VECKOBREV

I veckan har MSB:s årsrapport för föregående års it-incidentrapportering släppts. Till skillnad från tidigare år, där majoriteten av de rapporterade it-incidenterna har berott på systemfel och misstag, vår cyberangrepp den vanligaste orsaken 2023. Ökningen av cyberangrepp kopplas till att fler överbelastningsangrepp rapporterades under första halvan av året. I veckan har det även varit patchtisdag, så se till att era system är uppdaterade. Veckobrevet bjuder dessutom på en hel del spännande fördjupande artiklar, så som Brittish Librarys utvärdering av sin tidigare incident.

Nyheter i veckan

Attack wrangles thousands of web users into a password-cracking botnet (7 mar)https://arstechnica.com/security/2024/03/attack-wrangles-thousands-of-web-users-into-a-password-cracking-botnet/

Update on Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard (8 mar)https://msrc.microsoft.com/blog/2024/03/update-on-microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/

CISA forced to take two systems offline last month after Ivanti compromise (8 mar)https://therecord.media/cisa-takes-two-systems-offline-following-ivanti-compromise

Incognito Darknet Market Mass-Extorts Buyers, Sellers (11 mar)https://krebsonsecurity.com/2024/03/incognito-darknet-market-mass-extorts-buyers-sellers/

Belgian village whose brewery was hit by cyberattack faces another on its coffee roastery (11 mar)https://therecord.media/koffie-beyers-cyberattack-coffee-roaster-duvel-belgium

Franska myndigheter utsatta för it-attack (11 mar)https://www.aftonbladet.se/nyheter/a/Rr77qd/aftonbladet-direkt?pinnedEntry=1226344

New network code on cybersecurity for EU electricity sector (11 mar)https://energy.ec.europa.eu/news/new-network-code-cybersecurity-eu-electricity-sector-2024-03-11_en

Over 12 million auth secrets and keys leaked on GitHub in 2023 (12 mar)https://www.bleepingcomputer.com/news/security/over-12-million-auth-secrets-and-keys-leaked-on-github-in-2023/

Sophiahemmet betalar inte lösensumma till hackarna (12 mar)https://www.mitti.se/nyheter/sophiahemmet-betalar-inte-losensumma-till-hackarna-6.3.209636.d86253e919

Fastighetsbolaget Örebroporten utsatt för dataintrång (12 mar)https://www.svt.se/nyheter/lokalt/orebro/fastighetsbolaget-orebroporten-utsatt-for-dataintrang

Cyberattack on U.S. health care system could be biggest in sector’s history (12 mar)https://www.youtube.com/watch?v=g1daKX_eke8

Förbättringar i välfärdens informationssäkerhetsarbete (12 mar)https://skr.se/skr/tjanster/pressrum/nyheter/nyhetsarkiv/forbattringarivalfardensinformationssakerhetsarbete.79730.html

Så förbereder du dig mot cyberattacker (12 mar)https://www.svt.se/nyheter/inrikes/sa-forbereder-du-dig-for-cyberattacker

Expert varnar för AI inför EU-valet: Har inte rätt verktyg (13 mar)https://sverigesradio.se/artikel/expert-varnar-for-ai-infor-eu-valet-har-inte-ratt-verktyg

Stanford University Hacked – Attackers Breached The Internal Network (13 mar)https://cybersecuritynews.com/stanford-university-hacked/

Tidigare Must-chef ska utreda cyberattack (13 mar)https://tt.omni.se/tidigare-must-chef-ska-utreda-cyberattack/a/Q7nljR

Alert: Cybercriminals Deploying VCURMS and STRRAT Trojans via AWS and GitHub (13 mar)https://thehackernews.com/2024/03/alert-cybercriminals-deploying-vcurms.html

Antalet cyberangrepp ökade kraftigt 2023 (14 mar)https://www.svt.se/nyheter/inrikes/antalet-cyberangrepp-okade-kraftigt-2023.. Antalet cyberangrepp ökade kraftigt under 2023 (14 mar)https://www.msb.se/sv/aktuellt/nyheter/2024/mars/antalet-cyberangrepp-okade-kraftigt-under-2023/

