in Sri Lanka, caused disruptions, though the situation has largely been brought under control. Senior police official K.B. Manatunga confirmed that the department’s Facebook and Twitter accounts had been restored, but the YouTube channel and the website of the Printer Department remain offline.

Chinese authorities have launched an investigation into the breach and are exploring the possibility of foreign intelligence involvement in the attack.

The post Cybersecurity news headlines trending on Happy New Year 2025 appeared first on Cybersecurity Insiders.

January 01, 2025 at 11:29AM

Read More

Here’s the little known iPhone data security secret, the Lockdown Mode

Apple has introduced a powerful new data security feature, Lockdown Mode, for iPhone users running iOS 16 and later versions. This feature aims to provide heightened protection against cyber threats, particularly for individuals who are at a higher risk of being targeted by advanced attacks. While Lockdown Mode offers enhanced security, it does come with certain limitations that users should be aware of before enabling it.

What is Lockdown Mode?

Lockdown Mode is a security feature designed primarily for individuals who may be vulnerable to sophisticated cyberattacks, such as journalists, activists, or high-profile targets. It is intended to help protect users from spyware and other types of malicious activity. Although initially developed for a limited group of people, Apple has now made this feature available to all iOS users with devices running iOS 16 and above.

The feature limits certain device functionalities in exchange for heightened security. When enabled, Lockdown Mode restricts the use of certain apps, limits web browsing capabilities, and disables specific features in order to prevent the installation or exploitation of spyware like Pegasus, which is known for targeting high-risk individuals.

How to Enable Lockdown Mode?

Activating Lockdown Mode is straightforward. To do so, users should navigate to the Settings app on their iPhone. From there, they should select Privacy & Security, where the option to enable Lockdown Mode can be found. After selecting it, the iPhone will prompt the user to restart the device to activate the feature effectively. Once enabled, Lockdown Mode will function automatically, providing the added layer of protection.

What Does Lockdown Mode Disable?

While Lockdown Mode boosts security, it does so by limiting the functionality of certain apps and services. Here are some of the most notable effects of enabling Lockdown Mode:

Messaging Apps: Apps like WhatsApp will experience restrictions. Users will no longer be able to send or receive attachments such as photos, videos, documents, or links. Link previews are also disabled, meaning that when links are shared, the user will only see the raw URL instead of a preview of the content.

FaceTime: FaceTime calls will not function as they normally would, with some features being disabled or affected. For instance, it might not support video calls or could restrict other interactive elements of the service.

Web Browsing: Web browsing will be significantly impacted. When using Safari or other browsers, pages may load only in plain text, removing images, scripts, and other media that could potentially be used for malicious purposes. This could result in slower browsing experiences, with certain websites appearing incomplete or broken.

App and Website Functionality: In general, many apps and websites will experience a reduction in functionality. By limiting JavaScript and other active features, Lockdown Mode prevents harmful exploits from being executed via these platforms. This also protects against spyware that could otherwise compromise the device.

Emergency Features Remain Unaffected

One of the significant benefits of Lockdown Mode is that it does not interfere with critical emergency features. Functions like the Emergency SOS mode and Find My iPhone will continue to operate normally. These features are vital for user safety and are essential for situations where users need to access emergency help or locate their device.

Limitations on Location Sharing

Another side effect of Lockdown Mode is that location-sharing features may be restricted. While the Find My iPhone feature remains unaffected, the ability to share location information via apps like Messages or third-party apps may be limited or disabled entirely, depending on the specific app in question. This is another security measure to ensure that location data is not exploited by malicious actors.

Conclusion

In summary, Lockdown Mode is a valuable feature for iPhone users who are concerned about advanced cyber threats and spyware attacks. Although it may limit the functionality of some apps and services—such as messaging apps, FaceTime, and web browsing—the trade-off is the added security it provides against highly sophisticated malware. While it may not be suitable for everyday users due to the limitations it imposes, for those who need heightened protection, Lockdown Mode is an important tool to safeguard their personal data and privacy.

The post Here’s the little known iPhone data security secret, the Lockdown Mode appeared first on Cybersecurity Insiders.

December 31, 2024 at 08:35PM

Read More

Chinese APT Hackers behind US Treasury breach of data

Chinese hackers, reportedly part of an Advanced Persistent Threat (APT) group, are accused of breaching the servers and workstations of the U.S. Department of the Treasury. The department confirmed the cyberattack in an official statement released on December 30, 2024.

The breach came to light after the Treasury was alerted by BeyondTrust, a technology vendor, about the possibility of a security compromise. The breach involved the theft of one or two security keys using stolen employee credentials.

According to the details of the incident, the cyberattack occurred on December 8, 2024, targeting the Treasury’s servers. Following the attack, a full-scale investigation was launched, with both the U.S. government and BeyondTrust working to understand the extent of the breach.

Despite the sophistication of the attack, the technology vendor took quick action to mitigate the damage, thanks to a well-prepared disaster recovery plan. Sources on Telegram indicated that the hackers exploited a vulnerability in BeyondTrust’s software to access sensitive data on the Treasury’s systems.

As a precautionary measure, compromised workstations and servers were disconnected from the network.

A letter detailing the incident was sent to the Senate Banking Committee on December 19, 2024, by Aditi Hardikar, the Assistant Secretary of the Treasury.

The Committee on House Financial Services will review the matter next week, and a comprehensive report will be provided to the FBI for further investigation.

Chinese Cyber Threats Escalating

Chinese cyber operations targeting U.S. infrastructure have been a persistent concern for years and appear to be intensifying. Beijing’s goal to become a global superpower by 2035 has led to increased surveillance of U.S. government networks since 2016. The recent revelation of the Salt Typhoon espionage campaign, which compromised nine major U.S. telecom companies, highlights the ongoing nature of these threats.

The U.S. government’s cybersecurity challenges are not limited to China, however. North Korea has increasingly used digital wallets to fund its nuclear ambitions, while Iran has ramped up its cyber warfare efforts to gain influence in the digital domain.

U.S. Response: Retaliation on the Horizon?

With the incoming administration under former President Donald Trump set to take office in mid-January 2025, there are expectations of a more aggressive response to foreign cyber threats. The new leadership has vowed to counter China’s technological dominance with retaliatory cyberattacks. This stance builds on previous initiatives like the Snowden whistle blown Pentagon’s cyber operations, which have sought to outpace Russian and Chinese activities in the cyber realm since as early as 2013.

As geopolitical tensions rise, the United States faces a growing array of cyber adversaries, including China, North Korea, and Iran. In this environment, it is crucial that governments take decisive action to strengthen cybersecurity defenses to prevent further economic and political disruption.

The post Chinese APT Hackers behind US Treasury breach of data appeared first on Cybersecurity Insiders.

December 31, 2024 at 10:34AM

Read More

Italy faces DDOS attacks from Russia

On Saturday, a series of sophisticated cyberattacks hit nine Italian government websites, causing disruptions across several key digital platforms. Among the affected sites were those of Italy’s Foreign Ministry, as well as the official websites of Milan’s two major airports, Linate and Malpensa. Despite the scale of the attack, Italy’s proactive cybersecurity defenses were able to mitigate the impact, with the downtime limited to just 109 minutes, according to an official spokesperson authorized to speak on the matter.

The attack took the form of a Distributed Denial of Service (DDoS) assault, a common tactic where websites are bombarded with an overwhelming amount of fake web traffic. This flood of traffic effectively blocks legitimate users from accessing the targeted services, causing disruptions. While the attack did cause temporary outages, crucial systems, including those related to air travel, remained operational without affecting flight schedules or airport operations.

Pro-Russian Group “Noname57” Claims Responsibility

The Russian-affiliated hacking group known as “Noname57(16)” claimed responsibility for the DDoS attacks. In an official statement released on Telegram, the group asserted that Italy had been targeted due to its perceived anti-Russian sentiment, accusing the country of being influenced by “Russophobes.” The group also warned that additional attacks on Italian digital infrastructure were planned for early next year, signaling that this assault may have been just the beginning of a broader campaign.

The credibility of the group’s statement is uncertain. While the message could simply be a propaganda tool or a strategy to further disrupt Italian politics, Italy’s Cybersecurity Agency (ACN) has confirmed that the attack took place and is continuing its investigation into the full scope and origin of the assault. The agency has promised to release more details once the inquiry is complete, but for now, it is unclear whether the DDoS campaign is part of a larger, coordinated effort by state-backed actors or a rogue operation by independent hackers sympathetic to Russian interests.

Cyberattacks: A Historical Context

Cyberattacks, particularly those involving DDoS, have often been linked to state-sponsored groups, especially when targeting key infrastructure and government institutions. Such attacks are not only aimed at disabling services but also serve a broader strategic purpose: to sow confusion, create chaos, and undermine public trust in government operations. In many cases, these cyberattacks have been used as part of broader geopolitical strategies to retaliate against countries perceived as adversaries.

