Tag: threat intelligence

Posted on by

Perimeter security appliances source of most ransomware hits

Compromised or vulnerable perimeter security appliances and devices – especially virtual private networks (VPNs) – formed the initial access vector in over half of observed ransomware attacks during 2024, according to data released this week by cyber security insurance provider Coalition in its latest annual threat report, covering 2024.

US-based Coalition, which began offering its so-called Active Insurance policies in the UK back in 2022, said that cyber criminals compromised such appliances in 58% of claims with which it dealt during 2024, with the second most widespread access point being remote desktop products, blamed in 18% of claims.

“While ransomware is a serious concern for all businesses, these insights demonstrate that threat actors’ ransomware playbook hasn’t evolved all that much – they’re still going after the same tried and true technologies with many of the same methods,” said Alok Ojha, head of security products at Coalition.

“This means that businesses can have a reliable playbook too, and should focus on mitigating the riskiest security issues first to reduce the likelihood of ransomware or another cyber attack. Continuous attack surface monitoring to detect these technologies and mitigate possible vulnerabilities could mean the difference between a threat and an incident.”

Unsurprisingly, the most commonly compromised products were all built by ‘household’ names in the industry, including the likes of Cisco, Fortinet, Microsoft, Palo Alto Networks and SonicWall. The most common initial access vectors (IAVs) were stolen credentials, used in 47% of such intrusions, and software exploits, seen in 29% of cases.

Coalition’s analysts warned that exposed logins were fast-emerging as an underappreciated and acute driver of ransomware risks. They claimed that the organisation detected more than five million remote management solutions and tens of thousands of login panels exposed on the public internet. It added that, according to its data, most applicants for cyber insurance (65%) had at least one internet-exposed web login panel, and securing these is a requirement for buying its products.

Out of these, the most commonly exposed admin login panels related to VPNs from Cisco and SonicWall, which between them accounted for over 19% of detected exposed panels, followed by Microsoft email services.

In 2024, Coalition also observed a significant number of exposed Citrix panels, which caused significant losses, including more than a billion dollars from the infamous Change Healthcare incident in the US, in which a ransomware gang used stolen Citrix credentials and exploited a lack of multifactor authentication to access the victim’s systems.

CVEs set to jump in 2025

As part of the set of services Coalition provides, it sends out zero-day alerts to its customers as and when new vulnerabilities are discovered, and constantly monitors for new vulnerabilities.

As such, its annual report also includes data on some of the more widespread common vulnerabilities and exposures (CVEs) it saw in 2024 – issues with Citrix, Fortinet, Ivanti and Palo Alto Networks prominent among them.

Looking ahead to 2025, Coalition’s analysts said the number of published vulnerabilities would likely increase to more than 45,000, a rate of nearly 4,000 every month, up 15% over the first 10 months of 2024.

This aligns closely with data released in February by the Forum of Incident Response and Security Teams (First), a non-profit, which suggested that CVE volumes may even top 50,000 this year.

A combination of new players in the CVE ecosystem, evolving disclosure compliance practices and a rapidly expanding attack surface are likely behind the growing number of vulnerabilities being reported on.

“This year’s report focuses on the most crucial security risks that under-resourced organisations should understand to better calibrate their defensive investments to bolster resilience,” said Daniel Woods, senior security researcher at Coalition.

“Calibration involves balancing security investment across vulnerabilities, misconfigurations and threat intelligence, while also responding to emerging threats, such as zero-day vulnerabilities exploited in the wild. That’s why Coalition issues Zero-Day Alerts to help businesses, especially SMEs with limited security resources, stay ahead of these vulnerabilities and reduce alert fatigue by prioritising those posing the greatest risk.”

Source

Posted on by

Quantum computing in cyber security: A double-edged sword

Despite investor scepticism, prominent quantum computing stocks have seen a notable rise at the beginning of 2025. Even prominent tech leaders like Jensen Huang and Mark Zuckerberg stating the field won’t be profitable hasn’t stopped investors and the wider public from being excited. 

In cyber security, however, quantum computing offers both unprecedented capabilities and significant threats, making it a double-edged sword that demands careful navigation. Just as white hat hackers can use it to bolster defences, their malicious counterparts might be able to supercharge their efforts, too. 

But how do we grapple with this quantum quandary? That’s exactly what we’ll tackle in this article, as we must collectively ensure they are not blindsided by the risks while leveraging its advantages.

Due to the presence of qubits, quantum systems can perform multiple calculations simultaneously, exponentially increasing computational power for specific tasks. 

For cyber security, we already know this means quantum computers could break widely used encryption methods, particularly those relying on factoring large prime numbers, such as RSA and ECC.

