Andrea Zanni’s Post

Iranian hackers are going after critical infrastructure sector passwords, agencies caution: An international advisory says that the purpose of the “brute force” attacks is to sell the info to cybercrime forums. The post Iranian hackers are going after critical infrastructure sector passwords, agencies caution appeared first on CyberScoop.

The US authorities have disrupted the operations of the hacktivist group "Anonymous Sudan". The group has been linked to major DDoS attacks worldwide, including a significant attack on Microsoft in 2023. Two Sudanese nationals have been indicted on charges of conspiracy to damage computers. Additionally, the FBI seized a DDoS tools used by the group to conduct attacks against various organisations. The group is also alleged to have sold this DDoS tool to other threat actors. Since 2023, Anonymous Sudan and its customers have launched over 35,000 attacks globally. The victims of these attacks include numerous government agencies, hospitals, network service providers, and technology platforms. Read more here: https://lnkd.in/erXrM5DF #Cybersecurity #DDoS #NetworkSecurity #Hacktivist #ITSecurity #DDoSNews

✈️ Seattle Airport confirms that ransomware caused major disruptions in August ⚠️ While systems have been restored, some sensitive data was stolen and could be leaked 💻. ⭐ Actionable Insights and Tips 🔐 Implement data encryption to protect sensitive assets from being exfiltrated during attacks. 🛡️ Deploy deep packet inspection to detect malicious data transfers during ransomware incidents. 🔍 Utilize secure DNS services to block known malicious domains from accessing critical systems. At SSL.com, Trust is What We Do 🔒 #RansomwareResponse #DataProtection #CyberResilience Read more from link in comments ⬇️

FBI Tells Telecom Firms to Boost Security Following Wide-Ranging Chinese Hacking Campaign: Guidance issued by the FBI and CISA is intended to help root out the hackers and prevent similar cyberespionage. The post FBI Tells Telecom Firms to Boost Security Following Wide-Ranging Chinese Hacking Campaign appeared first on SecurityWeek.

Since October 2023, Iranian actors have been utilizing various tactics, including password spraying and 'push bombing' multifactor authentication, to compromise user accounts and gain access to organizations. These actors often manipulate MFA registrations to maintain persistent access and conduct network reconnaissance to obtain additional credentials. The authoring agencies have identified that these Iranian actors sell the obtained information on cyber criminal forums, potentially leading to further malicious activities. Stay informed by reading more about this from CISA: [Link to report](https://lnkd.in/enzcUpsm).

FBI warns critical Infrastructure of ‘push bombing’ and password attacks The FBI, NSA, and other global authorities are warning vital infrastructure organizations about the rise of password spraying and MFA fatigue (push bombing) attacks. Hackers use common passwords to access accounts, then repeatedly send MFA requests until a user mistakenly approves one, granting access. Once in, attackers register their own devices for persistent control. Targeted services include Microsoft 365, Azure, and Citrix, with lateral movement via Remote Desktop Protocol (RDP) also reported. Authorities advise strict monitoring, MFA security, and disabling unused accounts to counter these threats. How to fight against MFA fatique (push bombing) and password spraying: https://idcontrol.pw (free for private use) #MFA #bruteforce #MFAfatique #push #attack #FBI #criticalinfrastructure

Today's Critical #ISMGNews Updates 📰 ➡ Chinese Hacking Contractor iSoon Leaks Internal Documents An apparent leak of internal documents from a Chinese hacking contractor paints a picture of a disaffected, poorly paid workforce that nonetheless penetrated multiple regional governments and possibly NATO. Multiple experts told Information Security Media Group the documents appear to be legitimate. ➡ 1Password Acquires Kolide, Aiming to Enhance Device Security Jeff Shiner, CEO of the popular password management company 1Password, said Monday that the company is acquiring leading device security platform Kolide in response to the "historic transformation of the workplace that demands transformative and intuitive new security solutions." ➡ Arrests and Indictments in LockBit Crackdown An international law enforcement operation that infiltrated ransomware-as-a-service operation LockBit has resulted in arrests, indictments and the seizure of encryption keys that can be used to help victims recover their data. LockBit emerged in 2019 and was one of the largest ransomware operations. ➡ Broken LockBit: #Ransomware Group Takedown Will Have Impact Blue Monday arrived late this year for the LockBit ransomware-as-a-service group, after an international coalition of law enforcement agencies seized swaths of its infrastructure. Security experts said even if the down-at-the-heels group reboots, the disruption already stands as a big win. Akshaya Asokan Chris Riotta Mathew Schwartz #Cybersecurity

A recent breach of U.S. telecommunications companies has been described recently as the “worst telecom hack in our nation’s history – by far,” by the chairman of the Senate Intelligence Committee, Senator Mark Warner. This alarming statement comes in the wake of a massive cyber espionage campaign allegedly linked to China, which has compromised multiple telecommunications networks across the United States. The breach, first reported earlier this month, involved China-linked hackers intercepting sensitive surveillance data intended for American law enforcement agencies. According to a joint statement by the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) on November 13, the hackers infiltrated networks of several telecom companies, stealing U.S. customer call records and communications from individuals primarily involved in government or political activities. Stay connected to Aashay Gupta, CISM, GCP for content related to Cybersecurity. #LinkedIn #Cybersecurity #Cloudsecurity #AWS #GoogleCloud #Trends #informationprotection #Cyberthreats #CEH #ethicalhacker #hacking #cloudsecurity #productmanagement #cybersecurity #appsec #devsecops

Here's an outstanding article covering Iranian cyber attackers' TTPs and remediations to mitigate their unauthorized access to critical infrastructure. https://lnkd.in/g_SU_fEa