Historically, state-sponsored actors have launched cyberattacks against both public and private entities to disrupt daily operations, weaken the economy, and tarnish the international reputation of their targets. The effects of these campaigns often reverberate far beyond the immediate victims, drawing attention from global media and influencing public opinion, particularly in Western countries where such attacks are seen as part of ongoing geopolitical tensions.

Italy’s Support for Ukraine as a Potential Trigger

The timing of the DDoS attacks against Italy coincides with the country’s unwavering support for Ukraine in its ongoing conflict with Russia. Italian Prime Minister Giorgia Meloni has been a staunch ally of Kyiv, consistently voicing support for Ukraine’s sovereignty and providing both humanitarian and military aid in its struggle against Russian aggression. This support has undoubtedly provoked a reaction from Moscow, which has previously expressed anger at nations that openly back Ukraine.

It is believed that the cyberattacks against Italy are a form of retaliation by Russian-backed hackers, attempting to send a message to the Italian government. By targeting Italy’s key digital infrastructure, the attackers sought to disrupt operations and draw attention to Italy’s role in the conflict. However, despite the scale of the cyberassault, Italian authorities report that the actual damage was minimal. The country’s airports, despite being targeted, did not experience any major disruptions, and flight schedules remained unaffected.

Ongoing Investigation and Future Threats

As of now, Italy’s cybersecurity agencies are continuing to investigate the scope of the attack, which appears to have been part of a larger trend of Russian-linked cyberattacks against European countries that support Ukraine. The Cybersecurity Agency (ACN) has stressed the importance of remaining vigilant, noting that this attack could be a precursor to more coordinated actions, particularly given the warning from Noname57(16) about further attacks in the coming months.

The Italian government has also assured the public that additional measures are being taken to bolster cybersecurity defenses, especially as the geopolitical landscape continues to evolve. With tensions between Russia and Ukraine showing no signs of abating, experts warn that cyberattacks like these may become more frequent and sophisticated, potentially targeting critical infrastructure such as energy grids, government agencies, and even financial institutions.

Conclusion

The recent wave of DDoS attacks against Italy highlights the growing role of cyber warfare in international politics. While the attacks were effectively mitigated, the geopolitical context suggests that this may be only one part of a larger strategy aimed at destabilizing countries that oppose Russian interests. Italy’s resilience in the face of these attacks, combined with its strong cybersecurity measures, demonstrates the importance of cybersecurity in safeguarding critical infrastructure against increasingly sophisticated digital threats.

As Italy continues to support Ukraine in the face of Russian aggression, the likelihood of further cyberattacks remains high, and cybersecurity will undoubtedly remain a top priority for both the government and private sector in the months to come.

The post Italy faces DDOS attacks from Russia appeared first on Cybersecurity Insiders.

December 30, 2024 at 08:33PM

Read More

SquareX Researchers Expose OAuth Attack on Chrome Extensions Days Before Major Breach

Palo Alto, Calif., USA, December 30th, 2024, CyberNewsWire

SquareX, an industry-first Browser Detection and Response (BDR) solution, leads the way in browser security. About a week ago, SquareX reported large-scale attacks targeting Chrome Extension developers aimed at taking over the Chrome Extension from the Chrome Store.

On December 25th, 2024, a malicious version of Cyberhaven’s browser extension was published on the Chrome Store that allowed the attacker to hijack authenticated sessions and exfiltrate confidential information. The malicious extension was available for download for more than 30 hours before being removed by Cyberhaven. The data loss prevention company declined to comment on the extent of the impact when approached by the press, but the extension had over 400,000 users on the Chrome Store at the time of the attack.

Unfortunately, the attack took place as SquareX’s researchers had identified a similar attack with a video demonstrating the entire attack pathway just a week before the Cyberhaven breach. The attack begins with a phishing email impersonating Chrome Store containing a supposed violation of the platform’s “Developer Agreement”, urging the receiver to accept the policies to prevent their extension from being removed from Chrome Store. Upon clicking on the policy button, the user gets prompted to connect their Google account to a “Privacy Policy Extension”, which grants the attacker access to edit, update and publish extensions on the developer’s account.

Fig 1. Phishing email targeting extension developers

Fig 2. Fake Privacy Policy Extension requesting access to “edit, update or publish” the developer’s extension

Extensions have become an increasingly popular way for attackers to gain initial access. This is because most organizations have limited purview on what browser extensions their employees are using. Even the most rigorous security teams typically do not monitor subsequent updates once an extension is whitelisted.

SquareX has conducted extensive research and demonstrated at DEFCON 32, how MV3-compliant extensions can be used to steal video stream feeds, add a silent GitHub collaborator, and steal session cookies, among others. Attackers can create a seemingly harmless extension and later convert it into a malicious one post-installation or, as demonstrated in the attack above, deceive the developers behind a trusted extension to gain access to one that already has hundreds of thousands of users. In Cyberhaven’s case, attackers were able to steal company credentials across multiple websites and web apps through the malicious version of the extension.

Given that developer emails are publicly listed on Chrome Store, it is easy for attackers to target thousands of extension developers at once. These emails are typically used for bug reporting. Thus, even support emails listed for extensions from larger companies are usually routed to developers who may not have the level of security awareness required to find suspicion in such an attack. As per SquareX’s attack disclosure and the Cyberhaven breach that occurred within the span of less than two weeks, the company has strong reason to believe that many other browser extension providers are being attacked in the same way. SquareX urges companies and individuals alike to conduct a careful inspection before installing or updating any browser extensions.

Fig 3. Contact details of extension developers are publicly available on Chrome Store

SquareX team understands that it can be non-trivial to evaluate and monitor every single browser extension in the workforce amidst all the competing security priorities, especially when it comes to zero-day attacks. As demonstrated in the video, the fake privacy policy app involved in Cyberhaven’s breach was not even detected by any popular threat feeds.

SquareX’s Browser Detection and Response (BDR) solution takes this complexity off security teams by:

• Blocking OAuth interactions to unauthorized websites to prevent employees from accidentally giving attackers unauthorized access to your Chrome Store account
• Blocking and/or flagging any suspicious extension updates containing new, risky permissions
• Blocking and/or flagging any suspicious extensions with a surge of negative reviews
• Blocking and/or flagging installations of sideloaded extensions
• Streamline all requests for extension installations outside the authorized list for quick approval based on company policy 
• Full visibility on all extensions installed and used by employees across the organization

SquareX’s founder Vivek Ramachandran warns: “Identity attacks targeting browser extensions similar to this OAuth attack will only become more prevalent as employees rely on more browser-based tools to be productive at work. Similar variants of these attacks have been used in the past to steal cloud data from apps like Google Drive and One Drive and we will only see attackers get more creative in exploiting browser extensions. Companies need to remain vigilant and minimize their supply chain risk without hampering employee productivity by equipping them with the right browser native tools.”

About SquareX:

SquareX helps organizations detect, mitigate, and threat-hunt client-side web attacks happening against their users in real-time.

SquareX’s industry-first Browser Detection and Response (BDR) solution, takes an attack-focused approach to browser security, ensuring enterprise users are protected against advanced threats like malicious QR Codes, Browser-in-the-Browser phishing, macro-based malware, and other web attacks encompassing malicious files, websites, scripts, and compromised networks.

With SquareX, enterprises can provide contractors and remote workers with secure access to internal applications, and enterprise SaaS, and convert the browsers on BYOD / unmanaged devices into trusted browsing sessions.

Contact

Head of PR
Junice Liew
SquareX
junice@sqrx.com

The post SquareX Researchers Expose OAuth Attack on Chrome Extensions Days Before Major Breach appeared first on Cybersecurity Insiders.

December 30, 2024 at 08:01PM

Read More

Google trending Cybersecurity headlines for the last weekend

Space Bears Ransomware Targets Atos SE in Major Cyberattack

Atos SE, the France-based global leader in cloud computing and cybersecurity services, has confirmed a major cybersecurity breach involving the ransomware group Space Bears. The cybercriminals claim to have compromised Atos’ database, extracting sensitive data by exploiting a known vulnerability. The attack is part of a growing wave of ransomware campaigns that target large corporations for financial extortion.

The attack occurred on December 28, 2024, and led to the deployment of file-encrypting malware that disrupted Atos’ servers. In response, Atos issued a public statement acknowledging the breach and assured that an investigation was underway. While the company has yet to release detailed information about the scope of the breach, it promised to provide updates as the investigation progresses.

The timing of the attack is particularly notable. It occurred just weeks after Atos had announced the completion of its financial restructuring plan, which had been overseen by its creditors. The timing has raised concerns about whether the cyberattack was linked to these internal corporate changes, though there is no official statement connecting the two events at this time.