These encryption standards form the backbone of secure online communication, financial transactions, and digital identity verification.

The versatility of quantum computing goes beyond cracking encryption. Its computational power could revolutionise cyber security applications by improving pattern recognition, anomaly detection and optimisation algorithms. Tasks that once took days or months to process could be executed within minutes, drastically reducing response times to potential threats.

Breaking encryption: A looming threat

Classical cryptography, based on mathematical problems too complex for current computers to solve within a practical timeframe, faces obsolescence in the quantum era. Shor’s algorithm, a quantum computing method, can efficiently factorise large integers, undermining RSA encryption’s security. 

Just for comparison, in the context of Shor’s algorithm:

  • A traditional computer might need trillions of years to crack a 2,048-bit RSA key.
  • A quantum computer would need hours, if not days, to perform the same action. 

Similarly, elliptic curve cryptography (ECC), celebrated for its efficiency, is vulnerable to the same algorithm. This vulnerability jeopardises everything from personal data protection to national security. 

Hence, experts fear that hackers equipped with quantum capabilities could decrypt intercepted communications, exposing sensitive corporate or governmental information. And we all know how hard it is for politicians to adapt to modern tech. 

Even data encrypted today could be at risk due to the “harvest now, decrypt later” strategy, where adversaries collect encrypted data now, anticipating quantum decryption in the future. The implications extend to industries like banking, healthcare and energy, where secure communication is paramount.

Strengthening cyber security with quantum technology

It’s not all doom and gloom, as quantum computing offers plenty of tools to counter these threats. Quantum Key Distribution (QKD), for instance, uses quantum mechanics to establish secure communication channels. As a result, any attempt to eavesdrop on quantum-transmitted keys would alter their state, immediately alerting both parties to the intrusion.

In addition to QKD, quantum random number generation (QRNG) is another promising application. Unlike classical methods, which rely on algorithms that could be predicted or replicated, QRNG leverages the inherent unpredictability of quantum processes to create genuinely random sequences. This strengthens cryptographic protocols, making them more resistant to attacks.

Last, but most certainly not least, quantum-enhanced machine learning could also aid in identifying and mitigating cyber threats. If the current applications of ML seem daunting, think of what quantum ML can do by analysing vast datasets more efficiently than classical systems. Quantum algorithms could detect subtle patterns indicative of an attack, enabling earlier intervention.

Post-quantum cryptography: The immediate response

The cyber security industry is not waiting passively for the quantum threat to materialise. Post-quantum cryptography (PQC) aims to develop encryption algorithms resistant to both classical and quantum attacks. 

Standards bodies like the National Institute of Standards and Technology (NIST) are already advancing PQC algorithms, with several candidates already released or in the final stages of evaluation.

Despite the apparent defensive potential, transitioning to PQC involves significant logistical challenges. Organisations must inventory their cryptographic assets, evaluate quantum risks and implement new algorithms across their systems. 

For industries like finance and healthcare, where data sensitivity is paramount, the transition timeline could stretch into years, requiring immediate action to stay ahead of quantum advancements. 

The degree of difficulty gets even higher if legacy systems are being relied upon, as backwards compatibility in a quantum context isn’t something developers of old thought about. 

Likewise, PQC adoption requires extensive testing to ensure compatibility with existing systems and resilience against emerging threats. This, unfortunately, means allocating additional resources to train personnel, upgrade infrastructure and maintain compliance with evolving regulatory requirements.

Mr Hyde: How cyber criminals benefit from quantum computing

We’ve spent a lot of time discussing how quantum computing can aid in defending our data, but white hat hackers and red teams aren’t the only ones interested in these advancements. 

Nation states and cyber crime conglomerates with nine-figure sums to spend will certainly finance the R&D of offensive tools, which can pose problems for everyone from governments to small businesses. 

In particular, sophisticated attacks, such as quantum-enhanced phishing or cracking biometric data, could exploit quantum-powered pattern recognition to unprecedented degrees. These capabilities pose a direct threat to authentication mechanisms, access controls and user trust.

Overnight, staples like QR codes and various forms of MFA will become easily corruptible due to the sheer computing power at the criminals’ disposal. Widely used for payments and authentication, they may require updates or complete overhauls to resist quantum-generated attacks. 

Even the seemingly simple act of scanning a QR code could become a security risk if quantum-powered adversaries exploit flaws in code generation or scanning software.

Regulatory and strategic considerations

Despite claims that quantum computing will become feasible or profitable in several decades, we must still prepare for that inevitable moment. 

Governments and regulatory bodies are beginning to address the quantum challenge. Investments in quantum research and the establishment of frameworks for quantum-safe technologies are gaining momentum. 

