CyberSecOp Chronicles: Insights from CrowdStrike's 2024 Global Threat Report

CyberSecOp Chronicles presents a comprehensive overview of key insights extracted from CrowdStrike's 2024 Global Threat Report. In this report, we delve into six critical trends identified by CrowdStrike, including the persistence of identity-based attacks, the surge in cloud-environment intrusions, and the exploitation of third-party relationships by threat actors. With the addition of 34 new threat actors in 2023, the threat landscape continues to evolve rapidly, necessitating proactive cybersecurity measures. CyberSecOp, leveraging its expertise, has been aiding clients in ransomware remediation and payment processes from the outset. Accelerated network compromises and periphery network targeting further underscore the urgency for robust cybersecurity strategies. Our recommendations aim to equip organizations with actionable insights to fortify their defenses and mitigate emerging cyber threats effectively. Stay informed and secure with CyberSecOp Chronicles.

Highlights from CrowdStrike’s 2024 report

1. Identity-based and social engineering attacks still take center stage.

2. Cloud-environment intrusions increased by 75%.

3. Third-party relationships exploitation make it easier for attackers to hit hundreds of targets.

4. CrowdStrike added 34 new threat actors in 2023.

5. Attackers are compromising networks at a faster rate.

6. Attackers are targeting periphery networks.

 CyberSecOp Chronicles presents a comprehensive breakdown of the key insights unveiled in CrowdStrike's 2024 Global Threat Report. This report sheds light on the evolving landscape of cyber threats, providing crucial information for enterprises to fortify their security posture.

 Identity-Based Attacks Remain Pervasive

Despite advancements in cybersecurity measures, identity-based attacks remain a prominent threat. Threat actors continue to favor phishing, social engineering, and credential theft tactics. CrowdStrike's report highlights the persistence of attacks like phishing campaigns orchestrated by threat actors such as FANCY BEAR and SCATTERED SPIDER, emphasizing the need for robust security awareness training and multi-factor authentication (MFA) protocols.

Cloud Security Under Siege

The shift to cloud-based infrastructure has not gone unnoticed by cybercriminals. Cloud-environment intrusions saw a staggering 75% increase from 2022 to 2023, with attackers exploiting vulnerabilities for financial gain. Cloud-conscious attacks, where threat actors specifically target cloud environments, have surged by 110%, posing significant challenges for organizations worldwide. CyberSecOp emphasizes the importance of implementing cloud-native security solutions and educating teams on cloud security best practices.

Exploiting Third-Party Relationships

Supply chain attacks have emerged as a favored tactic among threat actors, offering a gateway to compromise multiple targets efficiently. CrowdStrike's findings underscore the prevalence of third-party exploitation, enabling attackers to infiltrate organizations across various sectors. CyberSecOp advocates for heightened vigilance when engaging with third-party vendors and emphasizes the importance of robust vendor risk management frameworks.

Growing Threat Actor Landscape

CrowdStrike's continuous monitoring identified 34 new threat actors in 2023, further expanding the diverse landscape of cyber threats. This influx underscores the dynamic nature of cybersecurity challenges and the need for adaptive security strategies. CyberSecOp, leveraging its expertise, has been assisting clients from the outset with ransomware remediation and ransomware payment, ensuring swift and effective response to such threats.

Accelerated Network Compromises

Attackers are increasingly adept at infiltrating networks and swiftly escalating their activities. The average breakout time for intrusion activities has decreased, with attackers leveraging stolen credentials and trusted relationships to expedite their malicious objectives. CyberSecOp stresses the importance of comprehensive endpoint detection and response (EDR) solutions to detect and mitigate intrusions effectively.

Focus on Periphery Networks

Threat actors are capitalizing on vulnerabilities in network peripheries, targeting devices and systems that may not be adequately monitored. This includes exploiting End of Life products and unmanaged devices, presenting significant challenges for defenders. CyberSecOp emphasizes the criticality of securing all network endpoints and implementing robust patch management practices to mitigate risks effectively.

Recommendations for Mitigating Cybersecurity Risks

In response to the evolving threat landscape outlined in CrowdStrike's report, CyberSecOp provides actionable recommendations for enhancing cybersecurity resilience:

• Implement phishing-resistant MFA and extend it to legacy protocols.