As a leading player in cybersecurity, Atos’ own infrastructure and its clients’ data were likely a key target for the cybercriminal group. Atos’ response to the breach and its commitment to uncover the full details of the attack will be closely watched by the cybersecurity community and its clients, who rely on the company for cloud and cybersecurity services.

Android’s ‘Find My Device’ Feature Triggers False Alerts

Android users have been facing a frustrating issue with the Find My Device feature, as it has been sending out false alarms for the past two weeks. These notifications are triggered when registered devices are moved, but the alarms are incorrectly set off even when the devices remain in trusted locations, such as within the home.

The issue appears to be most prevalent for households with both Android and Apple iOS devices. Experts speculate that the interference between these two operating systems, coupled with Bluetooth-enabled devices, is behind the false alerts. The problem seems to be exacerbated when Android devices are in close proximity to Apple devices, causing cross-platform interference that triggers unnecessary notifications.

To address the issue, cybersecurity professionals are recommending that Android users activate the whitelisting feature on their devices, that should be activated by default. Whitelisting allows users to specify which devices and locations are trusted, helping to streamline the alert system and reduce the occurrence of false alarms. By restricting alerts to only those situations where there is a genuine risk, whitelisting can help improve the user experience for those affected by the bug.

While the issue has been widespread, Android’s development team has not yet released an official fix. However, users can take steps to mitigate the problem by updating their settings and minimizing the chances of receiving erroneous alerts.

AT&T and Verizon Defend Their Networks Against Cyber Espionage Claims

In response to allegations of being targeted by the Chinese-linked Salt Typhoon cyber espionage campaign, American telecom giants AT&T and Verizon have issued statements confirming that their networks remain secure from any compromise related to the threat. The Salt Typhoon campaign, which has reportedly been active since 2016, is believed to have targeted multiple telecom networks across North America, with particular focus on espionage activities aimed at government officials and sensitive communications.

The controversy surrounding these claims escalated after Anne Neuberger, a White House official, suggested in a public statement that eight North American telecom networks were impacted by the campaign, with AT&T possibly being the ninth target. This revelation raised concerns about the scope and impact of the espionage operation, which allegedly involved the theft of sensitive data, including government communications.

FBI officials later corroborated these concerns, noting that Salt Typhoon may have compromised data related to government officials’ calls and messages. However, both AT&T and Verizon have vigorously denied any breach of their networks, reassuring the public that their security measures are robust and have successfully thwarted any attempts at espionage.

These statements come in the wake of growing scrutiny of foreign cyber activities targeting critical infrastructure in the West. The Salt Typhoon campaign, reportedly linked to Chinese state-sponsored hackers, highlights the ongoing threat posed by cyber espionage, particularly against telecom networks, which are essential for secure communications and data transmission.

AT&T and Verizon’s swift responses have been welcomed by both the telecom industry and government officials, who continue to monitor the situation closely to ensure that such vulnerabilities do not compromise national security. The FBI’s ongoing investigation into the Salt Typhoon campaign is expected to provide further insights into the extent of the threat and the potential targets of these malicious activities.

The post Google trending Cybersecurity headlines for the last weekend appeared first on Cybersecurity Insiders.

December 30, 2024 at 11:12AM

Read More

2024 Attack Surface Threat Intelligence Report – Cogility – TacitRed

Introduction

Over 80% of cyber breaches result from external threat actors conducting phishing, session hijacking, account takeover, and ransomware attacks, putting organizations under mounting pressure to improve their security posture and automate cyber response. This increase in successful attacks stems from an extended attack surface, vulnerable internet-facing assets and susceptible users, and increased coordination and advancement of cyber-attack methods. Threat Intelligence Management (TIM) and External Attack Surface Management (EASM) are core technologies for security teams to fortify their security posture, increase threat response efficiency, and improve cyber resiliency.

The 2024 Attack Surface Threat Intelligence Report, produced by Cybersecurity Insiders, the 600,000+ member online community of information security professionals, serves as a foundation to gain insight on the challenges, advantages, maturity, and best practices for applying TIM and EASM to mitigate attack surface risks.

KEY FINDINGS INCLUDE:  

•90% of organizations experienced an increase in impactful attack surface incidents. Smaller organizations had 60% more impactful incidents than larger organizations.

• 84% of respondents reported external attack surface changes contributing to security incidents.

• 33% of organizations have mature external attack surface management programs — nearly half are early stage. Larger companies’ programs are twice as mature as smaller organizations, on average.

•66% of respondents claimed only nominal usefulness of their current threat intelligence tools with the majority (65%) seeking multi-source, curated, and prioritized threat intelligence. Not surprisingly, management found tools 30% more effective than actual operators.

•Over 40% of organizations have challenges with supply chain risk, external asset inventory, and active threat and      breach detection effecting attack surface management integrity.

• Over 60% of organizations have attack surface management objectives to accelerate threat identification and      response times, and to achieve complete and accurate asset inventory.

•90% of organizations anticipate a budget increase in attack surface management and threat intelligence tools –      40% expect an increase of over 20%.

We want to thank Cogility TacitRed for supporting this important industry research. We hope you find this report informative and helpful as you continue your efforts to protect your organization against evolving threats.

Thank you,

Holger Schulze Founder,

Cybersecurity Insiders

Most Impactful Attack Vectors

As the external attack surface rapidly expands due to increases in cloud adoption, third-party integrations, hybrid work, and supply chain, understanding the operational and financial impact of external attack surface exposures is essential for prioritizing security initiatives and investments.

The survey reveals malware and ransomware (54%) continue to drain resources, from operational disruption to recovery. Compromised credentials is a close second on the list of attack vectors, with 50% of respondents reporting significant costs tied to validation, remediation efforts, account recovery, and other system-wide security enhancements. Phishing follows closely at 49%, reflecting the burden of detection, user education, and incident response. Supply chain attacks (40%) continue to introduce additional complexity by requiring investments to determine the scope of third-party cyber risk. 

Lastly, 36% of respondents highlight the costs associated with targeted technologies, internet-facing assets, and cloud exposures, which demand ongoing security monitoring and threat mitigation across dispersed infrastructure.

Key Factors Driving External Attack Surface Incidents

The new normal of remote and hybrid work, along with Bring Your Own Device (BYOD) exposures, continues to be among top factors contributing to external attack surface security issues, as cited by 60% of respondents. Remote work has significantly expanded the perimeter, introducing personal devices and home networks into corporate ecosystems, often with insufficient security controls. 

The adoption of new technologies (59%), including cloud services and IoT, further complicates security efforts, as organizations struggle to protect a dispersed and growing set of assets. Additionally, 56% point to the expansion of web applications and APIs as attack vectors frequently exploited due to weak authentication or misconfigurations. Supply-chain exposures (34%) continue to present threat actor activity against partner enterprises.

Expanding External Attack Surface

As organizations expand their digital footprint through hybrid cloud adoption, new technologies and modern applications, and third-party services, their external attack surface has grown significantly. This survey reveals that 84% of respondents report an increase in their external attack surface activity, with 36% observing a sharp rise in asset changes over the past year. The increased complexity of managing these distributed digital ecosystems compounds the risk, as cybercriminals exploit gaps in security across the cloud, new technologies, supply chains, and external-facing assets.

This expansion is closely tied to a significant rise in impactful external attack surface management threats. A combined 90% of respondents report an increase in significant incidents, with 31% seeing a substantial rise in attacks and incidents over the past year. The sheer expansion and dynamics of the attack surface has made it more difficult for organizations to manage vulnerabilities, with adversaries exploiting new entry points more aggressively.

Smaller organizations (<2,500 employees) experienced 60% more impactful incidents compared to larger enterprises (>2,500 employees), underscoring the disproportionate risk they face despite having fewer resources. Additionally, technology and financial services sectors reported slightly more impactful incidents than the government sector, reflecting their higher exposure to external threats due to their reliance on a more dynamic and greater connected infrastructure.

Challenges in Managing Attack Surface Risk 

Managing the external attack surface presents several challenges, particularly in identifying active third-party exposures, which 45% of respondents cited as their top pain point. As organizations become more dependent on external vendors and partners, the complexity of securing these third-party connections increases, introducing new attack vectors across the supply chain. Additionally, maintaining an accurate inventory of internet-facing assets (41%) has become a significant hurdle. The sheer scale of digital assets across cloud services, applications, and remote work environments makes it difficult for security teams to maintain up-to-date visibility.

Detecting active external actor-engaged threats and breaches (40%) demonstrates the burden and volume of potential security threats, violations, and issues that SecOps teams must filter, validate, and respond to.  Filtering through all the threat noise, highlighted by 39% of respondents, remains a key challenge as security teams struggle with excessive data, alerts, and false positives. 

