Publicerad 2022-08-26 15:17 CERT-SE:s veckobrev v.34En grekisk leverantör av naturgas, ett franskt sjukhus och en leverantör till flygbolag har den senaste tiden utsatts för utpressningsvirus. Ytterligare organisationer berättar om både försök till och genomförda angrepp och ett felaktigt meddelande om "Luftangrepp, fara" har gått ut i Blekinge. Dessutom blir det som vanligt ett antal fördjupningar och mer tekniska analyser. Trevlig helg önskar CERT-SE! Nyheter i veckanSoftware developer cracks Hyundai car security with Google search (17 aug)https://www.theregister.com/2022/08/17/software_developer_cracks_hyundai_encryption/PayPal Phishing Scam Uses Invoices Sent Via PayPal (18 aug)https://krebsonsecurity.com/2022/08/paypal-phishing-scam-uses-invoices-sent-via-paypal/iOS Privacy: Announcing InAppBrowser.com (18 aug)https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browserPersonuppgiftsincident anmäld (19 aug)https://www.regionkalmar.se/nyhetslista/personuppgiftsincident-anmald28/LockBit ransomware blames Entrust for DDoS attacks on leak sites (22 aug)https://www.bleepingcomputer.com/news/security/lockbit-ransomware-blames-entrust-for-ddos-attacks-on-leak-sites/Norska Oljefonden: Vi utsätts för allvarliga cyberangrepp varje dag (22 aug)https://sverigesradio.se/artikel/norska-oljefonden-vi-utsatts-for-allvarliga-cyberangrepp-varje-dagHiding a phishing attack behind the AWS cloud (22 aug)https://www.theregister.com/2022/08/22/aws_cloud_phishing/Greek natural gas operator suffers ransomware-related data breach (22 aug)https://www.bleepingcomputer.com/news/security/greek-natural-gas-operator-suffers-ransomware-related-data-breach/Hackers demand $10 million from Paris hospital after ransomware attack (23 aug)https://www.bitdefender.com/blog/hotforsecurity/hackers-demand-10-million-from-paris-hospital-after-ransomware-attack/Ex-Twitter exec blows the whistle, alleging reckless and negligent cybersecurity policies (23 aug)https://edition.cnn.com/2022/08/23/tech/twitter-whistleblower-peiter-zatko-security/index.htmlLinus Larsson: Därför kommer du inte få rösta via mobilen (23 aug)https://www.dn.se/sverige/linus-larsson-darfor-kommer-du-inte-fa-rosta-via-mobilen/Major airline technology provider Accelya attacked by ransomware group (23 aug)https://therecord.media/major-airline-technology-provider-accelya-attacked-by-ransomware-group/ETHERLED: Air-gapped systems leak data via network card LEDs (23 aug)https://www.bleepingcomputer.com/news/security/etherled-air-gapped-systems-leak-data-via-network-card-leds/..ETHERLED: Sending Covert Morse Signals from Air-Gapped Devices via Network Card (NIC) LEDshttps://arxiv.org/pdf/2208.09975.pdfPlex discloses data breach and urges password reset (24 aug)https://securityaffairs.co/wordpress/134814/data-breach/plex-data-breach.html5G Networks Are Worryingly Hackable (24 aug)https://spectrum.ieee.org/5g-virtualization-increased-hackabilityNotice of Recent Security Incident (25 aug)https://blog.lastpass.com/2022/08/notice-of-recent-security-incident/Felaktigt meddelande om ”Luftangrepp, fara” gick ut i Blekinge (25 aug)https://www.dn.se/sverige/felaktigt-meddelande-om-luftangrepp-fara-gick-ut-i-blekinge/Informationssäkerhet och blandatReservations Requested: TA558 Targets Hospitality and Travel (18 aug)https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travelGrandoreiro Banking Trojan with New TTPs Targeting Various Industry Verticals (18 aug)https://www.zscaler.com/blogs/security-research/grandoreiro-banking-trojan-new-ttps-targeting-various-industry-verticalsYou Can’t Audit Me: APT29 Continues Targeting Microsoft 365 (18 aug)https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoftBack in Black: Unlocking a LockBit 3.0 Ransomware Attack (19 aug)https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/Cyber Signals: Defend against the new ransomware landscape (22 aug)https://www.microsoft.com/security/blog/2022/08/22/cyber-signals-defend-against-the-new-ransomware-landscape/Cyber security experts team up to protect UK construction projects (23 aug)https://www.ncsc.gov.uk/news/joint-ventures-construction-guidanceLegitimate SaaS Platforms Being Used to Host Phishing Attacks (23 aug)https://unit42.paloaltonetworks.com/platform-abuse-phishing/MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone (24 aug)https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/CERT-SE i veckanKritisk sårbarhet i BitbucketKritisk sårbarhet i GitLabKritisk sårbarhet i Zimbra Collaboration Suite (uppdaterad 2022-08-25)
