Cybercrime Archives - Cyber Security Plus

BBC, BA and Boots issued with ultimatum by cyber gang Clop

tonibennett — Thu, 08 Jun 2023 14:32:00 +0000

A prolific cyber crime gang thought to be based in Russia has issued an ultimatum to victims of a hack that has hit organisations around the world.

The Clop group posted a notice on the dark web warning firms affected by the MOVEit hack to email them before 14 June or stolen data will be published.

More than 100,000 staff at the BBC, British Airways and Boots have been told payroll data may have been taken.

Employers are being urged not to pay up if the hackers demand a ransom.

Cyber security research previously suggested Clop could be responsible for the hack which was first announced last week.

The criminals found a way to break into a piece of popular business software called MOVEit and were then able to use that access to get into the databases of potentially hundreds of other companies.

Analysts at Microsoft said on Monday they believed Clop was to blame, based on the techniques used in the hack.

It has now been confirmed in a long blog post written in broken English.

The post, seen by the BBC, reads: “This is announcement to educate companies who use Progress MOVEit product that chance is that we download a lot of your data as part of exceptional exploit.”

The post goes on to urge victim organisations to send an email to the gang to begin a negotiation on the crew’s darknet portal.

This is an unusual tactic as normally ransom demands are emailed to victim organisations by the hackers, but here they are demanding that victims get in touch. This could be because Clop itself can’t keep up with the scale of the hack which is still being processed around the world.

“My take is that they just have so much data that it is difficult for them to get on top of it all. They’re betting that if you know then you will contact them,” says SOS Intelligence CEO Amir Hadžipasić.

MOVEit is supplied by Progress Software in the US for many businesses to securely move files around company systems. Payroll services provider Zellis, which is based in the UK, was one of its users.

Zellis has confirmed that eight UK organisations have had data stolen as a result, including home addresses, national insurance numbers and, in some cases, bank details. Not all firms have had the same data exposed.

Zellis customers which has been breached include:

BBC
British Airways
Aer Lingus
Boots

Nova Scotia Government and the University of Rochester is also warning staff that data may have been stolen through the MOVEit vulnerability.

Advice from experts is for individuals not to panic, and for organisations to carry out security checks issued by authorities like the Cyber Security and Infrastructure Authority in the US.

Clop claims on its leak site that it has deleted any data from government, city or police services.

“Do not worry, we erased your data you do not need to contact us. We have no interest to expose such information,” it reads.

However, researchers say the criminals are not to be trusted.

“Clop’s claim to have deleted information relating to public sector organisations should be taken with a pinch of salt. If the information has monetary value or could be used for phishing, it’s unlikely that they will simply have disposed it,” said Brett Callow, threat researcher from Emsisoft.

Cyber security experts have long tracked the exploits of Clop, which is thought to be based in Russia as it mainly operates on Russian speaking forums.

Russia has long been accused of being a safe haven to ransomware gangs – which it denies.

However, Clop runs as a “ransomware as a service” group, which means hackers can rent their tools to carry out attacks from anywhere.

In 2021, alleged Clop hackers were arrested in Ukraine in a joint operation between Ukraine, US and South Korea.

At the time, authorities claimed to have taken down the group which they said was responsible for extorting $500m from victims around the world.

But Clop has continued to be a persistent threat.

The post BBC, BA and Boots issued with ultimatum by cyber gang Clop appeared first on Cyber Security Plus.

How schools can protect against cyber attacks

tonibennett — Sun, 19 Jul 2020 16:51:25 +0000

Increasing concerns about cybersecurity are justified, says Jamie Moles, but there’s plenty schools can do to protect themselves and their students

Cyber security in the education sector has become an increasingly pressing concern in recent years as hackers target the sensitive data of students, teachers and staff. In the UK, the issue came to a head over the Christmas holidays when a group of hackers demanded £15 million in ransom money after successfully attacking at least 16 British schools. As a result, teachers returning to work after Christmas were left unable to access their computer systems, causing major disruptions to their work.

Similarly, in the United States, an apparent cyber attack on Iowa’s largest school district, Des Moines Public Schools, led officials to cancel classes for 30,000 students for two consecutive days as technicians worked to restore the computer system and protect data. This highlights the vulnerability of schools to cyber attacks, particularly due to understaffed IT teams and a lack of cybersecurity education among staff and pupils. Last week this sentiment was echoed by a report from the National Cyber Security Centre (NCSC) and edtech charity LGfL, which revealed that 78 per cent of UK schools experienced at least one type of cyber incident in 2022, with 7 per cent reporting significant disruption.

Given the findings of the NCSC’s report, it’s clear that the education sector is a prime target for cybercriminals. The NCSC warns schools are at “particular risk” of cyber attacks. Therefore, it’s crucial that schools take proactive measures to improve their cyber security defences and be better prepared to handle incoming attacks. So, how can schools protect themselves from these threats?

Educating educators

Perhaps fittingly, education is the sector’s best bet. One of the most effective, low-cost measures to ensure safety is through staff training and awareness efforts. By educating staff on how to spot and avoid phishing attempts and providing training on best practices, schools can significantly improve their defences against these types of attacks. This is particularly important as phishing is a major threat to staff members who may have a lack of awareness about how hackers gain access to systems, steal data or spread malware.

However, education may not be enough. In today’s digital age, schools are faced with the constant threat of cyber attacks. With intruders attempting to breach networks at a near-constant rate, it is essential for schools to have extra levels of defence in place. It isn’t only a question of how and when a bad actor will breach the network, but also how much damage they will cause once inside.

Network Detection and Response

To combat these threats, schools must act quickly and efficiently. A few seconds can mean the difference between a minor inconvenience and a major disaster.

One way to keep schools’ computer networks safe is by using advanced technology like Network Detection and Response (NDR) systems. These systems use real-time information to watch over the network, determining whether or not something is a problem. These tools measure the risk level of a problem and how often it has happened before, which helps to filter out false alarms and lets the security team focus on the most serious threats.

NDR systems are powered by AI and machine learning, which means they can work on their own and take some of the burden off a school’s IT team.

Endpoint protection and updates

Another important technology to consider is endpoint protection. This helps protect devices like laptops, desktop computers and mobile phones from harmful software and viruses. Additionally, schools can keep networks safe by diligently making sure software is always up-to-date with the latest patch and using two-factor authentication for sensitive information access.

Ultimately, the education sector will continue to be a target for cyber criminals. Hackers are constantly evolving and developing new methods to penetrate networks. To stay ahead of these threats, schools must implement robust cyber security measures such as staff training, advanced technology solutions and regular software updates and monitoring.

In particular, utilising smart technologies like machine learning and artificial intelligence can help improve defences and help schools keep up at a time when resources are stretched.

The post How schools can protect against cyber attacks appeared first on Cyber Security Plus.