For businesses, aligning with these initiatives is critical to ensure compliance and leverage state-of-the-art defences. Will cyber security become more expensive? Inevitably. But at the same time, there will be many more incidents than the 2,200 a day companies experienced in 2024.

Moreover, collaboration between the public and private sectors will play a pivotal role in quantum readiness. Sharing threat intelligence, standardising best practices, and incentivising quantum-safe transitions will strengthen collective security. 

Most importantly, governments must invest in building a robust quantum infrastructure to ensure that technological advantages are not monopolised by adversaries.

But how will we be able to balance between protectionism and benefiting the human race as a whole? We’ll find out sooner or later, that’s for sure.

Preparing for the quantum future

Quantum computing is no longer a distant possibility, but an imminent reality. Organisations of all sizes must adopt a proactive stance, integrating quantum risk assessments into their cyber security strategies. In particular, we must collectively focus on: 

  1. Education and awareness: IT and cyber security teams must receive the right education on quantum concepts and their implications. Building in-house expertise will be critical to navigating the complexities of quantum integration.
  2. Cryptographic inventory: This means mapping current cryptographic use to identify vulnerable assets. It allows organisations to prioritise upgrades where they are most needed.
  3. Adopting PQC: Currently, the best option is to transition to NIST-approved post-quantum algorithms. Early adoption minimises the risk of falling behind competitors or compliance requirements.
  4. Testing quantum services: In addition, it’s up to organisations to pilot technologies like QKD and QRNG to evaluate their practical benefits. Testing in real-world scenarios ensures smooth integration and operational efficiency.

Conclusion

Quantum computing’s dual potential in cyber security – as a tool for both defence and attack – requires a balanced approach. While its threats to traditional encryption are undeniable, its innovations also promise stronger, more resilient defences. 

Organisations that act now to understand and prepare for the quantum era will not only safeguard their assets, but position themselves as leaders in a rapidly evolving technological landscape.

Otherwise, no one’s data will be safe, and we’ll have no way of keeping up with the computing power at the hackers’ disposal.

Source

Posted on by

Cyber incident that closed British Museum was inside job

A disgruntled insider appears to have been behind a security incident at the British Museum, which forced the 270-year-old institution to partially close its doors over the weekend of 25 and 26 January following disruption to core IT systems.

The incident shuttered two of the museum’s ongoing special exhibitions, one on the history of the ancient Silk Road trading network connecting Asia and Europe, and one on the prints of Pablo Picasso, after key systems including the museum’s ticketing platform were disrupted.

“An IT contractor who was dismissed last week trespassed into the museum and shut down several of our systems,” a spokesperson for the museum said. “Police attended and he was arrested at the scene.

“With regret, our temporary exhibitions were closed over the weekend – ticket holders were alerted and refunds offered.”

The British Museum told Computer Weekly that all of its exhibitions and facilities have now reopened.

London’s Metropolitan Police confirmed its officers attended the museum on the evening of Thursday 23 January and arrested an unnamed man in his 50s on suspicion of burglary and criminal damage. The individual has since been released on bail.

Since the cyber incident did not appear to involve any element of cyber criminal hacking or malware, its long-term impact is unlikely to be as significant as similar attacks against other cultural institutions, such as the autumn 2022 Rhysida ransomware attack on the British Library – from which it’s still recovering.

In this instance, the British Museum appears to have experienced minimal impact, with the disruption apparently limited merely to that caused by unscheduled downtime

Nevertheless, it behoves all organisations to pay close attention to the potential for IT disruption arising from insider actions as their impacts can be wide-ranging, and costly.

Indeed, according to IBM’s 2024 Cost of a data breach report, when compared against other cyber attack vectors, attacks by malicious insiders tend to result in higher recovery costs, close to $5m (£4m) on average, although such attacks represented only 7% of the total seen in the report data.

Risk management

It’s also important to factor insider threats into cyber risk planning activities as such incidents can be very difficult to detect. This is because malicious insiders often look like ordinary users and typically do not reveal themselves until the minute they carry out their attack, at which point the damage is done.

This is in contrast to ransomware attacks, for example, in which organisations with appropriate threat-hunting measures and network monitoring in place can sometimes detect the warning signs of an impending incident, and take steps to thwart them.

“Cyber security arrangements must be agile and constantly updated to keep up with the evolving threat landscape,” said SonicWall executive EMEA vice-president Spencer Starkey.

“This requires a proactive and flexible approach to cyber security, which includes regular security assessments, threat intelligence, vulnerability management, and incident response planning,” he said.

“It also requires ongoing training and awareness programmes to ensure that employees are aware of the latest threats and best practices for cyber security,” said Starkey.

