Eliana Willis

CISA, the FBI and NSA officially implicated the BlackMatter ransomware group in the recent attacks on two agriculture companies, confirming the assessments of some security researchers who said the gang was behind incidents involving New Cooperative and Crystal Valley in September.New Cooperative — an Iowa-based farm service provider — was hit with a ransomware attack on September 20 and BlackMatter demanded a $5.9 million ransom. Crystal Valley, based in Minnesota, was attacked two days later. Both attacks came as harvests began to ramp up for farmers.In the advisory, CISA, the FBI and NSA said BlackMatter has targeted multiple US critical infrastructure entities since July. The advisory provides a detailed examination of BlackMatter’s tactics and outlines how the group typically attacks organizations. “Using embedded, previously compromised credentials, BlackMatter leverages the Lightweight Directory Access Protocol (LDAP) and Server Message Block (SMB) protocol to access the Active Directory (AD) to discover all hosts on the network,” CISA said in the advisory. “BlackMatter then remotely encrypts the hosts and shared drives as they are found. Ransomware attacks against critical infrastructure entities could directly affect consumer access to critical infrastructure services; therefore, CISA, the FBI, and NSA urge all organizations, including critical infrastructure organizations, to implement the recommendations listed in the Mitigations section of this joint advisory.”The law enforcement organizations noted that BlackMatter operates as ransomware-as-a-service and may possibly be a rebrand of DarkSide, a ransomware group that allegedly closed shop in May after attacking Colonial Pipeline. They added that BlackMatter has demanded ransom payments ranging from $80,000 to $15,000,000 in Bitcoin and Monero.

“Notably, this variant of BlackMatter leverages the embedded credentials and SMB protocol to remotely encrypt, from the original compromised host, all discovered shares’ contents, including ADMIN$, C$, SYSVOL, and NETLOGON. BlackMatter actors use a separate encryption binary for Linux-based machines and routinely encrypt ESXi virtual machines. Rather than encrypting backup systems, BlackMatter actors wipe or reformat backup data stores and appliances,” the advisory explained.”BlackMatter leverages legitimate remote monitoring and management software and remote desktop software, often by setting up trial accounts, to maintain persistence on victim networks. BlackMatter attempts to exfiltrate data for extortion. BlackMatter remotely encrypts shares via SMB protocol and drops a ransomware note in each directory. BlackMatter may wipe backup systems.”The notice lists dozens of measures organizations should take to protect themselves from BlackMatter, including the implementation of detection signatures, strong passwords, MFA, routine patching, network segmentation and access limitations.Due to the increase in ransomware attacks on weekends and holidays, CISA suggested organizations implement time-based access for accounts set at the admin-level and higher.In September, the FBI released its own notice warning companies in the food and agriculture sector to watch out for ransomware attacks aiming to disrupt supply chains. The FBI note said ransomware groups are seeking to “disrupt operations, cause financial loss, and negatively impact the food supply chain.” “Ransomware may impact businesses across the sector, from small farms to large producers, processors and manufacturers, and markets and restaurants. Cybercriminal threat actors exploit network vulnerabilities to exfiltrate data and encrypt systems in a sector that is increasingly reliant on smart technologies, industrial control systems, and internet-based automation systems,” the FBI said. “Food and agriculture businesses victimized by ransomware suffer significant financial loss resulting from ransom payments, loss of productivity, and remediation costs. Companies may also experience the loss of proprietary information and personally identifiable information and may suffer reputational damage resulting from a ransomware attack.”The notice listed multiple attacks on the food and agriculture sector since November, including a Sodinokibi/REvil ransomware attack on a US bakery company, the attack on global meat processor JBS in May, a March 2021 attack on a US beverage company and a January attack on a US farm that caused losses of approximately $9 million. In November 2020, the FBI also cited an attack on a US-based international food and agriculture business that was hit with a $40 million ransom demand from the OnePercent Group. The company was able to recover from backups and did not pay the ransom. More

A new survey of 300 US-based IT decision-makers found that 64% have been victims of a ransomware attack in the last 12 months, and 83% of those attack victims paid the ransom demand.

ZDNet Recommends

Cybersecurity company ThycoticCentrify released its “2021 State of Ransomware Survey & Report” on Tuesday, featuring the insights of IT leaders who have dealt with ransomware attacks over the last year. Of those surveyed, 72% have seen cybersecurity budgets increase due to ransomware threats, and 93% are allocating special budgets to fight ransomware threats. Half of the respondents said they experienced a loss of revenue and reputational damage from a ransomware attack, while 42% indicated they had lost customers as a result of an attack. More than 30% said they were forced to lay off employees as well.Respondents said the most vulnerable vectors for ransomware attacks were email (53%), followed by applications (41%) and the cloud (38%).26% of respondents cited the top attack vector was privileged access, followed closely by vulnerable endpoints (25%). “Organizations are spending their increased cyber security budgets investing in ransomware prevention with network security (49%) and cloud security (41%) solutions. It is interesting to note that in this survey, identity access management (24%), endpoint security (23%) and privileged access management (19%) are lower priorities for budget spend,” the survey said. “The most common steps taken to prevent ransomware attacks include backing up critical data (57%), regularly updating systems and software (56%), and enforcing password best practices (50%). Last on the list was adopting a least privilege posture (34%).”

