BlackCat Ransomware takes credit for the attack on Ecuador's army / Lockbit demands $60M ransom from Pendragon / Raspberry Robin becoming one of the most used distribution platforms by threat actors

Plus: Google releases emergency security patch for a bug found by Avast

Inside.com Part of   Network October 28, 2022

Presented by

The BlackCat ransomware group has taken credit for a recent cyberattack on Ecuador's army. The Russian hacker group is known for breaching public institutions and actors tied to governments such as the U.S. Defense Department. More: BlackCat stated that it has gained access to information that belongs to the Ecuadorian Joint Command of the Armed Forces. The hacker group added that if the Ecuadorian government does not contact them, they will release information every 12 hours. BlackCat has been behind numerous cyberattacking campaigns during the last 12 months. The threat actor has breached over 60 victims, including Italian energy company GES, Swissport, German oil companies Oiltanking and Mabanaft, etc. The group uses RUST as its programming language for malware, as it provides the group with more security and unpredictability.  BlackCat was tracked by the FBI in November 2021. The FBI warned that the group offers a 70% profit share for its affiliates, making it unique among threat actors.

The Lockbit hacker group is demanding a $60M ransom from car dealer chain Pendragon after breaching the company, while Pendragon says the attack has been contained. Hackers claim they have 2TB worth of data. More: The threat actor claims that it will leak more than 2 million files unless its demands are met by Oct. 29.  Lockbit hacker group has previously pushed the deadline after initially setting the deadline for Oct. 21. Pendragon is a car dealership chain with more than 160 based in the U.K. The company has claimed that it will categorically refuse to pay any ransom and has not done so.  Lockbit hacker group has been one of the most active threat actors recently. Reports have shown that the actor was responsible for nearly 40% of all ransom demands in May 2022.

A message from SECURITY COMPASS The only secure developer training that is accredited by (ISC)²  Our role-based, language-specific, secure developer training meets developers where they are in their knowledge and learning style to ensure they successfully develop and apply secure coding skills. Go beyond secure coding training. Retain talent, remain competitive, and stay compliant. We offer over 49 courses covering topics including: ● Defending AWS, .NET, Angular, Java, and more ● DevSecOps Fundamentals and DevSecOps for Managers ● Defending Containers, Kubernetes, Docker ● Secure Software Requirements, Design, Testing Explore language-specific, role-based, (ISC)² accredited secure developer training.  Visit our page to browse our curriculum, try a free course, or speak to the team. Browse our curriculum

Raspberry Robin is becoming one of the largest malware distribution platforms currently used by threat actors, according to researchers. The worm is being used as a way of diversifying threat vector opportunities for hackers. More: The Microsoft Security Threat Intelligence division stated that the worm previously had no post-infection capabilities. The worm was only tracked in May 2022, but by July 2022, it was already widely being used as a distribution platform. Raspberry Robin attacks involve multi-stage intrusions, while its post-infection activities require access to highly privileged credentials to cause lasting damage.  In the last 30 days alone, 3,000 devices that belong to nearly 1,000 organizations have been targeted by Raspberry Robin. Hackers have used it to deploy malware such as:  Fake updates, Lockbit ransomware, IceID, Bumblebee, Truebot, etc. Researchers believe that it is likely threat actors are paying the Raspberry Robin operators for malware installs.

Google has released an emergency patch for a security flaw found by security company Avast. The flaw affects the V8 Javascript engine in Google Chrome. More: The flaw is officially tracked as CVE-2022-3723 and was reported only three days ago. This marks the seventh zero-day Chrome security flaw Google has patched so far in 2022, two of which have been reported by Avast Security. In addition to this flaw, Avast also reported CVE-2022-2294. This bug was patched a few months ago. CVE-2022-2294 may affect WEBRTC, a component that is suspected of having been previously used by an Israel-based cybersecurity company to breach targets in the Middle East.

Binance Labs has invested in Ancilia, a real-time threat detection company for Web3. Hackers have stolen $1.5B from Web3 companies and users so far. More: The investment comes after the number of Web3 hacks, such as the $600M Axie hack, has reached an all-time high. Ancilia offers threat detection and prevention as a SaaS platform. The company aims to differentiate itself by using both on-chain and off-chain data to formulate its report. Representatives from Binance Labs stated that the investment will let Binance offer its users more security and allow them to build an ecosystem safely. The Pre-Seed investment amount remains undisclosed. Zoom Out: Hackers have so far stolen over $100M from NFT collectors, while cyberattacks against crypto companies have seen a double-digit rise in 2022.

Quick Hits: Scale up with this toolkit and get your brand on everyone's wishlist.* A new report by McKinsey claims that the global cybersecurity market may reach $2T. Parliament members in the parliament of Slovakia were forced to shut down their devices due to a cyberattack. Santander, one of the world's largest banks, has stated that the U.K. government needs to do more to fight APP payment fraud by updating legislation and using more security checks. According to a newly released report from research company Gartner, 2022 is the year when APIs will become the leading attack vector for enterprise web applications. *This is sponsored content.

Upcoming events at Inside: November 02 - AMA with Bill Glenn (Executive Chairman at Crenshaw Associates) (Register Here) November 09 - Synthetic data for more efficient, robust and ethical model development - Live AMA with Yashar Behzadi (CEO and Founder of Synthesis AI)* (Register Here) December 07 - Live AMA with Deividi Silva ( Head of Developer Relations at Gun.io) (Register Here) *This is a sponsored listing.

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

Security Compass delivers best-practice, role-based, accredited eLearning solutions.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.