“By maintaining agile and up-to-date cyber security arrangements, companies can minimise their risk exposure, detect and respond to threats more effectively, and maintain the trust and confidence of their customers and stakeholders.”

Source

Posted on by

The Data Bill: It’s time to cyber up

In the latest deliberations on the Data Use and Access Bill in the House of Lords, I set out two amendments to offer well overdue updating to the Computer Misuse Act (CMA) of 1990. In preparing for committee stage of the bill I remain incredibly grateful to everyone involved with the CyberUp campaign, their analysis and commentary always so perfectly on point.

I hardly think I need to rehearse the backdrop to the CMA, many people will be well aware of the act and its shortcomings. Curiously, in the intervening thirty-four and a half years, despite seismic changes in our society and technologies – crucially, including the rise of cyber security threats – the act remains unamended.

Having said that though, I’ve tempted myself a little as it is the case that the act was originally drafted to protect telephone exchanges in 1990, when only 0.5% of the population had access to the internet. 

The CMA was the UK’s first computer crime law and came about following an attack on Prestel in the mid-1980s. Anyone under the age of 40 is probably wondering what Prestel was – a forerunner of internet-based online services launched by the Post Office in 1979 – which only serves to make the point.

Significant change

My amendments to the new Data Bill seek to achieve a very clear and materially significant change, to enable cyber security professionals to do what we have asked of them without the legislation tying at least one hand behind their back.

Thirty-four years on, the CMA still governs how we tackle cyber criminals. As it is currently written, the act inadvertently criminalises legitimate cyber security research. This includes a large proportion of vulnerability research and threat intelligence activities which are critical in protecting the UK from increasingly sophisticated cyber attacks. 

Fundamentally, it restricts cyber security researchers from conducting essential work to protect the UK, including critical national infrastructure. While improving data access is a positive move, it is equally crucial to modernise cyber security laws to protect not just the data but also the systems that underpin it.

The wording of my amendments in full is:

Data use: definition of unauthorised access to computer programs or data

In section 17 of the Computer Misuse Act 1990, at the end of subsection (5) insert—

“c) they do not reasonably believe that the person entitled to control access of the kind in question to the program or data would have consented to that access if they had known about the access and the circumstances of it, including the reasons for seeking it, and

(d) they are not empowered by an enactment, by a rule of law, or by order of a court or tribunal to access of the kind in question to the program or data.

Data use: defences to charges under the Computer Misuse Act 1990

(1) The Computer Misuse Act 1990 is amended as follows.

(2) In section 1, after subsection (3) insert—

(4) It is a defence to a charge under subsection (1) to prove that—

(a) the person’s actions were necessary for the detection or prevention of crime, or

(b) the person’s actions were justified as being in the public interest.

(3) In section 3, after subsection (6) insert—

(7) It is a defence to a charge under subsection (1) in relation to an act carried out for the intention in subsection (2)(b) or (c) to prove that—

(a) the person’s actions were necessary for the detection or prevention

of crime, or

(b) the person’s actions were justified as being in the public interest.

As I said in the debate, don’t take my word for it, the National Cyber Security Centre acknowledged the widening gap between the risks facing the UK and its ability to mitigate them in its 2024 annual review, clearly stating that “updating this out-of-date legislation is a crucial step in closing this gap”.

Statutory defence

Introducing a statutory defence would provide legal clarity and protection for ethical cyber security professionals undertaking legitimate vulnerability research and threat intelligence activities. Such a defence would align the UK with best practices internationally, ensuring that we keep pace with nations like the US and EU, which are moving to safeguard ethical cyber security work.

To put some numbers to this, there have been nine million instances of cyber crime against UK businesses and charities since May 2021, according to the Department for Science, Innovation and Technology’s 2024 cyber breaches survey, published April 2024. Half of businesses and 32% of charities suffered a cyber breach or attack last year, with £2.4bn estimated increased revenue potential post-update for the sector.

Analysis based on CyberUp’s recent industry report suggests that 60% of respondents said the CMA is a barrier to their work in threat intelligence and vulnerability research, and 80% believed the UK was at a competitive disadvantage due to the CMA.

Concluding my remarks, I asked whether the minister would be able to provide an update on the work to reform the Computer Misuse Act? I also asked her whether she believed that my amendments as drafted would provide the legal protection that we seek and, if so, why the government would not bring them into force via the means of the Data Bill.

The minister’s answers to both questions were largely the same – we must wait, the amendments are “premature”, there was not consensus among those who responded to last year’s consultation on the matter so the path forward must continue with no timeline or sense of when this most pressing of issues will be resolved.

If the government needs some public support to increase its pace on this project, how about the fact that two-thirds of UK adults are inclined to support a change in the law to allow cyber security professionals to carry out research to prevent cyber attacks?