Experts were not surprised by the survey’s findings, considering how many companies have been public about paying ransoms. Major corporations like Colonial Pipeline and JBS admitted to paying ransoms after devastating ransomware incidents, and studies show many organizations end up paying ransoms. “Naive statements like ‘never pay the ransom’ simply ignore the reality of the situation and do not have any chance in actually changing anything. Over the years, we have gotten better at recovery from breaches, and attackers are trying new ways to get paid. It has been increasingly frequent in recent months where supply chain breaches are leading to ransom demands to not leak data belonging to the victim organization,” said John Bambenek, threat intelligence advisor at Netenrich. “Frankly, as long as the economics are in favor of paying, most organizations will pay. However, the paying of ransoms doesn’t guarantee results.” More

It looks like more than ghosts are wreaking havoc on haunted networks. We’re less than a full week into October, and Cybersecurity Awareness Month isn’t quite taking shape the way we expected. Ostensibly, orgs decided to pivot and use this time to confess their wrongdoings before Halloween. Let’s take a trip through what’s happened so far and the lessons we’ve learned. Luckiest breach announcement timing… ever? Before October 4, you likely had not heard of Syniverse, though it works with 95% of the top 100 telecoms in the world. If you learned about them on October 4, it was first thing in the morning, and then … other stuff happened. Unfortunately, your texts, call records, and more were likely hoovered up by hackers in yet another third-party telecom breach. What makes this breach unique — for now anyway — is that the unauthorized access went unnoticed or undisclosed for five years, topping SolarWinds by an order of magnitude. It also highlights the risks of SMS and geolocation data, which could play a critical role in misinformation/disinformation and espionage. 

Facebook disappeared from the internet — literally — and that effectively buried the Syniverse news under a mountain of speculation about the Facebook outage. In an ironic twist of fate, Facebook simultaneously contended with the outage and experienced a deluge of rumors on the cause. Speculation ranged from an insider show of solidarity with the whistleblower to the opposite, using the outage to draw attention away from the whistleblower testifying to the US Congress. The truth is less salacious but far more realistic: a faulty configuration change interrupted communication between data centers. While Facebook data centers could not communicate, few tried to communicate at all about Syniverse. And that’s troubling, since Syniverse “processes 740 billion texts yearly and has over 300-plus direct connections to mobile operators” per its website. This breach is not limited to an individual consumer’s text messages and records. Twilio is a minority owner of Syniverse and is mentioned as one of its major contributors to revenue, behind only AT&T. That makes this breach relevant from a B2C and B2B perspective, given Twilio’s reach into the developer world. The long tail of this breach will have far-reaching consequences as Sen. Ron Wyden told Motherboard: “The information flowing through Syniverse’s systems is espionage gold.” Expect security and privacy events that trace back to this one for years. Attackers reveal how Twitch fails livestreamers In what’s certainly damaging to users — but perhaps more so damaging to the platform itself — Twitch, the dominant livestreaming choice for content creators, experienced a massive data leak. This one features partner, platform, and product security issues. And  the ugliest part of all? It provides a serious glimpse into gender and racial pay gap disparities between content creators. The payout rates negotiated between Twitch, sponsors, and streamers are now publicly available and exposed. There’s zero doubt Twitch — already facing competition from YouTube for streamers — could see a talent exodus as feelings of unequal treatment get confirmed as fact. As a platform, Twitch sits between content creators, sponsors, advertisers, and viewers, facilitating and monetizing parasocial relationships. That ecosystem requires trust, which data breaches and disclosure of sensitive intellectual property threatens. 

Breaches often come at the worst possible time, and Twitch already had serious issues with content creators facing harassment from viewers and other streamers on occasion. Hot tub streams, hate raids, swatting, racism, and sexism plague Twitch. A data breach is not the most serious problem the company faces given those other items, but it’s certainly not making things easier. The power of incident response compels you If this month keeps going the way it is, the “X” in XDR (extended detection and response) might stand for eXorcism, given the ratio of breach announcements-to-days of October we’ve experienced so far. Add this to the volume and severity of breaches reported in 2021, and we’re swimming in pea soup. Yet, according to Forrester Analytics Business Technographics® Security Survey, 2021, just 12% of respondents list breach and attack simulation as a top information/IT security priority over the next 12 months. Firms should revisit, revise, and rehearse incident response and crisis management plans at least biannually, if not quarterly, to keep up with attackers and their tactics. At least one of those breach simulations should be a ransomware attack, and all exercises should assume data exfiltration. Those concerned about data that could come from Twitch should consider a crisis management exercise. For customers, platforms, and partners, trust is on the line. Don’t wait until the incident is underway to assemble your crisis management ecosystem of critical third parties like legal, digital forensics, and incident response, along with PR to ensure notifications, handoffs, and all communication flows smoothly. Consider media training for key executives who will be seen as the face of any crisis affecting your firm. Zero Trust to the rescue The old way to approaching security architecture is already widely known to be a failure from a technical perspective (see the above examples if you aren’t convinced). Add in the business realities of the interconnectedness of relationships between platforms, partners, and customers without shifting your strategy, and security, risk, and privacy leaders will get totally left behind. This makes a shift to Zero Trust architectures a requirement. Customers and business partners demand dependability, believing that you’re protecting the entire ecosystem by forgoing inherent trust in any user, device, or system. Zero Trust enables you and your ecosystem to be both resilient and protected. At the end of the day, organizations don’t want another mystery on their hands. To learn more about Zero Trust, register to attend Forrester Security & Risk Forum here. This post was written by Forrester Vice President, Principal Analyst Jeff Pollard and it originally appeared here.  More