An overload of irrelevant and inaccurate information not only contributes to analyst workload problems and burnout, but can also lead to missed detections and delayed responses to genuine security issues. Compounding  external attack surface management obstacles, 37% of respondents cited difficulties with poor-quality threat intelligence, where data is often inaccurate or unactionable, further hampering the ability to respond efficiently to security incidents.

Most Useful Threat Intelligence Sources

In the face of growing external attack surface security issues, organizations rely heavily on threat intelligence to inform their defense strategies and attack response. The survey results indicate a clear preference for multi-source, curated, and prioritized threat intelligence, with 65% of respondents finding it the most useful. This underscores the importance of intelligence that is not merely aggregated or relatively comprehensive, but validated, correlated, refined, and actionable—enabling security teams to focus on the most critical threats and with information to expedite mitigation efforts. This attack surface threat intelligence greatly reduces the burden on security teams to identify, triage, and respond to active exposures – also helping to reduce analyst’s efforts to manage through extraneous threat intelligence noise and data overload.

Half of respondents (54%) are using aggregation platforms that organize multiple intelligence sources, from vulnerability alerts to dark web sources. These popular platforms attempt to bring vast amounts of threat intelligence and data feeds into searchable a context, although they may not have as much perceived operational value as per the findings expressed earlier. Additionally, community and industry exchanges, such as ISACs and sector-specific sharing groups, also have value to half of organizations (51%). These exchanges provide sector-relevant intelligence, fostering collaboration across industry peers to address shared threats.

Notably, open-source and government intelligence sources are perceived as lower value, with less than 30% of respondents citing these as useful. This suggests a growing preference for intelligence that is more actionable, curated, and relevant to an organization, rather than the broad, often uncontextualized data from open-source or governmental sources.

To enhance their threat intelligence capabilities, organizations should prioritize platforms that offer curated, multi-source intelligence and invest in solutions that offer detailed, yet prioritized insights. These tools not only enhance the efficiency of security teams but also ensure that resources are directed toward mitigating the most relevant and immediate threats.

Effectiveness of Threat Intelligence Tools 

The survey results reveal a negative outlook on the effectiveness of current attack surface intelligence tools, with only a portion of the market realizing full value from their capabilities. While 28% of respondents rate their tools as useful—indicating that these solutions deliver some degree of curated, pre-validated, and prioritized threat data—the majority (66%) find them only nominally useful. 

This suggests that while some organizations are benefiting from advanced attack surface intelligence that enables proactive responses and reduces investigation time, most still struggle with tools that provide only more generalized threat intellience, requiring analysts to do more investigative analysis and inference. The fact that 6% of respondents find their tools not useful at all, citing irrelevant data and an increase in alert noise, highlights that many attack surface intelligence solutions have not met the market’s needs.

Smaller organizations found their attack surface threat intelligence tools 20% less effective compared to larger organizations, likely reflecting the advantage larger enterprises have in both size and specialized personnel. Unsurprisingly, management reported finding these tools 30% more effective than those in operational roles, indicating a potential gap between tool perception and hands-on efficacy.

The gap in usefulness underscores that vendors providing these solutions have much room for improvement. It suggests that most attack surface intelligence tools are still not reducing investigative burdens on security analysts. Many organizations still face overwhelming data and noise, with tools that fall short in filtering and prioritizing actual threats. To improve value, organizations should focus on those tools that not only provide comprehensive threat data but also prioritize actionable intelligence. Solutions that reduce the investigation burden by delivering pre-validated threat details allow security teams to act more efficiently and proactively, ultimately improving their overall threat response capabilities.

Perceived Trends for EASM and Threat Intelligence

Perceived future trends driving the evolution of EASM are centered on the convergence of Vulnerability Assessment (VA), Continuous Automated Attack Surface Management (CAASM), and EASM solutions, cited by 63% of respondents. This convergence reflects the industry’s shift toward Continuous Threat Exposure Management (CTEM), where processes and supporting tools work together to enable security teams to achieve comprehensive visibility, proactive remediation, efficient incident response, and greater resiliency, across all layers of an organization’s attack surface. Additionally, 51% of respondents anticipate greater reliance on generative artificial intelligence (AI) to facilitate threat response and mitigation, as AI rapidly analyzes large datasets and automates noise reduction, threat validation, and mitigation triage processes. Respondents also anticipate easier to use tools (33%) and broader integration capabilities (28%) to enhance their SecOps team’s ability to improve their cyber security posture.

Interestingly, 25% of respondents foresee a reduction in the number of subscribed threat intelligence sources, pointing to a shift toward fewer, more effective attack surface threat intelligence solutions.

EASM Program Maturity

The maturity of EASM programs varies significantly across organizations. Nearly 50% of respondents report that their programs are in the early stages of development, either in the “Initial” or “Repeatable” phases, where processes remains unstructured and reactive. Only 33% of respondents are in the most advanced stages of maturity, with 22% reporting proactive, managed programs and 11% achieving optimized automation and continuous threat assessment. Perhaps the anticipated increase in EASM expenditure may be applied to progress program capabilities (and tool sets), and in turn, maturity. 

Larger companies (>2,500 employees) report EASM maturity levels twice that of smaller organizations (20% vs. 10%). Operations teams (16%) are less positive about maturity than senior management (18%). Government and critical infrastructure sectors (25%) trail slightly behind financial services, healthcare, and technology, with technology and healthcare reporting stronger maturity (23%).

These findings underscore ample room for growth in maturing the people, processes, and tools necessary for effective EASM. Organizations must move beyond ad hoc and reactive measures and invest in more advanced, proactive, and automated approaches that help mature attack surface management to enhance their overall security posture and resilience.

Near-Term EASM Program Objectives

As organizations continue to face new threats across an expanding attack surface, their near-term focus is on improving speed, accuracy, and intelligence in managing attack surface exposures. A top priority for 65% of respondents is accelerating identification and remediation speed. This indicates a clear recognition of the need for faster responses to emerging threats as organizations deal with more sophisticated and dangerous threats against an increasingly dispersed and vulnerable digital landscape. Additionally, 59% seek to achieve a complete and accurate inventory of all internet-facing assets, underscoring the risks associated with attack surface dynamics as previously expressed by respondents, including the ongoing challenge of maintaining visibility across cloud environments, remote endpoints, and web applications.

Enhancing proactive remediation is a goal for 48% of respondents, highlighting the shift from reactive defenses to more forward-looking strategies aimed at stopping threats before they escalate. This aligns with Continuous Threat Exposure Management (CTEM) initiatives taking ground in many organizations. Similarly, 44% are focused on enriching the quality of threat intelligence data in existing tools (SIEM, XDR, SOAR), seeking to amalgamate internal with external attack surface insights. This would also serve to enhance overall capabilities for security posture risk assessment, as well as help further automate remediation and containment. Notably, 30% aim to reduce the volume and noise of threat intelligence data, emphasizing that while more intelligence is being gathered, filtering out irrelevant and outdated information remains a critical challenge for security teams.

These priorities show that while organizations are advancing their attack surface management programs, they still have significant hurdles to overcome, particularly in balancing comprehensive visibility with the reduction of threat noise. Solutions that offer real-time monitoring, actionable insights, and improved filtering capabilities will be critical in helping security teams keep pace with the evolving digital landscape.

Expanding Budgets

The financial and resource commitment to EASM is on the rise, with 90% of respondents expecting budget increases in the coming year. Of these, 40% anticipate significant increases of more than 20%, reflecting the growing recognition of EASM’s importance in mitigating risks and securing the expanding attack surface.  

Methodology and Demographics

The 2024 Attack Surface Threat Intelligence Report is based on a comprehensive online survey of 312 cybersecurity professionals conducted in September 2024 to gain insight into the challenges, advantages, maturity, and best practices for using threat intelligence and managing external attack surface risk. All respondents manage programs and teams or use threat intelligence and external attack surface management tools daily.

__

TacitRed

Tactical Attack Surface Intelligence – Today, over 80% of security breaches originate from threat actors successfully conducting phishing, session and malware attacks, and exploiting vulnerable internet-facing assets. Cogility TacidRed empowers security analysts to take immediate, decisive actions to mitigate impactful cyber exposures by taking advantage of unparalleled tactical attack surface intelligence.

•Continuous intelligence; on-demand, curated, prioritized, and detailed.

•In-depth findings; scoring, threat type, attack stage, severity, and full context.

•Expedite time to resolution, attack containment, and proactive mitigation

•Active attack surface exploits and exposures of over 18 million U.S entities.