Nissan Hack: 10K+ Users Data Stolen by Hackers (14 mar)https://cybersecuritynews.com/nissan-hack-10k-users-data-stolen-by-hackers/

Stort kabelhaveri stör internet i Afrika (15 mar)https://www.aftonbladet.se/nyheter/a/Rr77qd/aftonbladet-direkt?pinnedEntry=1227609

McDonald’s bekräftar it-haveri – stora problem (15 mar)https://www.svt.se/nyheter/inrikes/problem-pa-mcdonalds-restauranger-stangda

Millions of users may have had data leaked in new French government agency security breach (15 mar)https://www.techradar.com/pro/security/millions-of-users-may-have-had-data-leaked-in-new-french-government-agency-security-breach

Scottish health service says ‘focused and ongoing cyber attack’ may disrupt services (15 mar)https://therecord.media/scottish-nhs-cyberattack-healthcare-dumfries-galloway

Recent Ivanti Vulnerabilities: 4 Lessons Security Leaders Can Learn (15 mar)https://www.informationweek.com/cyber-resilience/recent-ivanti-vulnerabilities-4-lessons-security-leaders-can-learn

Informationssäkerhet och blandat

TA577’s Unusual Attack Chain Leads to NTLM Data Theft (4 mar)https://www.proofpoint.com/us/blog/threat-insight/ta577s-unusual-attack-chain-leads-ntlm-data-theft

LEARNING LESSONS FROM THE CYBER-ATTACK British Library cyber incident review (8 mar)https://www.bl.uk/home/british-library-cyber-incident-review-8-march-2024.pdf

February 2024’s Most Wanted Malware: WordPress Websites Targeted by Fresh FakeUpdates Campaign (11 mar)https://blog.checkpoint.com/research/february-2024s-most-wanted-malware-wordpress-websites-targeted-by-fresh-fakeupdates-campaign/

FakeBat delivered via several active malvertising campaigns (12 mar)https://www.malwarebytes.com/blog/threat-intelligence/2024/03/fakebat-delivered-via-several-active-malvertising-campaigns

The 2024 Sophos Threat Report: Cybercrime on Main Street (12 mar)https://news.sophos.com/en-us/2024/03/12/2024-sophos-threat-report/

Threat actors leverage document publishing sites for ongoing credential and session token theft (13 mar)https://blog.talosintelligence.com/threat-actors-leveraging-document-publishing-sites/

Security Flaws within ChatGPT Ecosystem Allowed Access to Accounts On Third-Party Websites and Sensitive Data (13 mar)https://salt.security/blog/security-flaws-within-chatgpt-extensions-allowed-access-to-accounts-on-third-party-websites-and-sensitive-data

SVG Files Abused in Emerging Campaigns (13 mar)https://cofense.com/blog/svg-files-abused-in-emerging-campaigns/

A patched Windows attack surface is still exploitable (14 mar)https://securelist.com/windows-vulnerabilities/112232/

New email standards: what you need to knowhttps://www.techradar.com/pro/new-email-standards-what-you-need-to-know

CERT-SE i veckan

Microsofts månatliga säkerhetsuppdateringar för mars 2024 (14 mar)https://www.cert.se/2024/03/microsofts-manatliga-sakerhetsuppdateringar-for-mars-2024.html

Adobes månatliga säkerhetsuppdateringar för mars 2024 (14 mar)https://www.cert.se/2024/03/adobes-manatliga-sakerhetsuppdateringar-for-mars-2024.html

SAP:s månatliga säkerhetsuppdateringar för mars 2024 (14 mar)https://www.cert.se/2024/03/saps-manatliga-sakerhetsuppdateringar-for-mars-2024.html

Kritiska sårbarheter i FortiOS, FortiProxy och FortiClientEMS (Uppdaterad 15 mar)https://www.cert.se/2024/03/kritiska-sarbarheter-i-fortios-och-fortiproxy.html

Kritisk sårbarhet i Arcserve UDP (15 mar)https://www.cert.se/2024/03/Kritisk-sarbarhet-i-Arcserve-UDP.html

Kritisk sårbarhet i Juniper Secure Analytics (15 mar)https://www.cert.se/2024/03/Kritisk-sarbarhet-i-juniper-secure-analytics.html