The US Federal Communications Commission (FCC) is due to consider a new proposal to clamp down on robot texts.

On October 18, FCC Acting Chairwoman Jessica Rosenworcel unveiled a new set of proposed rules that would force wireless carriers to block illegal robot texts, potentially at the network level. According to the chairwoman, the US regulator received roughly 14,000 complaints from consumers concerning unwanted, robot texts in 2020. So far, the commission has received over 9,800 complaints, which suggests that this is a rising trend that needs to be tackled alongside robot calls.  Research conducted by RoboKiller found that spam text message rates in the US are far higher than the rate of complaints received by the FCC, with an estimated 7.4 billion spam SMS messages sent in March alone. Robocalls and robotexts are often pushed out to consumers for the same purpose: to lure them into scams — such as insurance claims or, more recently, coronavirus-themed services — as well as to share Personally identifiable information (PII), banking details, or to visit malicious and fraudulent websites in phishing campaigns.  Rosenworcel said that if the proposal is accepted, mobile carriers in the United States would be required to protect customers from illegal text messages, and this could include initiatives such as blocking texts at the network level — or “applying caller authentication standards to text messaging.” The proposals build upon rules discussed in September to protect 911 call centers from robocalls. As a critical service, call handlers certainly do not need to also have to deal with influxes of scam calls — and the FCC’s proposal would force service providers to stop robocalls from reaching numbers on do-not-call registries. 

In addition, the watchdog is attempting to stop telecoms firms from accepting calls on their networks from voice service providers that are not registered in the FCC’s Robocall Mitigation Database. “We’ve seen a rise in scammers trying to take advantage of our trust of text messages by sending bogus robotexts that try to trick consumers to share sensitive information or click on malicious links,” Rosenworcel commented. “It’s time we take steps to confront this latest wave of fraud and identify how mobile carriers can block these automated messages before they have the opportunity to cause any harm.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Twitter has suspended accounts belonging to a North Korean hacking group targeting security researchers. 

The social media accounts, @lagal1990 and @shiftrows13, were suspended this month after “posing as security researchers,” according to Google Threat Analysis Group (TAG) analyst Adam Weidermann, who added that the profiles “leaned on the hype of 0-days to gain followers and build credibility.”As noted by Threatpost, another account, @lagal1990, was closed for the same reason in August. The campaign, believed to be the work of state-sponsored North Korean cyberattackers, has been tracked by the Google TAG team over the past year.  First documented in January 2021, the campaign includes the creation of a network of fake profiles across platforms including Twitter, LinkedIn, Keybase, and GitHub.  The fake profiles are riding on interest in exploits and zero-day bugs to establish an aura of credibility and will post content such as proof-of-concept (PoC) code and exploit techniques.  According to Weidermann, the fake accounts were found by researchers Francisco Alonso and Javier Marcos.

“We (TAG) confirmed these are directly related to the cluster of accounts we blogged about earlier this year,” Weidermann commented. “In the case of @lagal1990, they renamed a GitHub account previously owned by another of their Twitter profiles that was shut down in Aug, @mavillon1.” The cluster of accounts is used to reach out to their intended targets, including well-known and credible security researchers. A research blog, too, was published online, and videos have been uploaded online claiming to be proof of exploits and bugs. “They’ve used these Twitter profiles for posting links to their blog, posting videos of their claimed exploits, and for amplifying and retweeting posts from other accounts that they control,” Google TAG says.  However, once communication has been established, the North Korean group then asks their targets if they are interested in collaborating on security research.  Links are then sent to researchers to a blog that contains browser exploits including an Internet Explorer zero-day unmasked in January. Alternatively, they may also be sent a malicious Visual Studio project file containing a backdoor, granting the attackers entry into their victim’s machine — and the information contained therein.  In March, the group created a fake Turkish offensive security company called SecuriElite, with a batch of profiles linked to this firm pretending to be made up of cybersecurity researchers and recruiters.  Last week, Google TAG documented efforts to counter attacks from APT35, an Iranian group specializing in phishing campaigns against high-risk users of Google, including campaign staffers during the 2020 US election.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More