There is also support for such a statutory change from the excellent report of the then chief scientific advisor, Patrick Vallance, earlier this year which concluded that, “Amending the CMA to include a statutory public interest defence that would provide stronger legal protections for cyber security researchers and professionals”.

Other nations have already led in this area, not least France and the Netherlands. Belgium, Germany and Malta are currently amending their legal frameworks to this end. As I stated in the debate, it’s time to pass these amendments, it’s time to afford our cyber security professionals the safety they need to do the self-same thing for us, all of us. As has been the case for far too long – it’s time to CyberUp.  

Source

Posted on by

Latest attempt to override UK’s outdated hacking law stalls

Two amendments to the Data (Access and Use) Bill that would have established a statutory legal defence for security professionals and ethical hackers to protect them from prosecution under the 1990 Computer Misuse Act (CMA) have failed to make it beyond a House of Lords committee hearing after being withdrawn.

The 34-year-old CMA broadly defines the offence of “unauthorised access to a computer” that is frequently relied upon in the UK when prosecuting cyber criminals, but given it became law when Margaret Thatcher was prime minister, it has not been updated to reflect the emergence, and practices, of the legitimate cyber security profession.

Campaigners say this is putting the UK at a competitive disadvantage because security pros fear they may be prosecuted simply for doing their jobs – for example, by accessing a system during the course of an incident investigation – while their employers lose out to companies located in more permissive jurisdictions.

Introduced by Lord Chris Holmes and Lord Tim Clement-Jones, the changes would have introduced two amendments into the Data Bill to amend the CMA such that security professionals could prove their actions were “necessary for the detection or prevention of crime” or “justified as being in the public interest”.

Speaking in support of the amendment on 18 December 2024, Holmes spoke about how the CMA was introduced to defend telephony exchanges in an era when 0.5% of the population was online, and if that was the act’s sole purpose, that alone would indicate it needs updating given the profound advances in technology made in the past three-and-a-half decades.

“The Computer Misuse Act 1990 is not only out of date but inadvertently criminalising the cyber security professionals we charge with the job of keeping us all safe. They oftentimes work, understandably, under the radar, behind not just closed but locked doors, doing such important work. Yet, for want of these amendments, they are doing that work, all too often, with at least one hand tied behind their back,” said Holmes.

The Computer Misuse Act 1990 is not only out of date but inadvertently criminalising the cyber security professionals we charge with the job of keeping us all safe Lord Chris Holmes

“Let us take just two examples: vulnerability research and threat intelligence assessment and analysis. Both could find that cyber security professional falling foul of the provisions of the CMA 1990. Do not take my word for it: look to the 2024 annual report of the National Cyber Security Centre, which rightly and understandably highlights the increasing gap between the threats we face and its ability, and the ability of the cyber security professionals community, to meet those threats.

“These amendments, in essence, perform one simple but critical task: to afford a legal defence for legitimate cyber security activities,” he said. “That is all, but it would have such a profound impact for those whom we have asked to keep us safe and for the safety they can thus deliver to every citizen in our society.

“It’s not time, it’s well over time that these amendments become part of our law. If not now, then when? If not these amendments, what amendment? And if not these amendments, what will the government say to all those people who will continue to be put in harm’s way for want of these protective provisions?” added Holmes.

Government responds

During the hearing in Westminster, other parliamentarians, including the amendment’s co-sponsor Lord Clement-Jones and Lord James Arbuthnot, better known for his campaigning work in the Post Office Horizon scandal, spoke in favour of reform, but to no avail.

Lord Timothy Kirkhope said: “This just demonstrates, yet again, that unless we pull ourselves together, with better smart legislation that moves faster, we will never ever catch up with developments in technology and AI [artificial intelligence]. This has been demonstrated dramatically by these amendments. I express concerns that the government move at a pace that government always moves at, but in this particular field it is not going to work.”

Responding to the meeting, under-secretary of state at the Department for Science, Innovation and Technology (DSIT) Baroness Margaret Jones said the government agreed the UK needed a revised legislative framework to enable the authorities to tackle the harms posed by cyber criminals, and that it was committed to ensuring the CMA remains up to date and is effective in this regard.

However, said Jones, reform is a “complex and ongoing” issue that is being considered as part of a Home Office review of the CMA itself.

“We are considering improved defences by engaging extensively with the cyber security industry, law enforcement agencies, prosecutors and system owners. However, engagement to date has not produced a consensus on the issue, even within the industry, and that is holding us back at this moment – but we are absolutely determined to move forward with this and to reach a consensus on the way forward,” she said.