• Conduct comprehensive user awareness programs to combat social engineering tactics.

• Deploy integrated security solutions capable of correlating threats across identity, endpoint, and cloud environments.

• Prioritize the adoption of Cloud Native Application Protection Platforms for comprehensive cloud security.

• Utilize consolidated security platforms offering complete visibility and threat detection capabilities.

By implementing these proactive measures, organizations can bolster their defenses against emerging cyber threats and safeguard their digital assets effectively.

CyberSecOp Chronicles News delivers timely insights and actionable strategies to navigate the complex cybersecurity landscape. Stay informed, stay secure.

Understanding the UnitedHealth Data Breach: Lessons Learned and Cybersecurity Imperatives

In recent months, the healthcare industry has been rocked by a significant number of cybersecurity breaches, the most prolific of which was at UnitedHealth Group. This breach sheds light on the critical importance of robust cybersecurity measures in safeguarding sensitive patient data and ensuring the continuity of essential services. 

Below we delve into the details of this breach and explore its broader implications for cybersecurity in the healthcare industry as a whole.

The breach at UnitedHealth's tech unit on February 12th was orchestrated by hackers who gained remote access to the network using stolen login credentials. This breach, attributed to the cybercriminal gang AlphV, aka BlackCat, underscored the vulnerabilities inherent in relying solely on passwords for authentication, particularly the absence of multi-factor authentication (MFA). The compromised Change Healthcare Citrix portal, lacking MFA, provided an open gateway for cybercriminals to infiltrate and encrypt the systems, leading to a ransom demand to restore access.

The aftermath of the breach highlighted the significant disruption to American healthcare. Change Healthcare was locked out of the essential systems impacting medical claims processing across the country. UnitedHealth Group has been diligently working with law enforcement agencies and cybersecurity firms, including Google, Microsoft, Cisco, and Amazon, to investigate the breach and secure affected systems.

However, the ransom payment made by UnitedHealth Group underscores the complex ethical and practical considerations surrounding ransomware attacks. While paying the ransom may, or may not truly ensure the decryption of systems and the restoration of services, it also incentivizes cybercriminals to continue their nefarious activities.

In response to the breach, UnitedHealth Group has taken proactive measures to support affected healthcare providers, providing over $6.5 billion in accelerated payments and no-interest, no-fee loans to mitigate the financial impact.

This breach serves as a stark reminder of the urgent need for healthcare organizations to prioritize cybersecurity and implement robust defenses against evolving cyber threats. CyberSecOp continues to provide award winning services, standing ready to assist organizations in mitigating risks, conducting comprehensive risk assessments, and implementing tailored cybersecurity strategies to safeguard sensitive data and ensure the integrity of critical systems.

As the healthcare industry grapples with the fallout of this breach, it is imperative for organizations to learn from these events and strengthen their cybersecurity posture to protect patient privacy and maintain the trust of stakeholders.

Together, we can work towards building a more resilient and secure healthcare ecosystem where patient data remains protected and essential services remain uninterrupted.

Healthcare is a Top 3 Cyber Target

 Attacks on the healthcare industry are on the rise as noted in a recent article published in CYBERSECOP.  Healthcare providers of all sizes are subject to attack and in this case, CHRISTUS Health learned of “unauthorized access” likely similar to 254 ransomware incidents targeting patient care facilities between June 2020 and April 2022 worldwide.  Patients are at risk, both their health and their PII where threat actors can alter and/or add to patient billings with no notice of impropriety.  The true impact will be hard to discern until more time and data are collected but we know one thing for sure, the healthcare industry needs to take cybersecurity as seriously as they do patient care and follow their own advice; Plan, Prevent, Protect and Respond.

Plan – Get a Risk Assessment to identify and understand your cybersecurity vulnerabilities is one of the most critical steps as the awareness will lead to a prioritized remediation plan.  Even a chink in the armor will have your patients, employees, and community concerned as a cyber-attack will likely affect critical operations because the prize is financial data, patient, and employee Personally Identifiable Information (PII).

Prevent - After an assessment is completed, you need a trusted and reliable security cyber organization to assist in leveraging the right framework and controls to be measured by such as HITURST, HITECH, HIPAA and PCI.  These guidelines assist in defining the appropriate critical security controls for effective cyber defense.  These efforts can be awareness training, policy creation & enforcement, and security controls as well as incident response readiness and governance.  It’s a journey, not a sprint.

