Malware Trends 2 - CodeHunter

The Rising Threat of Algorithmic Trading Exploits

October 7, 2024/in Malware Trends, finance, Cybersecurity/by Website Administrator

The financial services industry is increasingly reliant on algorithmic and high-frequency trading (HFT), which has revolutionized the speed and efficiency of trades. However, this technological advancement comes with heightened cybersecurity risks. As cybercriminals evolve their tactics, CISOs are becoming more concerned about the potential for attacks targeting these advanced trading systems. The threat posed by such cyberattacks is no longer theoretical; it is a growing reality that could have severe consequences for markets worldwide.

Defending the Energy Industry from Nation-State Cyberattacks

September 25, 2024/in Cybersecurity, Malware Trends/by Website Administrator

The energy industry has become a prime target for cyberattacks, particularly from nation-state actors. These attacks, driven by geopolitical motives, espionage, and the desire to disrupt economies or gain competitive advantage, pose a critical threat to the global energy infrastructure. Energy companies, from oil refineries to nuclear power plants, form the backbone of nations’ economies, and a breach in their cybersecurity could lead to catastrophic outcomes such as power outages, environmental disasters, or the manipulation of energy prices.

Proactive Protection Against Custom Malware

August 21, 2024/in Threat Hunting, Malware Trends, Malware/by Website Administrator

In the realm of cybersecurity, custom malware has become a formidable threat to organizations of all sizes. Unlike generic malware, which is designed for mass deployment and targets a wide range of victims, custom malware is meticulously crafted to infiltrate specific organizations. This personalized approach makes it incredibly effective at bypassing traditional security measures, posing significant risks to targeted businesses.

Double Extortion: The Latest Malicious Money Grab

July 10, 2024/in Cybersecurity, Malware Trends, Best Practices/by Website Administrator

In recent years, cybersecurity threats have evolved dramatically, with ransomware attacks becoming increasingly sophisticated and damaging. Among the latest trends in this digital arms race is the tactic known as double extortion. This method goes beyond encrypting a victim’s data by also threatening to expose it publicly unless a ransom is paid. Affected organizations thereby suffer double the pressure to comply with the demands.

Proactive Prevention: How to Defend Against Zero-Day Attacks

May 22, 2024/in Malware Trends, Threat Hunting, Cybersecurity, Malware/by Website Administrator

The Anatomy of Zero-Day Malware

Zero-day malware is called such because it takes advantage of zero-day vulnerabilities, which are newly discovered flaws that have yet to be patched. The time when the vulnerability is discovered is referred to as “Day 0”. These vulnerabilities provide cyber attackers with a window of opportunity to launch their attacks, often catching victims- and their security systems- off guard. In the time that it takes for a patch to be deployed across an entire enterprise malware can already be siphoning critical information from your system.

Automated Defense Protects Against Software Supply Chain Attacks

April 10, 2024/in Threat Hunting, Cybersecurity, Malware, Malware Trends/by Website Administrator

Strengthening Defense-in-Depth With Automated Malware Detection & Analysis

April 4, 2024/in Threat Hunting, Cybersecurity, Malware, Malware Trends/by Website Administrator

Defense-in-Depth in Today’s Cyberthreat Landscape

The probability of falling victim to an advanced malware attack, including zero-day exploits, multi-part malware, and custom attacks continues to rise. Cybercriminals persist, finding new ways to find their way into “secured” corporate networks, and tools like malware-as-a-service have made it easy to launch sophisticated attacks for even the most novice of threat artists. For organizations to stay ahead of a breach, a multi-layered cybersecurity practice that combines a robust defense-in-depth strategy with cutting-edge technologies like automated threat detection and reverse engineering malware analysis is critical. Read more

Malware-as-a-Service: A Top Threat to Organizations in 2024

April 4, 2024/in Threat Hunting, Cybersecurity, Malware, Malware Trends/by Website Administrator

What is Malware-as-a-Service?

Malware-as-a-service (MaaS) poses a serious threat to enterprise organizations. MaaS functions much like any other software-as-a-service you may be familiar with, and in some cases even comes with technical support. Hackers develop complex malware systems that can be easily purchased by even the most novice of cybercriminals, who can then launch sophisticated attacks against individuals and businesses. Malware-as-a-service democratizes cybercrime, providing any run-of-the-mill criminal with the expertise of an experienced hacker, drastically increasing the average strength and sophistication of a malware attack. Read more

The Revolutionary Impact of Zero-Day Malware Identification on the Industry: The Urgency of Addressing Malware Threats

October 19, 2023/in Malware, Malware Trends, Threat Hunting/by Website Administrator

Formjacking Exposes Mortgage Lenders to Cyber Threats

June 7, 2023/in finance, Malware, Malware Trends/by Website Administrator

Formjacking is malicious JavaScript code that steals digital information through online forms — and it’s wreaking havoc on mortgage lenders. Malicious software lurks in the background of compromised online forms waiting to steal credit card information, social security numbers, passwords, and other PII while innocent hopefuls sign up for an account or apply for a home loan.

Cybercriminals use formjacking to take advantage of trusting home buyers operating under the illusion of digital safety. Most prospective clients assume bankers and lenders place everyone’s information under a tight watch, trusting the mortgage lenders implicitly as they fill out web forms. They rarely stop to consider who else might be accessing them.

How Does Formjacking Work?

The method is simple and eerily effective: A cybercriminal slips malicious JavaScript code into a website’s back or front end, which sends copies of users’ input to them instantly. If their code seeps into the front end, malicious actors can add extra input fields to any form. They can request sensitive information like a social security number or bank account credentials. And, if they’re particularly hungry, they can track mouse clicks and IP addresses.