•Compreshensive, actionable third-party risk assessment 

Learn more at tacitred.com

__

Cybersecurity Insiders brings together 600,000+ IT security professionals and world-class technology vendors to facilitate smart problem-solving and collaboration in tackling today’s most critical cybersecurity challenges. Our approach focuses on creating and curating unique content that educates and informs cybersecurity professionals about the latest cybersecurity trends, solutions, and best practices. From comprehensive research studies and unbiased product reviews to practical e-guides, engaging webinars, and educational articles – we are committed to providing resources that provide evidence-based answers to today’s complex cybersecurity challenges. For more information: email us info@cybersecurity-insiders.com or visit cybersecurity-insiders.com

 

 

 

 

 

 

 

 

 

 

 

The post 2024 Attack Surface Threat Intelligence Report – Cogility – TacitRed appeared first on Cybersecurity Insiders.

December 28, 2024 at 12:18PM

Read More

Volkswagen data breach of Electric cars and D Link router botnet attack

Volkswagen Data Leak Exposes Information of Over 800,000 Electric Vehicle Owners

Volkswagen (VW), one of the most well-known automobile manufacturers in the world, has become the latest victim of a significant data breach that has compromised the personal information of over 800,000 electric vehicle (EV) owners. The breach, which has raised concerns about data privacy, exposed sensitive details such as location data and contact information of customers. However, what makes this breach particularly alarming is that it was not the result of a sophisticated cyberattack, but rather due to a simple misconfiguration in Volkswagen’s cloud infrastructure.

Details of the Breach: The exposed data originated from Cariad, the software arm of Volkswagen, which handles the company’s connected car services. The data was stored in an unsecured cloud instance on Amazon Web Services (AWS), which remained publicly accessible for several months. This misconfiguration allowed unauthorized access to the information, putting customer data at risk. The specific data leaked included geolocation details, which can potentially be used to track the movements of vehicle owners, and personal contact information, which could be exploited for phishing attacks or other forms of identity theft.

How the Breach Could Be Exploited: Cybersecurity experts have raised concerns that the leaked geolocation data could enable malicious actors to create detailed profiles of the affected users. By analyzing the locations of the electric vehicles over time, hackers could infer users’ daily routines, travel habits, and potentially even their home or workplace addresses. This type of information is invaluable to cybercriminals, who could use it for targeted attacks or other malicious purposes.

Interestingly, the breach was discovered not by Volkswagen’s internal security team, but by the Chaos Computer Club (CCC), a prominent European hacking group known for its ethical hacking efforts. The CCC, which has been active since 1981 and boasts over 7,000 registered members, was the first to report the data leak to the public. The group’s involvement highlights an important aspect of modern cybersecurity: the role of independent security researchers in detecting vulnerabilities and holding organizations accountable.

As of now, Volkswagen has not issued a public statement addressing the breach or outlining any steps they plan to take to mitigate the damage. The company’s silence has raised questions about their preparedness for handling such incidents and their commitment to protecting customer data.

Implications for Volkswagen and Its Customers: For Volkswagen, this breach could have serious reputational consequences. In an age where data protection is increasingly a priority for consumers, mishandling sensitive information can erode customer trust. Moreover, the exposure of location data could lead to more targeted attacks on vehicle owners, raising concerns about the security of VW’s connected car services.

The situation also underscores the importance of proper cloud security configurations. Despite the increasing reliance on cloud infrastructure, many organizations still fail to secure their data properly, leaving it vulnerable to unauthorized access. This breach is a reminder that even the most reputable companies can make costly errors if they do not prioritize security in all aspects of their operations.

D-Link Routers Targeted by Botnet Attacks Exploiting Legacy Vulnerabilities

In another troubling cybersecurity development, D-Link routers, used by millions of consumers worldwide, have become the target of a growing botnet attack. This attack, which involves the exploitation of legacy vulnerabilities in outdated router models, poses a significant risk to internet security, as these routers could be hijacked and used as nodes in large-scale distributed denial-of-service (DDoS) attacks and other malicious activities.

Botnet Attacks on D-Link Routers: According to recent research by Fortinet’s FortiGuard Labs, two particular botnets—named FICORA and CAPSAICIN—have been identified as actively targeting D-Link routers. These botnets are capable of gaining full control over the affected devices remotely, turning them into part of a botnet army. Once infected, the compromised routers can be used to launch DDoS attacks, which can overwhelm websites and online services, causing outages or disrupting operations.

The root cause of the issue lies in legacy vulnerabilities that remain unpatched in certain D-Link router models. Despite the company’s efforts to patch some of these flaws, many devices are still running outdated firmware, making them easy targets for cybercriminals. The research from FortiGuard Labs indicates that in the past three months, there has been a notable increase in the number of attacks exploiting these unpatched vulnerabilities.

Why Are Legacy Devices Such a Risk? One of the biggest problems with older networking devices is that they often no longer receive firmware updates or security patches. This is especially true for routers that have reached their “end of life” (EOL), meaning the manufacturer no longer provides official support or updates for the device. As a result, these routers become increasingly vulnerable to new types of cyberattacks. In the case of D-Link, the botnets are targeting specific models that have not been updated to address known security flaws.

What Users Can Do: D-Link users are being strongly advised to take immediate action to protect their devices. The first step is to ensure that their routers are running the latest firmware, which may include security patches that address known vulnerabilities. If a device is nearing its end of life or no longer receives firmware updates, users are encouraged to replace it with a newer model that offers enhanced security features.

This incident highlights the importance of maintaining up-to-date security for all connected devices, particularly those that serve as entry points to home or office networks. As cybercriminals continue to target weak links in the digital ecosystem, individuals and organizations must be vigilant in securing their IoT devices and networking equipment.

The Broader Implications: The increasing prevalence of botnet attacks highlights a growing cybersecurity challenge in the world of connected devices. While companies like D-Link have a responsibility to patch their products and provide adequate security measures, end-users also play a crucial role in safeguarding their devices. The rise of botnets like FICORA and CAPSAICIN is a reminder that weak security on consumer devices can have far-reaching consequences, affecting not only individual users but also the broader internet infrastructure.

Both of these incidents—Volkswagen’s data breach and the D-Link router botnet attacks—serve as stark reminders of the ongoing threats in the digital age. They underscore the importance of robust cybersecurity practices, timely software updates, and a proactive approach to protecting personal data. As cyber threats continue to evolve, both consumers and companies must remain vigilant in their efforts to defend against them.

The post Volkswagen data breach of Electric cars and D Link router botnet attack appeared first on Cybersecurity Insiders.

December 27, 2024 at 08:36PM

Read More

Hacking Tug-of-War: China Accuses the USA for launching cyber attacks on its Technology Infrastructure

In recent weeks, the landscape of online espionage has shifted dramatically. For years, Western governments and companies have openly accused China of orchestrating cyber attacks on critical infrastructure to steal trade secrets, intellectual property, and sensitive data. However, the narrative has now taken a turn, with China publicly accusing the United States of launching similar cyber attacks on Chinese tech firms. These allegations, made by the Chinese National Internet Emergency Center (CN-CERT), have raised eyebrows globally and shed light on the growing complexity of international cyber conflicts.

The Allegations: Espionage Targeting Chinese Tech Firms

According to a recent report released by CNCERT, two major Chinese tech firms have been targeted by cyber attacks that they claim were aimed at stealing classified information and intellectual property. The first company is a prominent data analytics firm, while the second is a key player in China’s energy sector. These digital incidents are not just limited to minor data breaches; they are described as sophisticated attacks designed to extract valuable corporate secrets, which are considered critical for both national security and economic growth.

The report details how these attacks were conducted, although specifics remain sparse, leaving many to speculate on the methods and scale of the infiltration. CNCERT has framed these incidents within the broader context of global cyber espionage, pointing to the United States as the primary actor behind these breaches.

A New Cyber Cold War?

China’s accusations are significant because they represent a shift in the long-standing cyber conflict narrative. For years, China has been at the center of allegations from the U.S. and other Western nations for deploying state-backed hackers to infiltrate foreign systems, steal intellectual property, and even sabotage critical infrastructure. The U.S., in particular, has accused Chinese entities of engaging in widespread cyber-espionage campaigns, most notably through the activities of groups like APT10, which were linked to China’s Ministry of State Security.

However, as the world becomes more digitally interconnected, both countries seem to be caught in a vicious cycle of cyber retaliation. The recent Chinese allegations suggest that the U.S. may have crossed the line, with the Chinese government asserting that its technological infrastructure is under attack from American state-backed hackers.

One of the most notable factors in this escalation is the growing sophistication of the attacks. CNCERT’s report indicates that the breaches involved not just simple phishing attempts or malware attacks, but highly targeted, advanced persistent threats (APTs) that have been used in high-stakes online espionage. These types of attacks are usually associated with nation-state actors and are difficult to attribute, further complicating the narrative.