Protect – Within most remediation plans include investments in endpoint protection dark web monitoring and focusing on digital trust goals to ensure the technology investments already made as well as those in the future work in harmony.  Like a Rubik’s cube, the goal is to have every facet of your organization in order, not just celebrating a single win.  It is important to have a managed security partner to protect your patients, employees, devices, and data with monitored protection systems along with managed & encrypted backups with a Security Operations Center staffed with certified security professionals watching and engaging on your behalf 24x7x365.

Respond – Did you know that a threat actor will live in your ecosystem for an average of 121 days mining sensitive data, passwords, organization charts, and behaviors before acting?  Nearly 95% of ransomware attacks are preventable so what starts as a threat becomes a technology issue, then a business risk issue, and eventually decision-making and communications issue at the board level.  Do you pay the ransomware or not?  Are we able to recover our data?  Has the threat actor accessed our PII?  And equally important is how do you keep from reaching this point again.  Having an incident response assessment and plan might be the one thing you do if you don’t buy into everything else.  You should receive an IT assessment of “how capable are we to thwart an attack?” and “how able are we to recover if breached?”  Buying cyber insurance is not the silver bullet it used to be so having an incident partner who is proactively focused on your company’s sensitive data and reputation is paramount.

Not unlike a hospital, there are two main ways to address cyber security by coming through the Emergency Room or the front door proactively for testing; I recommend the latter.  A proactive health check is the best step to understanding your ability to fight off an attack like a stress test.  The results may drive adjustments in behavior and readiness, such as point endpoint detection, policy creation & enforcement, and security training.  If you enter the ER, then don’t panic because you read this blog and signed up a reputable security partner to react & respond, including quarantining affected systems to prevent the ransom spread, resetting all passwords, checking your backups, activating your existing crisis/DR plans and negotiate with the threat actor if that is the best business decision communicating carefully along the way with detailed documentation.  The moral of this story is that hope is not a strategy, so know your security scorecard and realize cyber readiness is a journey, not a sprint.

Author: Christopher Yula

So, What Exactly Is the Dark Web, Anyway?

The first time I heard the term ‘Dark Web’ was in the context of a case of misappropriated identity.  A close relative of mine had begun receiving all sorts of communications from credit card companies and debt collectors concerning delinquencies that they were completely unfamiliar with.  One even included an attempt at collecting back premises rent for an apartment in Dallas, Texas where my relative had never visited in their life.  After spending months fighting off financial claims and trying to repair their credit history, my relative contracted a computer security professional to perform a forensic investigation of their home PCs.  It was ultimately discovered that some or all of the data breach enabling the identity theft had been the outcome of a fairly sophisticated spear-phishing attack combined with the installation of a key logger agent.  The forensics also revealed that much of their Personal Identifying Information had migrated to the Dark Web and was presently freely available to whomever-or whichever entity-might be interested.

Dark Web and how it functions

Dark Web, I thought.  Huh.  I’ve heard of the Dark Web but don’t know much about what it is or more specifically, how it functioned.  Heretofore I’d (wrongly) believed it was composed of a bunch of gamers sharing logins to cloud gaming services along with the ever-present and always thriving market for pornography.  My investigatory efforts yielded that the Dark Web is so, so much more, however; and I thought it was important to share my findings to clear up any popular misconceptions of which there is legion.  Therefore, I’ve decided to put together a brief post that provides the nuts and bolts of what’s become an increasingly important cog in the global economy for ill-gotten bits and pieces of data and information.  It turns out, the Dark Web wasn’t nearly as elemental as I’d initially suspected.

The Dark Web is a collection of thousands of websites that use anonymity tools to hide their IP addresses. While it's most famously been used for black market drug sales and even child pornography, the Dark Web also enables anonymous whistleblowing and protects users from surveillance and censorship.  Readers will recall that the Dark Web played an intermediary role in WikiLeaks dissemination of certain confidential U.S. Department of Defense documents related to the conflicts in Iraq and Afghanistan.

Who created the Dark Web and how can it be assessed?