“The specific amendments … are premature, because we need a stronger consensus on the way forward, notwithstanding all the good reasons … given for why it is important that we have updated legislation. With these concerns and reasons in mind, I hope that the noble Lord [Holmes] will feel able to withdraw his amendment,” said Jones.

Katharina Sommer, group head of government affairs at cyber firm NCC Group, said she was thrilled to see such passionate calls for reform, and that the session had rightly highlighted the outdated nature of the CMA and how it holds back cyber security professionals.

“We need a statutory defence, like that proposed by Lord Holmes’ welcome amendment, to allow this vital work to proceed unimpeded, at a time where the cyber threat is rising unabatedly. Reforming the CMA would unlock huge opportunities, strengthen our defences, and help the UK compete on the world stage,” she said.

“It is heartening to see the minister recognise the need to provide legal protections for legitimate cyber security activities, and hear about her determination to reach consensus on the way forward, particularly as this follows her colleague the security minister’s recent commitment to reviewing the CMA,” said Sommer.

“We do hope sincerely that all those involved in keeping the UK safe in cyberspace are prepared to work together, and find compromise rather than risk deadlock. We look forward to working with the government and all partners to ensure the UK’s cyber laws reflect 21st century threats.”

Disappointment

Andrew Jones, strategy director at The Cyber Scheme, a supporter of the CyberUp Campaign for legal reform, said: “Whilst we are slightly disappointed by the government’s decision not to seize this opportunity to bring the Computer Misuse Act into the 21st century, we are encouraged by their recent comments suggesting a review of the act is being considered. Until then, the CMA will remain an outdated piece of legislation, preventing our cyber security professionals from defending organisations effectively and leaving us lagging behind peer nations, as the US and EU move to safeguard ethical cyber security work as a cornerstone of national resilience.

“With the CEO of the National Cyber Security Centre recently acknowledging that hostile activity in UK cyberspace has increased in ‘frequency, sophistication and intensity’, it is vital that the UK takes measures to upgrade its cyber resilience. 

He added: “The statutory defence we propose – drafted in consultation with industry and legal experts – would protect legitimate cyber security professionals, strengthen UK cyber defences, and reinforce its place as a cyber security leader. We are fully prepared to work with the government to help implement this necessary change in the future, as soon as it is ready to act.”

Source

Posted on by

LockBit ransomware gang teases February 2025 return

Despite being taken down and humiliated by the National Crime Agency (NCA) coordinated Operation Cronos in February 2024, an unknown individual(s) associated with, or claiming to represent, the LockBit ransomware gang has broken cover to announce the impending release of a new locker malware, LockBit 4.0.

In screengrabs taken from the dark web that have been widely circulated on social media in the past day, the supposed cyber criminal invited interested parties to “sign up and start your pentester billionaire journey in 5 minutes with us”, promising them access to supercars and women. At the time of writing, none of the links in the post direct anywhere, while a countdown timer points to a ‘launch’ date of 3 February 2025.

Robert Fitzsimons, lead threat intelligence engineer at Searchlight Cyber, said it was hard to say at this stage what LockBit 4.0 entailed – whether the gang was launching a new leak site, its old one having been seized, or whether it has made changes to its ransomware.

“It is worth noting that LockBit has already been through many iterations, its current branding is LockBit 3.0. It’s therefore not surprising that LockBit is updating once again and – given the brand damage inflicted by the law enforcement action Operation Cronos earlier this year – there there is clearly a motivation for LockBit to shake things up and re-establish its credentials, keeping in mind that the LockBit 3.0 site was hijacked and defaced by law enforcement,” said Fitzsimons.

“There has been a decrease in LockBit’s victim output since Operation Cronos but this post shows that it is still trying to attract affiliates and continue its operations.”

The gang’s sudden announcement comes just days after it emerged that the United States government is seeking the extradition from Israel of an alleged LockBit operative named as Rotislav Panev to face trial for wire fraud and cyber crime.

Panev was arrested in Haifa in Israel in August – according to Israeli news site Ynet, which was first to report the extradition request, news of his arrest has been restricted up to now in order to avoid tipping off other LockBit associates who may be located outside Russia and giving them a chance to escape to the relative safety afforded them there.

Panev is accused of working as a software developer for LockBit and may have created the mechanism by which the gang was able to print ransom notes on printers connected to the compromised systems. Panev’s lawyer told Ynet that he was a computer technician and was never aware of nor involved in any fraud, extortion or money laundering.

Computer Weekly understands an extradition hearing in this case is scheduled for January 2025.

LockBit down but not out?

Since Operation Cronos unfolded in early 2024, the NCA and other agencies that participated in the takedown have been drip feeding more information about the infamous cyber criminal operation.

