Tag Archive for: FOX

Greetings and Felicitations – Aly McDevitt on Ransomware Case Study, Part 1 | Thomas Fox – Compliance Evangelist

/in


Welcome to the Greetings and Felicitations, a podcast where I explore topics that might not seem directly related to compliance but influence our profession. In this episode, I begin a two-part series with Aly McDevitt, Data & Research Journalist at Compliance Week, and deep dive into her series case study on a ransomware attack on a fictional company.

Highlights include: (1) Why this subject matter for a deep dive? (2) The research that went See more +

Welcome to the Greetings and Felicitations, a podcast where I explore topics that might not seem directly related to compliance but influence our profession. In this episode, I begin a two-part series with Aly McDevitt, Data & Research Journalist at Compliance Week, and deep dive into her series case study on a ransomware attack on a fictional company.

Highlights include: (1) Why this subject matter for a deep dive? (2) The research that went into the piece. How many people were interviewed, and how long was the research process? (3) Writing style. Locked yourself in a room and not coming out until it’s done or more collaborative approach with an editor? (4) Story Synopsis- how common is Betty’s mistake? (5) What is the role of the CIRT and MSSP? How critical was VE’s preparation to its ability to respond?

Tune in to the Greetings and Felicitations podcast for the 2-part series with Aly McDevitt on Ransomware Case Study in Compliance Podcast Network. #GreetingsandFelicitations #RansomwareCaseStudy #AlyMcDevitt #CPN See less –

Source…

Fresno FOX affiliate among TV stations disrupted by hackers. Here are the attack’s impacts

/in


Oct. 19—Some operations at Fresno’s FOX television affiliate, KMPH Channel 26, and its parent company Sinclair Broadcast Group have been disrupted by a ransomware attack on their computer systems.

Justin Willis, an anchor for the station’s Great Day morning show, took to Facebook on Tuesday to explain that the weekend attack by hackers at the station and at Sinclair “left us unable to log into our systems that allow us to produce our newscasts as we normally would.”

On Facebook and on Twitter, the station acknowledged Monday that systems at Sinclair had been hacked, reporting that “certain servers and workstations in its environment were encrypted with ransomware and that certain office and operational networks were disrupted.”

Also on Monday, in a press release and in a filing with the U.S. Securities and Exchange Commission, Sinclair reported that the hack “has caused — and may continue to cause — disruption to parts of the company’s business,” including service to its advertisers.

The company’s statement added that “data was also taken from the company’s network.”

Telephone calls from The Bee could not be completed to either the KMPH studio in Fresno or to Sinclair’s headquarters in Maryland as the company’s phone systems were down.

The station reported Tuesday that all Sinclair stations were operational, but that “certain features, such as online live streams, have been interrupted.”

Cybersecurity firm Recorded Future, in its online publication The Record, reported Sunday that the attack “took down the Sinclair internal corporate network, email servers, phone services, and the broadcasting systems of local TV stations.”

Citing multiple sources, The Record reported that “as a result of the attack, many channels weren’t able to broadcast morning shows, news segments, and scheduled NFL games, according to a barrage of tweets coming from viewers and the TV channels themselves.”

The Fresno station’s social media posts and the company’s statements came after Sinclair said it had identified “a potential security incident” on Saturday. On Sunday, it determined that some of its systems were affected by ransomware.

In early July, Sinclair alerted its stations of “a serious…

Source…

School District's computers, phones and data locked up by ransomware attack – FOX 29

/in



School District’s computers, phones and data locked up by ransomware attack  FOX 29

Source…

APT10 targets Japanese entities. Purple Fox gets an upgrade. Android malware poses as system update.

/in


At a glance.

  • APT10 targets Japanese entities.
  • Purple Fox gets an upgrade.
  • Android malware poses as system update.
  • Vulnerable mobile apps.

APT10 targets Japanese entities.

Kaspersky describes a cyberespionage campaign that ran from March 2019 to the end of December 2020. The campaign targeted Japan and entities related to Japan, particularly the country’s manufacturing industry. The researchers “assess with high confidence” that China’s APT10 is behind the operation. The threat actor gained access by exploiting vulnerabilities in Pulse Connect Secure VPNs or by using previously stolen credentials.

Kaspersky says the actor used a unique loader dubbed “Ecipekac” to deliver fileless malware. The researchers explain, “This campaign introduced a very sophisticated multi-layer malware named Ecipekac and its payloads, which include different unique fileless malware such as P8RAT and SodaMaster. In our opinion, the most significant aspect of the Ecipekac malware is that, apart from the large number of layers, the encrypted shellcodes were being inserted into digitally signed DLLs without affecting the validity of the digital signature. When this technique is used, some security solutions cannot detect these implants. Judging from the main features of the P8RAT and SodaMaster backdoors, we believe that these modules are downloaders responsible for downloading further malware that, unfortunately, we have not been able to obtain so far in our investigation.”

Purple Fox gets an upgrade.

Guardicore is tracking a malware campaign dubbed “Purple Fox” that’s recently added a new propagation method. The malware was discovered in 2018, and would spread via exploit kits and phishing emails. In late 2020, however, the malware operators began gaining access by brute-forcing exposed SMB services:

“While it appears that the functionality of Purple Fox hasn’t changed much post exploitation, its spreading and distribution methods – and its worm-like behavior – are much different than described in previously published articles. Throughout our research, we have observed an infrastructure that appears to be made out of a hodge-podge of vulnerable and exploited servers hosting the initial payload of the malware,…

Source…