Today's Cybersecurity Threats and Trends - 7/27/2024

'Sploit'n the night away

Author

J.W. Croley
July 27, 2024

Today’s Top 5 Emerging Cybersecurity Threats and Trends:

1. Ransomware Ramp-Up

Primary Threat: Ransomware-as-a-Service (RaaS) operations like BlackCat/ALPHV and Daixin Team are escalating their attacks. Major targets include healthcare systems (e.g., UnitedHealth Group's Change Healthcare) and hospitality (e.g., Omni Hotels).

  • ​MITRE Tactics: Initial Access, Persistence, Lateral Movement, Impact

  • Risk: High – Financial loss, operational disruption, and data breaches.

2. Cloud Service Attacks

Primary Threat: Russian APT29 (Cozy Bear) is shifting focus to cloud infrastructure, targeting Microsoft 365 and other cloud services using compromised credentials and access tokens.

  • MITRE Tactics: Initial Access, Credential Access, Persistence, Defense Evasion.

  • Risk: High – Espionage, data theft, and long-term network infiltration.

3. Exploitation of Zero-Day Vulnerabilities

Primary Threat: Critical vulnerabilities like the Veeam Backup Enterprise Manager auth bypass (CVE-2024-29849) and Windows bug (CVE-2024-26169) are being actively exploited. These flaws allow attackers to gain unauthorized access and elevate privileges.

  • MITRE Tactics: Initial Access, Privilege Escalation, Defense Evasion

  • Risk: High – System compromise, unauthorized access, and potential for widespread attacks.

4. Phishing Campaigns in New Avenues

Primary Threat: Phishing attacks are evolving, targeting collaboration platforms like Microsoft Teams and leveraging open redirect vulnerabilities in sites like Indeed to steal credentials.

  • MITRE Tactics: Initial Access, Credential Access

  • Risk: Medium – Credential theft leading to further attacks and data breaches.

5. Supply Chain Compromises

Primary Threat: Attacks on firmware and third-party software, such as the PKfail Secure Boot bypass affecting UEFI products and the ServiceNow RCE flaws, are becoming more prevalent​.

  • MITRE Tactics: Initial Access, Execution, Persistence

  • Risk: High – System compromise at a foundational level, difficult to detect and mitigate.

IN SUMMARY:

It's a wild world out there, folks! Ransomware gangs are playing tag-you're-it with your wallets, cozy Russian bears are clawing at your cloud services, and zero-days are popping up faster than popcorn at a movie theater.

Meanwhile, phishing has graduated from your inbox to your team chats, and supply chains are looking like a hacker's buffet.

Stay frosty, patch often, and remember: In cybersecurity, paranoia is just good business sense.

J.W.