If that sounds bad, it only gets worse. It’s far too easy for these formjackers to go undetected for months or even years. They can set the script to activate at certain times of day to avoid a cybersecurity team’s working hours or split it into multiple files to make detection that much harder.

Mortgage Lenders: A Tempting Target

Mortgage lenders are a tempting target for their size, ubiquity, and access to sensitive information. What better way to demonstrate what formjacking can do than with the hackers who infiltrated hundreds of real estate websites with a single video?

Brightcove provides video streaming services to many well-known clients, including Sotheby’s International Realty. In January 2021, an attacker injected JavaScript codes into a video used in over 100 real estate websites run by Sotheby’s — which means that every time a user opened an infected page, the software would import the video. Then, the malicious code would become embedded in the website.

Sotheby’s was only recently able to end the attack campaign, meaning that for a year, their attacker hoarded clients’ names, email addresses, phone numbers, and credit card data.

The danger is not limited to clients either. Though news reports tend to highlight the damage to consumers, formjacking can just as easily steal internal information through company portals. If a cybercriminal managed to embed their code into an employee training video purchased from a mass retailer, for example, they wouldn’t need to wait long before taking a snapshot of an employee’s login credentials.

Formjacking is a growing trend — and it’s not going away anytime soon. Though it would be nice to believe that Brightcove’s breach was an anomaly, 4,800 websites are compromised with formjacking every month. Attackers especially enjoy targeting third-party tools because the average eCommerce website uses 40-60 of them, with the majority (68%) of those tools accessing form and input fields. Given the prevalence of these tools in modern business, anyone can be an easy target.

Protect Your Organization From Formjacking

Safeguarding your business from formjacking is becoming increasingly important, and there are steps you can take to minimize risk:

Website admins should manage permissions with a zero-trust mentality: In other words, trust nobody — and limit access to those who need it to do their job.
Most data breaches are a result of human error. Educate your staff about cybersecurity best practices.
Require two-factor authentication (2FA) to verify form submissions on your website. While 2FA doesn’t stop formjacking itself, it can minimize damage by preventing an attacker from taking over a person’s accounts. The malicious actor must simultaneously compromise both devices customers use for authorization (not an easy feat). Attackers tend to look for easier prey.
Detect unwanted changes to your environment with file integrity monitoring (FIM). You’ll be alerted to any changes made to files you’ve set it to monitor.
Run penetration tests and vulnerability scans. No matter how confident you feel about your security, make it a habit to look for weaknesses and consider new ways to strengthen your cybersecurity framework.
Run quality assurance tests on new updates. Make sure things are operating as you intend before launching something new, from back-end functionality to UI interactions.

It’s time to level up your security and stay multiple steps ahead of cybercriminals — it’s your job to protect your customers’ assets, and your own! Update your cybersecurity framework and audit your organization with meticulous detail because what you don’t know will hurt you.

The Nauseating Truth About FIN12 for Hospital CISOs

June 7, 2023/in Malware Trends, healthcare/by Website Administrator

FIN12’s Ruthless Tactics Put Lives at Risk

FIN12 is an aggressive, ransomware-focused cybercrime group that specializes in targeted attacks on the healthcare sector. While many cybercrime groups will avoid hospitals, nursing homes, and 911 services — FIN12 has no reluctance.

Since 2018, FIN12 has actively targeted a range of businesses — making the group one of the most notorious big game hunters in cybercrime. Nearly 20% of their victims are in healthcare; 85% are in North America; and all boast revenues of at least $300 million. With no sign of remorse or morals, FIN12 stands in stark contrast to other cybercriminals: DoppelPaymer and Maze claim that they provide free decryption keys if they accidentally target a vulnerable group. FIN12 deliberately seeks them out.

A New Challenge For Hospital CISOs

No sector is safe from this group’s reach (they have also attacked government websites, schools, universities, and local municipalities), but their ruthless tactics pose a huge threat to healthcare. CISOs have to strategize for FIN12’s attacks — especially if long-distance treatments like telesurgery become more prominent, which will raise the stakes astronomically.

FIN12’s Brutal Methods

FIN12’s single-minded focus on ransomware deployment sets them apart. Their methods are ruthless — and brutally quick. By developing close partnerships with other threat actors who have already gained access to a victim’s network, FIN12 can creep in undetected and quickly deploy debilitating ransomware. Then, when access is securely locked down, they request a single large payout in Bitcoin. Their time-to-ransom (TTR) is incredibly short — the attack and payout all occur in 2 to 3 days.

To make their attacks more complex, FIN12 often overlaps toolsets and services to include backdoors, droppers, and codesigning certificates. The rise of remote work and relaxed home cybersecurity has made it easier for them to access remote logins — paving the way for their attacks.

A Reason to Pay Ransom

FIN12 is in it for the money — not for the data. Since they solely encrypt or block access to data instead of exfiltrating it, there’s an incentive for hospitals to pay up, get systems running, and save lives. Without the threat of corrupted data or exposed personal identifiable information (PII), their victims have reason to believe that they won’t be extorted or left behind without restored access. Additionally, FIN12 has a reputation for taking payment and moving on — another reason used to justify random payments.

A Stronger Defense

Along with updating security processes, procedures, and systems — the no-brainer basics — educating healthcare personnel on cyber security best practices helps prevent attackers like FIN12 from gaining a foothold. In most cases, mismanaged credentials and privileges lead to a breach: Many successful attacks began with a mere phishing email.

Enacting safety standards such as prohibiting personal use of company devices, using multi-factor or adaptive authentication, and keeping OS and antivirus software up to date can go a long way in preventing threats from getting in.