The Salt Typhoon Controversy: The U.S. Telecom Crisis

The timing of China’s allegations coincides with the unfolding Salt Typhoon controversy, a massive digi attacks that has reportedly compromised the systems of at least eight major U.S. telecom firms. This breach, attributed to Chinese hackers, is seen as a critical moment in the ongoing cyber war between the two nations. Salt Typhoon is believed to have been an intelligence-gathering operation rather than a disruptive attack, which has only intensified fears of China’s cyber capabilities.

As the Salt Typhoon incident continues to develop, cyber security experts are increasingly concerned about the vulnerabilities in telecom and tech infrastructure worldwide. The breach has raised questions about the security of the U.S.’s critical communication networks and the potential for Chinese influence on American digital systems. It also reinforces the notion that digi- attacks are becoming a primary tool for geopolitical maneuvering, further complicating relations between the U.S. and China.

China’s Call to Action: Securing the Digital Frontier

In response to the cyber attacks on its firms and the ongoing cyber conflict, China’s cybersecurity agencies have urged domestic businesses to ramp up their efforts to secure their digital infrastructure. The China Computer Emergency Response Team (China CERT) has issued a set of guidelines urging companies to deploy the latest software updates, implement robust monitoring mechanisms, and adopt advanced threat detection systems.

These recommendations reflect an understanding of the severity of the threat. In a world where both state and non-state actors have access to increasingly powerful cyber tools, China has recognized the need to create a more resilient digital ecosystem. This includes investing in cybersecurity infrastructure and fortifying the defense of key sectors, such as energy, telecommunications, and finance.

China’s government is also stepping up its cybersecurity laws and regulations, pushing for greater oversight and control over digital systems. These measures are designed not only to protect Chinese firms from foreign attacks but also to consolidate the government’s role in overseeing the nation’s growing digital economy. By doing so, China is signaling that it will not sit idly by while its critical infrastructure remains vulnerable to foreign espionage.

A Complex Digital Geopolitics

What we are witnessing is the evolution of cyber conflicts into a central aspect of international relations. The battle over digital sovereignty, trade secrets, and intellectual property is intensifying, and both the U.S. and China are using espionage as a tool of statecraft. As the U.S. and China continue to accuse each other of online intrusions, businesses and governments worldwide are facing an increasingly hostile digital landscape.

The cyber cold war between the U.S. and China is far from over. If anything, it is entering a new phase, with both countries ramping up their efforts to protect their digital infrastructure and retaliate against perceived threats. For businesses, the lesson is clear: no entity—be it a data analytics firm, an energy company, or a telecom operator—can afford to be complacent in today’s interconnected world.

As global tensions rise, the lines between espionage, cyber assaults, and warfare are becoming ever more blurred. This ongoing cyber battle will undoubtedly shape the future of global commerce, security, and diplomacy in the digital age. The outcome of this conflict will not only impact the U.S. and China but will also reverberate throughout the global economy and international relations. The world is now watching closely to see how this cyber espionage saga unfolds and how businesses, governments, and citizens adapt to the growing threats in the digital realm.

The post Hacking Tug-of-War: China Accuses the USA for launching cyber attacks on its Technology Infrastructure appeared first on Cybersecurity Insiders.

December 27, 2024 at 11:35AM

Read More

Clop Ransomware Gang Targets Cleo File Transfer Service and threatens to expose Sensitive Data

The infamous Clop Ransomware gang has once again made headlines by successfully breaching the servers of Cleo, a well-known provider of file transfer software. The cybercriminal group is now threatening to leak sensitive data from Cleo’s extensive client base unless a ransom demand is met within a 48-hour deadline. The ransomware group has already issued warnings to 66 companies, indicating that if they fail to negotiate or pay the required sum within the stipulated time frame, their confidential information will be sold on the dark web.

Initial Leak and Growing Threats

The Clop gang has already taken the first step in its extortion campaign by releasing partial names of the companies affected by the breach on their dark web portal. This public exposure is intended to pressure the victimized organizations into complying with their demands. The ransomware group has further warned that if no agreement is reached within the next two days, they will release the full names of these companies, potentially causing irreparable damage to their reputations and trust with customers.

This tactic is part of a larger strategy of “double extortion”, which has become increasingly common among sophisticated ransomware gangs. In double extortion attacks, cybercriminals not only encrypt the victim’s data, making it inaccessible, but they also threaten to release the stolen information unless the ransom is paid. What sets this attack apart is that Clop has now escalated its threats to include customer and client data stolen from the breached systems of Cleo’s clients. This adds an additional layer of urgency, as businesses face the risk of compromising sensitive information related to their customers, suppliers, and employees.

Exploitation of Vulnerabilities in Cleo’s Software

Reports from Cybersecurity Insiders reveal that Clop gained access to Cleo’s systems by exploiting critical zero-day vulnerabilities in several of Cleo’s products, including Lexicom, VLTransfer, and Harmony. These software products are widely used for secure file transfer and data exchange, making them attractive targets for cybercriminals. By exploiting these vulnerabilities, Clop was able to infiltrate the company’s servers and access the sensitive data of all its clients.

The use of zero-day exploits, which are previously unknown security flaws, makes this attack particularly dangerous. Once the vulnerabilities were discovered and exploited by Clop, Cleo was left with little recourse to prevent the breach or stop the attackers from exfiltrating large volumes of data. The company, which provides secure data transfer solutions to a broad range of businesses, has yet to comment on the full scope of the breach or its efforts to mitigate the damage.

The Double Extortion Playbook: A Growing Trend in Cybercrime

While the idea of ransomware attacks is not new, the strategy of double extortion—which involves both the encryption of files and the public leak of sensitive data—is a more recent and disturbing trend. The tactic is becoming increasingly common among highly organized cybercriminal gangs like Clop, who are motivated not only by financial gain but also by the desire to damage their victims’ reputations.

In previous high-profile incidents, the Clop gang used similar tactics, including in the MoveIT file transfer attack that compromised the data of several prominent organizations. In that case, Clop not only demanded ransom payments from the affected companies but also threatened to expose client data if the ransom was not paid. The same pattern of behavior is expected to unfold in the current attack on Cleo and its clients, with the gang likely to use the stolen information to extract as much profit as possible.

The victims in these kinds of attacks often face tough choices. On one hand, paying the ransom might allow them to regain access to their encrypted data. On the other, businesses that choose to comply with the demands run the risk of encouraging further attacks on themselves and others, as ransomware gangs are incentivized by the money they generate from such crimes.

The Broader Impact: A Call for Stronger Cybersecurity

The Cleo attack highlights an ongoing global cybersecurity crisis where businesses, regardless of their size or industry, are vulnerable to sophisticated attacks from ransomware gangs. For organizations that rely on third-party services for data transfer and file management, this breach underscores the importance of securing software and systems against zero-day vulnerabilities.

The attack also raises critical questions about the responsibility of software providers like Cleo in safeguarding their clients’ data. As companies continue to migrate their operations to cloud-based and third-party solutions, they must be vigilant in ensuring that the software they use is regularly updated and protected from the latest cyber threats.

For businesses that find themselves at the center of a ransomware attack, the incident serves as a stark reminder of the importance of having a robust incident response plan in place. This plan should include measures for both preventing attacks and responding effectively when a breach occurs—ranging from deploying strong encryption practices to ensuring employees are trained in identifying phishing attempts and other common attack vectors.

Conclusion: A Growing Threat Landscape

As the threat landscape continues to evolve, it is likely that ransomware attacks will become more sophisticated and impactful. The rise of groups like Clop, who specialize in double extortion tactics, is a warning for businesses around the world to take cybersecurity seriously. The Cleo breach is just one of many examples of how cybercriminals are adapting to a changing digital landscape, and it underscores the need for organizations to stay ahead of emerging threats through proactive defense strategies, regular vulnerability assessments, and quick response plans to mitigate damage in the event of an attack.

As Clop’s deadline approaches, Cleo and its clients are under intense pressure to protect their sensitive data, preserve their business reputations, and avoid becoming the next headline in the growing list of ransomware-related breaches.

The post Clop Ransomware Gang Targets Cleo File Transfer Service and threatens to expose Sensitive Data appeared first on Cybersecurity Insiders.

December 26, 2024 at 08:27PM

Read More

2024 Cloud Security Report Fortinet

Introduction

Companies are increasingly pursuing a cloud-first strategy by developing and deploying applications with the cloud in mind. With the majority of organizations adopting a hybrid or multi-cloud approach to support various use cases and work models, the attack surface has significantly broadened, making securing today’s cloud environments more critical and increasingly complex. 

The 2024 Cloud Security Report, based on a comprehensive survey of 927 cybersecurity professionals worldwide, provides critical insights into the current trends driving cloud security. It explores key challenges in protecting complex cloud environments, what solutions and strategies cybersecurity professionals are prioritizing, how they’re allocating their resources, and the best practices they’re adopting to ensure the security of cloud workloads. 

