Cyber Risk Update 31 MAR 2023

Here is the cyber risk update for the week of 31 March 2023.

Local Government Data Breaches

More information is emerging about the massive cyber breach of Minneapolis Public Schools. The school district has refused to pay $1 million in ransomware to the Medusa Media Team, cyber criminal group. https://www.cbsnews.com/minnesota/news/cybersecurity-expert-mps-hack-investigation/

Nation States

Secret trove offers rare look into Russian cyberwar ambitions, More than 5,000 pages of documents from a Moscow-based contractor offer unusual glimpses into planning and training for security services, including the notorious hacking group Sandworm https://www.washingtonpost.com/national-security/2023/03/30/russian-cyberwarfare-documents-vulkan-files/
- “These documents suggest that Russia sees attacks on civilian critical infrastructure and social media manipulation as one and the same mission, which is essentially an attack on the enemy’s will to fight.” John Hultquist, vice president for intelligence analysis at Mandiant
Since a mass ransomware attack in late January 2023/early February 2023, the Russia-linked Clop gang has disclosed less than half of the 130 organizations it claimed to have compromised via GoAnywhere file transfer software. https://techcrunch.com/2023/03/22/fortra-goanywhere-ransomware-attack/
A joint cybersecurity advisory from German and Korean government agencies warn about Kimsuky's use of Chrome extensions to steal target's Gmail emails. Kimsuky (aka Thallium, Velvet Chollima) is a North Korean threat group that uses spear phishing to conduct cyber espionage. https://www.bleepingcomputer.com/news/security/north-korean-hackers-using-chrome-extensions-to-steal-gmail-emails/
North Korean threat actor APT43 pivots back to strategic cyber espionage https://www.csoonline.com/article/3692288/north-korean-threat-actor-apt43-pivots-back-to-strategic-cyberespionage.html
Chinese Hackers Targeting Security and Network Appliances https://www.healthcareinfosecurity.com/chinese-hackers-targeting-security-network-appliances-a-21467

Threat Actor Trends

BianLian has shifted its focus to extortion, seemingly because of Avast’s release of a decryption tool that allowed a victim of the ransomware gang to decrypt and recover their files without paying any ransom. https://www.csoonline.com/article/3691130/bianlian-ransomware-group-shifts-focus-to-extortion.html
Office of the Director of National Intelligence highlights cyber threats in 2023 Intelligence Threat Assessment. CISOs everywhere should pay attention when ODNI outlines cybersecurity threats coming from nation-states and independent groups around the world. https://www.csoonline.com/article/3691619/office-of-the-director-of-national-intelligence-highlights-cyber-threats-in-2023-intelligence-threa.html
It's Raining Zero-Days in Cyberspace. Chinese Hackers and Others Increasingly Favor Unpatched Vulnerabilities https://www.databreachtoday.com/its-raining-zero-days-in-cyberspace-a-21472
Attacks involving data theft nearly doubled and harassment spiked 20 times by late 2022 - Palo Alto Networks Unit 42

Webinars

Water ISAC - Special Web Briefing - What You Need to Know: EPA’s New Operational Technology Cybersecurity Requirement to Help PWSs https://www.waterisac.org/event/special-web-briefing-what-you-need-know-epa%E2%80%99s-new-operational-technology-cybersecurity

Emerging Threats

CISOs need a plan for handling generative AI risks https://www.navex.com/blog/article/how-cisos-can-start-talking-about-chatgpt/

Tools

Introducing Microsoft Security Copilot: The AI-Powered Security Solution for the Modern Era https://www.learnsecurity.org/single-post/introducing-microsoft-security-copilot-the-ai-powered-security-solution-for-the-modern-era
Free AI Programs Prone to Security Risks, Researchers Say. The task of finding bugs in AI models is in its infancy, but one company is offering a free scanner to help. https://www.bloomberg.com/news/articles/2023-03-29/free-ai-programs-prone-to-security-risks-researchers-say

Fines

This is a new potential cost and risk related to disclosing misleading information about a data breach or ransomware attack. Blackbaud to Pay $3M for Misleading Ransomware Attack Disclosure. To settle the SEC's charges (but without confirming or denying the SEC's findings), Blackbaud has agreed to pay a $3 million civil penalty for failing to disclose the full scope of the cyber-attack. "Public companies have an obligation to provide their investors with accurate and timely material information; Blackbaud failed to do so." David Hirsch, the head of the SEC Enforcement Division's Crypto Assets and Cyber Unit. https://www.bleepingcomputer.com/news/security/blackbaud-to-pay-3m-for-misleading-ransomware-attack-disclosure/
The Securities and Exchange Commission found in recent examinations that some advisors had inadequate compliance policies and procedures, according to a risk alert released Monday. For instance, advisors used off-the-shelf compliance programs that were not tailored to their businesses or risks, or they outsourced compliance functions without assessing how third parties were performing them. They also allocated too few resources to compliance. https://www.investmentnews.com/sec-faults-new-advisors-for-compliance-shortcomings-235657

Resources

Space ISAC Stands Up Operational Watch Center to Keep Pace With Proliferating Threats to Space Systems https://cyber-center.org/s-isac-stands-up-watch-center/
NIST launches Trustworthy and Responsible AI Resource Center (AIRC) https://airc.nist.gov

Cyber Risk is Enterprise Risk

For IT to function better, the business side of the company has to get more involved. https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights/businesss-its-not-my-problem-it-problem
It's time to minimize silos and increase collaboration https://venturebeat.com/enterprise-analytics/5-ways-to-foster-data-transparency-and-collaboration-in-divided-departments/
Cybersecurity gets another up boost in the Federal government. Previewing the DOD's newest cyber position. https://defensescoop.com/2023/03/30/forthcoming-assistant-secretary-for-cyber-position-at-dod-could-encompass-electronic-warfare-and-information-warfare/

Privacy

California’s Office of Administrative Law OKs Privacy Regulations https://www.insurancejournal.com/news/west/2023/03/31/714528.htm
In California, a statewide ban blocking use of facial recognition on body cam footage has expired. Now several assemblymembers say they don’t want a new ban — instead, they’d rather create restrictions to curtail inaccurate arrests. https://www.govtech.com/public-safety/california-hears-bid-to-re-ban-police-facial-recognition-tech