The majority of Dark Web sites use the anonymity software Tor with was created by the U.S. Department of Defense, though a smaller number also uses a similar tool called I2P. Both of those systems encrypt web traffic in layers and bounce it through randomly-chosen computers around the world, each of which removes a single layer of encryption before passing the data on to its next hop in the network. In theory, that prevents any spy—even one who controls one of those computers in the encrypted chain—from matching the traffic’s origin with its destination.  In layman’s terms-traffic on the Dark Web is untraceable.

Though the Dark Web is most commonly associated with the sale of drugs, weapons, counterfeit documents, and child pornography, not everything on the Dark Web is quite so “dark.” One of the first high profile Dark Web sites was the Tor hidden service WikiLeaks created to accept leaks from anonymous sources.  Even Facebook has launched a Dark Web site aimed at better catering to users who visit the site using Tor to evade surveillance and censorship. The Dark Web is also a vehicle for hackers to buy and sell personal information such as names, addresses, social security numbers, credit card information, etc. The more information they obtain from the unsuspecting victim, the higher the price.

Can Dark Web provide privacy

Just how completely Dark Web users can evade the surveillance of highly-resourced law enforcement and intelligence agencies, however, remains an open question. The FBI and EUROPOL have both launched successful Dark Web investigations aimed at stopping human trafficking, identity theft, and drug smuggling, and in most cases, the agencies were able to identify the threat actor by setting up relays and scripts on websites they frequently visit.  It's also possible that the agencies employed sophisticated DNS attacks on TOR servers or used other exploits; then again, it’s also possible they were able to rely on good old Human Intelligence-informants.  Everyone seems to have a price. 

So in summary, we know that the Dark Web exists, it’s a marketplace for all sorts of data and information exchange, not all of it legal or voluntarily disclosed.  The best way to ensure you don’t wind up on the wrong side of information exchange?  Secure your information systems, be very, very judicious in responding to emails and if you have any questions or concerns, contact a licensed information technology security professional.  The stakes are high, and only getting higher.

Author: Rich Fiore

Hackers Taking Advantage of Covid19 to attack major industries

With the unprecedented events of the past few months and no end in sight to the COVID-19 pandemic, hackers are leveraging the related chaos as a means of targeting, hi-jacking, infiltrating, and generally creating havoc among major industries around the globe.

The suddenness of the global governmental response combined with the rapid shift to remote work solutions has created a haphazard environment for many businesses that simply do not have the time to implement due diligence and information security controls. Unfortunately, the smart bad guys are taking advantage.

In California’s’ Bay Area, two school districts have become recent victims of breaches that exploited the unexpected thrust to online learning. Video conferencing sessions were hacked and infiltrated by uninvited guests; hundreds of online learning passwords were inadvertently exposed to public consumption. School administrators were left scrambling and ultimately had to ban all usage of video conferencing until proper security measures were implemented.

Hospitals and medical facilities are reeling from the virus spread, and hackers are paying no solace to this industry as they hammer away with targeted phishing campaigns and other website-based attacks. The World Health Organization (WHO) has reported several unsuccessful attacks against their network, with one geared around impersonating the WHO email system. Hammersmith Medicines Research (HMR) a UK based research team tasked with creating a Covid19 vaccine, unfortunately, did fall victim to a cyber-attack, as malicious actors were able to access and then post medical data from thousands of patients.

Education and healthcare are not the only sectors being infiltrated. Financial firms are being hit with targeted phishing attacks called whale or spear-phishing - Using Covid19 as the backdrop. Attackers are creating very specific, sophisticated emails that create a sense of urgency and ultimately increase the odds of the recipient becoming a victim.

It is an important time to ensure that your business leaders are setting an example by exhibiting best practice security behaviors that will ultimately set the tone and trickle down the entire organization. Top management commitment, effective strong policies that are communicated to the entire organization, and a measurable security awareness along with a sound risk management framework; are just some of the layers in security that will decrease the attack surface of any business.

CyberSecOp offers a full suite of cyber-security solutions that include:

• Full Security Assessments

• Gap Analysis

• Policy Creation

• Security Awareness Training and Measurement

• 24/7 Security Operations Center (SOC)

• Ransomware Response

• Penetration Testing

• Vulnerability Scanning and Management

• Forensics

• VISO (Virtual Information Security Officer)