Key findings include:  

• Multi-Cloud Preference: A majority of organizations (78%) opt for hybrid and multi-cloud strategies to combine flexibility, control, and the unique benefits of various cloud services.
• Cloud Adoption Barriers: Security and compliance concerns (59%) are critical roadblocks to faster adoption of multi-cloud strategies. Technical challenges (52%) and resource constraints (49%) present substantial challenges in achieving visibility and policy control within complex multi-cloud infrastructures and emphasize the necessity for robust cloud security expertise.
• Cybersecurity Talent Shortage: Companies face a critical shortage of cybersecurity expertise, with 93% of respondents concerned about finding qualified professionals to protect complex multi-cloud environments. This directly affects their security posture and strategic efforts. This persistent scarcity of cloud security expertise hinders faster and more widespread adoption of multi-cloud strategies.
• Unified Cloud Security Platform Preference: 95% of respondents advocate for a single platform to streamline security across cloud environments. The objective is to simplify and automate security management, mitigate the talent gap, and enhance security through consistent policy enforcement and visibility, addressing the inefficiencies of managing multiple disparate security systems.

We would like to thank Fortinet for the invaluable support of this important industry research project. We hope this report serves as a practical guide for cybersecurity leaders and practitioners to navigate the complexities of cloud security more effectively in your ongoing efforts to secure your organization’s cloud journey against evolving cyber threats.

Thank you,

Holger Schulze Founder

Cybersecurity Insiders

Cloud Deployment Strategies

Choosing the right cloud deployment strategy is critical for organizations to maximize the benefits of cloud computing while minimizing associated risks. 

The majority of organizations (78%) favor a hybrid or multi-cloud strategy, integrating multiple deployments into a single operating environment. A large portion of this (43%) use a hybrid of cloud and on-premises infrastructure. 35% of organizations have a multi-cloud strategy, highlighting a preference for leveraging the strengths of different cloud service providers for a variety of use cases. Just 22% rely on a single cloud provider, suggesting a focused approach that simplifies management but that may increase dependency on one vendor.

To better navigate the complexities of hybrid and multi-cloud deployments, organizations should prioritize an integrated security framework that ensures seamless protection across their entire digital footprint. This is essential to delivering the agility, scale, and security needed for robust defense against evolving cyber threats.

Multi-Cloud Adoption

The number of cloud providers an organization uses is crucial, impacting operational flexibility, risk management, and the complexity of security implementations. A majority of organizations (71%) use two or more cloud providers, indicating an approach that seeks to combine flexibility, control, and the unique benefits of each cloud service provider. An increase of 2 percentage points from last year’s survey reflects a growing shift towards multi-cloud strategies, driven by the need for specialized cloud services, regional availability, and redundancy.

Interestingly, only 29% of organizations rely on just one cloud provider, highlighting a preference for simplicity and perhaps a strategic partnership with a single cloud provider.

Organizations should adopt a seamless, cloud-neutral approach to securing multiple cloud environments that ensures consistent security policies and visibility across their digital footprint, reducing complexity and bolstering defense mechanisms against increasingly sophisticated cyber threats.

Preferred Cloud Providers

Next, we asked cybersecurity professionals about their current and future use of cloud providers, to better understand the changing market dynamics within the cloud ecosystem. Microsoft Azure continues to lead the market, with 62% of organizations in our survey currently utilizing its services, followed by Amazon Web Services (AWS) at 54%. This indicates a strong preference for these established cloud giants.

The survey results also highlight a significant interest in future adoption across all providers, particularly Oracle Cloud and Google Cloud Platform, with 27% and 25% of respondents planning to adopt these services, respectively. This suggests an increasingly diverse cloud adoption.

Navigating Cloud Adoption Barriers

Identifying and understanding the barriers to faster and more widespread cloud adoption is essential for organizations to better navigate the complexities of transitioning to cloud-based solutions.

Security and compliance concerns are at the forefront, with 59% of respondents identifying it as a primary barrier. This highlights the importance of ensuring that security and compliance are an integral element of cloud adoption. Technical challenges follow closely at 52%, highlighting that the ease of cloud adoption is not without its challenges.

49% of respondents cite resource constraints, including the lack of staff expertise and budget limitations, underscoring the need for adequate investment in human and financial resources to support cloud initiatives. Organizational and operational barriers (49%) underscore that cloud computing is not just a new technology, it is also a new operating model that offers innovative working methods and requires management buy-in to address potential resistance to change.

Perceptions of Cloud Security Risks

Evaluating the risk of security breaches in public cloud environments reveals significant concerns about the risks and unique security challenges associated with cloud computing, compared to on-premises environments.

A combined 44% of respondents perceive the risk of security breaches in public cloud environments as higher than in traditional on-premises IT environments, with 30% considering it somewhat higher and 14% viewing it as significantly higher.

Conversely, 30% of participants view the risk as lower in public cloud environments, indicating confidence in cloud providers’ security measures and advancements. A notable 26% of respondents believe the risk remains the same, suggesting that while the cloud introduces new dynamics, the fundamental security challenges persist across environments.

Public cloud offers organizations the opportunity to embrace a proactive, automated approach to security. Adopting a security-by-design mindset offers organizations the ability to effectively mitigate risks and capitalize on the scalability, flexibility, and innovation that the cloud offers.

Cloud Security Concerns

The level of concern regarding public cloud security is a critical indicator of the cybersecurity community’s perception and readiness to address potential risks and threats.

Despite increasing cloud adoption, cloud security concerns show no signs of improving: a significant majority of 96% express high levels of concern, with 37% being extremely concerned and 41% very concerned about public cloud security. The high degree of cybersecurity concern, which has remained consistent over the years, acts as a significant barrier to faster cloud adoption, as organizations grapple with the perceived risks and the complexities of securing cloud environments. Only a small fraction (22%) report moderate to no concern, indicating a strong consensus on the importance of robust security measures in public cloud deployments. 

This data aligns with the previous finding where a combined 44% of respondents perceived a higher risk of security breaches in public clouds compared to traditional on-premises environments. This reinforces that while cloud computing offers numerous benefits and grows rapidly, security remains a paramount concern.

To address these concerns, organizations should not only maintain a security-by-design approach but also invest in continuous monitoring, threat intelligence, and incident response capabilities specific to cloud environments. Adopting cutting-edge security solutions and fostering strong collaborations with cloud providers can help mitigate the perceived risk and concerns associated with public cloud, ensuring a secure and resilient cloud infrastructure.

Challenges in Cloud Security Operations

The management of day-to-day cloud security operations presents a multifaceted challenge for organizations, requiring a delicate balance between technological, procedural, and human factors. Data security and privacy emerges as the top concern, with 58% of respondents highlighting the critical importance of protecting sensitive information and preventing data leaks in the cloud. This underscores the importance of robust data governance and encryption practices. Configuration management is a close second at 55%, reflecting the complexity and potential risks associated with cloud configurations—as a single misconfiguration can expose organizations to significant security risks. 

Access control and identity management is another major challenge, cited by 54% of participants, emphasizing the need for stringent control over user access and privileges to prevent unauthorized access. Threat detection and respons (50%) and endpoint security (45%) further indicate the ongoing struggle to identify and mitigate security threats in real-time and secure the myriad of devices accessing cloud services. Policy and compliance management (45%) and cloud security management (45%) highlight the difficulties in ensuring consistent security policies across environments and aligning cloud security features with on-premises solutions.

To navigate these challenges in cloud security operations, organizations should prioritize a unified security strategy that leverages automation, advanced analytics, and integrated security platforms to streamline data security, policy enforcement, access management, and threat detection and response. Emphasizing the development of cloud-native security skills within teams and fostering a culture of security awareness can further enhance an organization’s ability to manage cloud security operations effectively.

Multi-Cloud Security Challenges

Multi-cloud environments significantly increase the complexity and challenges of securing cloud workloads. Ensuring data protection and privacy in each environment is identified as the most significant multi-cloud security challenge, with 55% of respondents highlighting it as a concern. This aligns with the earlier emphasis on data security and privacy as critical operational issues, underscoring the increased complexity when data is dispersed across multiple cloud environments. 

Having the right skills to deploy and manage solutions across all cloud environments is a major challenge for 51% of participants, echoing the previously noted need for cloud-native security expertise to effectively navigate the multifaceted cloud security landscape. Understanding how different solutions fit together and understanding service integration options are critical challenges for 47% and 44% of respondents respectively.

These concerns spotlight the intricacies of achieving seamless integration and interoperability among diverse cloud environments, a crucial factor for maintaining robust security and operational efficiency. The challenge of managing the costs of different solutions, cited by 42% of respondents, further reflects the operational and financial balancing act required in a multi-cloud strategy.