In May, the NCA unmasked its leader, LockBitSupp, naming him as Russian national Dmitry Khoroshev and targeting him with asset freezes and travel bans, concurrent with an indictment in the US that has seen him charged with a total of 26 counts of fraud, damage to protected computers and extortion. Khoroshev remains at large despite a multimillion-dollar reward, and LockBitSupp has denied that this is their true identity.

Later in the year, the NCA named-and-shamed a high-profile LockBit affiliate, Aleksandr Ryzhenkov, aka Beverley, who was also a key player in the Evil Corp operation and served as a henchman to its leader Maksim Yakubets.

Despite the apparent success of Operation Cronos, recent history has shown that even when law enforcement operations can be effective at disrupting their activities, cyber criminals are remarkably resilient and often able to stand up their operations again with relative ease.

Although it is not currently possible to ascertain what the person behind LockBit’s announcement is actually planning, defenders should be alert to the possibility of attack in the coming weeks and take appropriate anti-ransomware measures wherever possible.

Source

Posted on by

NCA takes out network that laundered ransomware payments

The UK’s National Crime Agency (NCA) has exposed and disrupted two Russian money laundering networks that handled cash stolen by the Ryuk ransomware gang, among others.

Operation Destabilise took out the Smart and TGR criminal networks, which besides providing services to cyber criminals also played a key role in drugs and firearms trafficking into the UK.

The two networks also helped Russian clients bypass financial restrictions to invest money illegally in the UK, transferred money to support the activities of a sanctioned Russian-language media organisation, alleged to be banned propaganda network Russia Today (RT), and provided financial assistance to fund Russian espionage activities.

The NCA said it had also demonstrated clear links between the cryptocurrency addresses used by Smart and TGR, and sanctioned crypto exchange Garantex, which allegedly has links to payments made for weapons components for Russian troops in Ukraine.

“Operation Destabilise has exposed billion-dollar money laundering networks operating in a way previously unknown to international law enforcement or regulators,” said Rob Jones, NCA director general of operations.

“For the first time, we have been able to map out a link between Russian elites, crypto-rich cyber criminals and drugs gangs on the streets of the UK. The thread that tied them together – the combined force of Smart and TGR – was invisible until now.

For the first time, we have been able to map out a link between Russian elites, crypto-rich cyber criminals and drugs gangs on the streets of the UK. The thread that tied them together – the combined force of Smart and TGR – was invisible until now Rob Jones, NCA

“The NCA and partners have disrupted this criminal service at every level. We have identified and acted against the Russians pulling the strings at the very top, removing the air of legitimacy that enabled them to weave illicit funds into our economy,” he added.

“We also took out the key coordinators that enabled the cash-based element of their operation in the UK, making it extremely difficult for them to operate here and sending a clear message that this is not a safe haven for money laundering,” said Jones.

The NCA also named six key players in the two networks, all of whom have been sanctioned by the United States Office of Foreign Assets Control (OFAC) today: Ekaterina Zhdanova, Khadzi-Murat Magomedov and Nikita Krasnov, who between them led the Smart operation; and George Rossi, Elena Chirkinyan and Andrejs Bradens (aka Andrejs Carenoks), who headed up TGR.

The NCA said that dating back to 2021, Zhdanova played a key role in laundering $2.3m (£1.8m) of crypto-based ransoms paid to the Ryuk ransomware crew. The Ryuk gang – a predecessor to Conti – callously targeted health sector organisations in both the UK and US during the Covid-19 pandemic in 2020.

Members of Ryuk, sanctioned by the UK in 2023, were responsible for extorting over £27m from at least 149 known victims in the UK – the gang’s true impact was likely much higher.

“This is stellar work from the NCA, OFAC and partners, demonstrating the simple truth that paying ransoms contributes to crime on the streets in the UK and other countries,” said Don Smith, vice-president of threat intelligence at the Secureworks Counter Threat Unit.

“Paying ransoms is, and always has been, nothing more than putting funds in the hands of criminals,” he said.

84 arrests

NCA-coordinated activity against Smart and TGR has so far resulted in 84 arrests, with many individuals already behind bars and over £20m in assets seized.

The networks formed the core of a complex scheme that collected money in one jurisdiction and performed a series of crypto-for-cash swaps to make the equivalent value available elsewhere. In this manner, they were able to not only launder money for cyber criminals, but also streamline the movement of money made by other organised crime gangs and help Russian oligarchs and elites bypass sanctions.

This is stellar work from the NCA, OFAC and partners, demonstrating the simple truth that paying ransoms contributes to crime on the streets in the UK and other countries. Paying ransoms is nothing more than putting funds in the hands of criminals Don Smith, Secureworks Counter Threat Unit

The UK unwittingly played a key role as a hub for Smart and TGR, with investigators frequently witnessing in-person, street-level cash handovers, which were followed almost immediately by cryptocurrency movements.

