SHARDS Cybersecurity

#MSIgnite Day 1 has officially kicked off and we're looking forward to discussions on how to build a safer world together. Explore our many security sessions and demos, covering topics from proactive security to trustworthy AI: https://msft.it/6045WskNt

The third quarter of 2024 saw the emergence of the Lynx ransomware as a service (RaaS) operation. Multiple affiliates, tracked as Storm-2113, were observed deploying the new ransomware variant, named for the .LYNX extension it adds to encrypted files, in attacks targeting manufacturing, energy, and commercial facilities sector in the US. Storm-2113 campaigns gain initial access via exploits and employ a range of tools, including RMM and credential dumping tools, before moving laterally, exfiltrating data, and deploying the ransomware payload. In this period, however, RansomHub still stood out as one of the most prevalent payloads used by some of the most active ransomware operators. Octo Tempest, who in the last quarter added RansomHub to its toolkit, has continued to use the RaaS payload. Other financially motivated threat actors that use RansomHub include Manatee Tempest and Storm-1874. In September, Vanilla Tempest was observed deploying the INC ransomware in an attack against the US healthcare sector. In this attack, Vanilla Tempest leveraged Gootloader infections (Storm-0494) to deploy malicious tools, including the Supper backdoor, then moved laterally across the network before deploying the INC ransomware. Ransomware threat actors shift ransomware payloads to increase attack effectiveness or to adapt to changes in RaaS operators. They also continue to find new ways to persist and inflict broader damage. For instance, we’re seeing more actors targeting hybrid cloud environments, moving from on-premises to cloud. Threat actors Octo Tempest, Manatee Tempest, and more recently Storm-0501 have been employing this technique, leveraging compromised identities. Expanding to hybrid cloud environments provides threat actors more control on compromised environments, enabling them to more effectively maintain backdoor access, exfiltrate data, and deploy ransomware. Ransomware threat actors use a combination of established and novel tools and techniques for their attacks. In early October, access broker Storm-1674 was observed continuing to conduct voice phishing (vishing) campaigns via Microsoft Teams, posing as help desk or IT support staff. If successful, this social engineering activity leads to malicious payloads associated with ransomware actors like Storm-0506 and Sangria Tempest. This is the first time since May that Microsoft observed new Storm-0506 intrusions, indicating that the threat actor may have resumed their Black Basta operations. To better protect against persistently evolving ransomware attacks, users and organizations are advised to build credential hygiene, apply principle of least privilege, and employ Zero Trust. For more info and guidance, visit https://msft.it/6049WHpPh Get more trends in the ransomware landscape in the Microsoft Digital Defense Report 2024: https://msft.it/6040WHpu6 Learn why healthcare is uniquely susceptible to ransomware attacks and how organizations can stay resilient: https://msft.it/6041WHpuB

Don’t miss #MSIgnite online to learn how to secure your future with an AI-first, end-to-end cybersecurity. Register today to: ✅ Be among the first to hear top news ✅ Benefit from insights designed for your role ✅ Attend sessions tailored to addressing your top challenges Learn more and register today: https://msft.it/6044WP3g4 #AI

The financially motivated cybercriminal group that Microsoft tracks as Storm-0501 has been observed exfiltrating data and deploying Embargo ransomware after moving laterally from on-premises to the cloud environment. The said attacks also involve credential theft, tampering, and persistent backdoor access. Storm-0501 exploited known vulnerabilities to gain initial access and used various open-source and commodity tools to steal credentials and move laterally within the network. The threat actor leveraged their level of access to exfiltrate sensitive data, evade detection, and gain control of the cloud environment. The actor subsequently created a backdoor to the cloud environment to maintain persistent access, and deployed Embargo ransomware on the on-premises environment to extort their target. In this blog post, we share our findings on the recent attack conducted by Storm-0501 and provide recommendations and mitigations to help customers protect themselves from this threat and similar ransomware attacks. https://msft.it/6041m5gPx

Microsoft identified a North Korean threat actor exploiting a zero-day vulnerability in Chromium (CVE-2024-7971) to gain remote code execution (RCE) in the Chromium renderer process. Our assessment of ongoing analysis and observed infrastructure attributes this activity to Citrine Sleet, a North Korean threat actor that commonly targets the cryptocurrency sector for financial gain. Google released a fix for the vulnerability, and users should ensure they are using the latest version of Chromium. We thank the Chromium team for their collaboration in addressing this issue. Read our blog to get more information about Citrine Sleet and the observed tactics, techniques, and procedures (TTPs) used to exploit CVE-2024-7971, as well as recommendations for mitigating and protecting against this activity. https://msft.it/6043l7qAH

Phishing makes up more than 8 in 10 cyber attacks against UK small businesses. Check your cyber security with the UK Government’s free and quick tool that instantly spots IT vulnerabilities in your systems. Strengthen your organisation’s cyber security in just a few clicks. Check your cyber security now⬇️

Maximize analyst productivity with our unified security operations platform, delivering: ✔️ A simple, approachable interface ✔️ More context at every stage ✔️ Faster response to threats Learn more: https://msft.it/6040lcB7m #SecOps

Microsoft’s Security Service Edge (SSE) solution is now generally available. Get a closer look at how Microsoft’s SSE solution helps your organization eliminate security loopholes, improve end user experience at a global scale, and activate side-by-side, flexible deployment options with other SSE solutions: https://msft.it/6044lkfkQ #ZeroTrust #MicrosoftEntra

Excellent work from the National Crime Agency (NCA). Keep it up 👍

🛡️ Cyber-savvy employees are your best defense! Regular cybersecurity training helps your team recognize threats and respond appropriately. Microsoft 365 Business Premium includes tools for user awareness training and simulated phishing attacks to keep your employees alert and prepared. Empower your employees to be the first line of defense against cyber attacks. #EmployeeTraining #CyberSecurity #SMBSafety #M365BP #ShardsCybersecurity