To effectively address these challenges, organizations should leverage integrated security solutions that offer visibility and control across multi-cloud environments, supporting consistent data protection and privacy standards. Emphasizing partnerships with vendors that provide comprehensive multi-cloud security capabilities and fostering skills development can empower businesses to overcome the complexity of securing multi-cloud architectures. This approach not only mitigates the identified challenges but also harnesses the full potential of multi-cloud environments for enhanced agility, scalability, and innovation.

Cybersecurity Talent Gap

Echoing the challenges highlighted in securing multi-cloud environments, the ongoing shortage of skilled professionals capable of protecting complex multi-cloud environments stands out as an ongoing, critical industry problem.

An overwhelming 93% of respondents express concern about the industry-wide shortage of qualified cybersecurity professionals. This considerable apprehension reflects the acute awareness of the gap between the growing demand for skilled cybersecurity talent and the available workforce, a gap that exacerbates security vulnerabilities and operational challenges in an increasingly complex cyber landscape. 

An emphatic 74% of respondents confirm that their organization is currently experiencing a shortage in cybersecurity talent. This finding quantifies the extent to which the skills shortage is affecting day-to-day security operations and strategic initiatives within organizations.

To mitigate the impact of the perennial cybersecurity skills shortage, organizations should consider a multifaceted approach that includes fostering partnerships with academic institutions to pipeline new talent and investing in training and development programs to cultivate internal talent and adapt to the evolving demands of cloud security. Organizations should also consider embracing unified security solutions that replace multiple-point solutions, incorporating artificial intelligence, and reducing operational complexity to bridge the skills gap while enhancing threat detection, response capabilities, and overall security posture.

Critical Cybersecurity Skills

In the context of the pronounced cybersecurity talent shortage faced by organizations, we asked about the specific cybersecurity skills deemed most critical for addressing today’s security challenges.  

Cloud and application security skills takes the top spot, with 60% of respondents highlighting its critical importance. This underscores the accelerated migration to cloud services and the necessity for robust security practices in application development and deployment. Following closely, identity and access management (IAM) is identified by 59% of organizations as essential, reflecting the growing complexity of securing user access across increasingly distributed IT environments.

Governance, risk, and compliance (GRC) is recognized by 58% of respondents as an important skill, underscoring the essential role of regulatory compliance and risk management frameworks in today’s cyber threat landscape. Security monitoring and operations, threat intelligence, and advanced technical security skills—all at 57%— demonstrate a nearly equal emphasis on proactive threat detection, understanding cyber adversaries, and leveraging advanced technologies for robust security posture.

Cloud Security Budget Trends

The allocation of resources to cloud security is a critical indicator of organizational priorities and the perceived importance of cloud infrastructure protection in the face of evolving cyber threats and technological advancements.

A significant 61% of respondents anticipate an increase in their cloud security budget over the next 12 months. This substantial majority signals a strong recognition of the escalating cybersecurity challenges and the need for enhanced security measures in cloud environments, propelling cloud security budget to increase by 37%.

The willingness to invest up to 37% more in cloud security reflects an understanding that robust defense mechanisms are essential to safeguard sensitive data and maintain compliance with regulatory standards in the increasingly cloud-centric business landscape.

Meanwhile, a third of organizations (32%) expect their cloud security budget to remain unchanged. Only a small fraction, 7%, project a decrease in their cloud security budget. 

Given the predominant trend towards increased cloud security investment, organizations should strategically allocate additional resources to areas of highest risk and potential impact, such as advanced threat detection, identity and access management, and security automation. This approach not only prepares businesses to combat sophisticated cyber threats but also enhances their overall security posture by leveraging the latest technological innovations in cloud security.

Embracing Cloud-Based Security Solutions

The decision to adopt cloud-based security solutions is driven by a variety of factors that align with organizational goals for agility, efficiency, and enhanced protection. The need for better scalability, recognized by 56% of survey respondents, highlights the cloud’s ability to dynamically adjust to fluctuating demands. Close behind, cost savings and faster deployment, at 47% and 46% respectively, underscore the economic and operational benefits enticing organizations towards cloud security solutions. Enhanced performance (42%) and the reduction of manual efforts for patching and software upgrades (40%) further catalyze the shift to cloud-based security solutions, especially in light of the perennial cybersecurity skills shortage.

Organizations considering cloud-based security solutions should prioritize scalability, cost efficiency, and rapid deployment to capitalize on the cloud’s operational and economic advantages. Focusing on solutions that offer streamlined policy management and continuous compliance can further enhance security postures, ensuring resilience in the face of evolving threats and regulatory landscapes.

Unified Cloud Security Platform

Given the complexity, operational headaches, and skills challenges already highlighted, it comes as no surprise that organizations are looking for a unified security platform to streamline and consolidate security management across diverse cloud environments. An overwhelming 95% of respondents confirm that having such a platform would be advantageous for protecting data consistently and comprehensively across the cloud footprint. 

This demand for a single, integrated cloud security platform echoes the industry’s shift towards platform consolidation, driven by improving security effectiveness, simpler integration, and reduced management overhead. It is the only effective approach to addressing the cybersecurity talent gap and mitigating increasingly sophisticated and automated attacks. Such a unified platform alleviates the operational burden of navigating multiple security interfaces and enhances overall security posture through consistent policy enforcement and comprehensive visibility across all cloud environments.

Securely Embracing the Cloud:  Essential Cloud Security Strategies

I n today’s rapidly evolving cloud landscape, adopting a robust cloud security posture is imperative for organizations of all sizes. This guide outlines essential best practices for securing your cloud environments, from unifying security platforms to investing in specialized skills, designed to protect against the sophisticated threats of tomorrow.

ADOPT A UNIFIED SECURITY PLATFORM: Centralize security control and visibility across all cloud environments to streamline operations and enhance visibility, a strategy preferred by 95% of organizations.

EMPHASIZE CLOUD-AGNOSTIC SECURITY:  With 78% using hybrid or multi-cloud environments, it’s crucial to develop strategies that address the unique challenges of these environments and ensure consistent security policies and enforcement.

AUTOMATE POLICY AND COMPLIANCE MANAGEMENT: Implement systems to automate and streamline security policies across cloud environments and consistently meet regulatory requirements. 

PRIORITIZE DATA PROTECTION:  Implement robust data governance and encryption to safeguard sensitive information across all cloud services, addressing the security challenge mentioned by 58% of organizations.

ENHANCE CONFIGURATION MANAGEMENT:  Actively manage cloud configurations to prevent misconfigurations and reduce exposure to security vulnerabilities.

STRENGTHEN ACCESS CONTROL: Employ strict identity and access management to implement Zero Trust principles and reduce the risk of unauthorized access.

BOOST THREAT DETECTION AND RESPONSE:  Leverage advanced analytics and automated response capabilities to identify and mitigate threats in real time.

INVEST IN CLOUD-NATIVE SECURITY SKILLS:  With 93% expressing great concern over the cybersecurity skills shortage, foster the development of cloud-specific security expertise within your team to navigate the complex cloud security landscape more effectively.

Methodology and Demographics

The 2024 Cloud Security Report is based on a comprehensive global survey of 927 cybersecurity professionals conducted in February 2024, to uncover how cloud user organizations are adopting the cloud, how they see cloud security evolving, and what best practices IT cybersecurity leaders are prioritizing in their move to the cloud. The respondents range from technical executives to IT security practitioners, representing a balanced cross-section of organizations of varying sizes across multiple industries.

__

Fortinet (NASDAQ: FTNT) secures the largest enterprises, services providers, and government organizations around the world. Fortinet empowers our customers with complete visibility and control across the expanding attack surface and the power to take on ever-increasing performance requirements today and into the future. Only the Fortinet Security Fabric platform can address the most critical security challenges and protect data across the entire digital infrastructure, whether in networks, application, multi-cloud, or edge environments. Fortinet ranks #1 as the company with the most security appliances shipped worldwide and more than 730,000 customers trust Fortinet to protect their businesses. www.fortinet.com

__

Cybersecurity Insiders brings together 600,000+ IT security professionals and world-class technology vendors to facilitate smart problem-solving and collaboration in tackling today’s most critical cybersecurity challenges. Our approach focuses on creating and curating unique content that educates and informs cybersecurity professionals about the latest cybersecurity trends, solutions, and best practices. From comprehensive research studies and unbiased product reviews to practical e-guides, engaging webinars, and educational articles – we are committed to providing resources that provide evidence-based answers to today’s complex cybersecurity challenges. Contact us today to learn how Cybersecurity Insiders can help you stand out in a crowded market and boost demand, brand visibility, and thought leadership presence. Email us at info@cybersecurity-insiders.com or visit cybersecurity-insiders.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The post 2024 Cloud Security Report Fortinet appeared first on Cybersecurity Insiders.

December 26, 2024 at 12:59PM

Read More