After receiving their crypto funds back, the networks enabled criminals to reinvest in drugs or firearms without needing to move actual money across borders, perpetuating a cycle of violence and harm in Britain.

“The networks disrupted by Operation Destabilise were hidden in plain sight, operating from within our communities, moving vast sums of money linked to the drugs trade and serious violence on our streets,” said Nik Adams, T/assistant commissioner for City of London Police and National Police Chiefs’ Council lead for economic crime.

Cash couriers run by Smart and TCG used over 50 different locations in England, Scotland, Wales and even the Channel Islands over a four-month period, to swap funds for more than 20 distinct criminal groups. One of the couriers, Fawad Saiedi, who is now serving a four-year and four-month prison sentence, personally oversaw the laundry of £15m of funds.

A different group, coordinated by Krasnov, ran couriers to launder over £12m in just two-and-a-half months. Three individuals are currently serving time for these offences in the UK and Ireland.

The NCA also revealed how its investigation did not go unnoticed by the networks, with many members speaking openly about their reservations over operating in London as the agency and its partners slowly turned up the heat.

By summer 2024, a few short months ago, Russian money laundering networks in London were charging extremely high commission rates as it became harder and harder for them to work in the city. This proved costly to both groups, which were operating on extremely low profit margins.

Source

Posted on by

Shared digital gateway was source of three NHS ransomware attacks

Liverpool’s Alder Hey Children’s NHS Foundation Trust has revealed that a shared service operated by itself and Liverpool Heart and Chest Hospital NHS Foundation Trust was the source of an INC Ransom intrusion that has affected patient data at both hospitals, as well as Royal Liverpool University Hospital.

The attack, which came to light on 28 November, has seen data exfiltrated from the Trusts’ IT systems, but is not linked to a separate ransomware attack against Wirral University Hospitals NHS Foundation trust, which unfolded a few days earlier and has been linked to the RansomHub crew.

In an update shared on 4 December, Alder Hey said: “Criminals gained unlawful access to data through a digital gateway service shared by Alder Hey and Liverpool Heart and Chest Hospital.

“This has resulted in the attacker unlawfully getting access to systems containing data from Alder Hey Children’s NHS Foundation Trust, Liverpool Heart and Chest Hospital, and a small amount of data from Royal Liverpool University Hospital.

The Trust said its investigation into exactly what data has been stolen is ongoing, and this may take some time. It warned that there was a possibility that the ransomware gang may publish the data before its investigation is complete, an indication that it is standing firm and resisting demands, as is public sector policy in the UK.

“As soon as we are able to update on the impact to people’s data, we will provide a further update. Work is continuing with the National Crime Agency to secure impacted systems and to take further steps in line with law enforcement advice. We are also following guidance from the Information Commissioner’s Office and will ensure that anyone impacted by this data breach is contacted directly and supported,” Alder Hey said.

It emphasised that its core frontline services remain unaffected and are running as usual – patients should still attend appointments as scheduled.

The Trust’s added that its recovery efforts were making strong headway, saying: “As part of our response to this threat we have made progress in securing impacted systems and ensuring the attackers do not have continued access. This means that we are in a position to begin to reconnect our systems when it is safe to do so.”

Was Citrix Bleed involved?

Alder Hey’s assertion that a digital gateway service served as the entry point for INC Ransom’s operators appears to confirm earlier reports – per Infosecurity – that the gang attacked a Citrix instance operated by the Trust.

If this was the case, the gang likely used a critical vulnerability in Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway appliances, tracked as CVE-2023-4966, but more commonly known as Citrix Bleed.

Discovered towards the end of 2023, Citrix Bleed enables both session hijacking and data disclosure. It is one of the most widely exploited zero-days of the past 12 months and has been widely used in ransomware attacks – notably a number of high-profile incidents involving the LockBit gang. According to Secureworks’ intelligence, INC Ransom has also targeted it with great enthusiasm.

Rafe Pilling, director of threat intelligence at the Secureworks Counter Threat Unit, said: “Criminal gangs are opportunistic in the hunt for the next pay-out, the impact of their actions is not their concern. The fact that this is a highly specialist children’s hospital will not cause them to lose any sleep. We have previously seen Gold Ionic – the group that operates INC ransomware – hit NHS Dumfries and Galloway. These attacks on front line healthcare underline that this sector, is a vulnerable target and must be protected.

“INC ransom was one of the most active threat groups the Secureworks CTU observed over the past year, having started operating in July 2023. Its victims are predominantly based in the US, however it’s global reach is growing. Its victims represent a wide range of sectors, but the most common are industrial, healthcare and education organisations.”

Source