VECKOBREV

Blandade nyheter från veckan som gått. Idag är det många som handlar klappar inför jul och vi vill uppmana alla läsare att vara lite extra vaksamma. Som alltid så är ett erbjudande som är för bra för att vara sant ofta falskt.

Nyheter i veckan

More than 330,000 Medicare recipients affected by MOVEit breach (17 nov)
https://therecord.media/more-than-hundreds-thousands-medicare-moveit…
185,000 Individuals Impacted by MOVEit Hack at Car Parts Giant AutoZone (22 nov)
https://www.securityweek.com/185000-individuals-impacted-by-moveit-hack-at-car-parts-giant-autozone/

Canadian government discloses data breach after contractor hacks (20 nov)
https://www.bleepingcomputer.com/news/security/canadian-government-discloses-data-breach-after-contractor-hacks/

Danska mäklaren EDC utpressas att betala lösensumma för att undvika att 700 000 kunders data publiceras (på danska) (20 nov)
https://finans.dk/erhverv/ECE16613128/edc-afpresses-betal-eller-700000-kunders-data-laegges-paa-internettet/

Greater Paris wastewater agency dealing with cyberattack (20 nov)
https://therecord.media/paris-wastewater-agency-hit-cyberattack

British Library: Employee data leaked in cyber attack (22 nov)
https://www.bbc.com/news/entertainment-arts-67484639

US Cybersecurity Lab Suffers Major Data Breach (21 nov)
https://www.infosecurity-magazine.com/news/us-cybersecurity-lab-major-data/

Hacktivists breach U.S. nuclear research lab, steal employee data (21 nov)
https://www.bleepingcomputer.com/news/security/hacktivists-breach-us-nuclear-research-lab-steal-employee-data/

Kansas officials blame 5-week disruption of court system on “sophisticated foreign cyberattack” (21 nov)
https://apnews.com/article/kansas-courts-cyberattack-hack-network-offline-097a11cfa9de552ec5a9ea49b500d3d6

Svenska kyrkan drabbad av allvarlig it-störning (23 nov)
https://www.svt.se/nyheter/inrikes/svenska-kyrkan-drabbad-av-allvarlig-it-storning–wej89e

Rapporter och analyser

Mitigation Guide: Healthcare and Public Health (HPH) Sector (17 nov)
https://www.cisa.gov/resources-tools/resources/mitigation-guide-healthcare-and-public-health-hph-sector

A deep dive into Phobos ransomware, recently deployed by 8Base group (17 nov)
https://blog.talosintelligence.com/deep-dive-into-phobos-ransomware/

Researchers extract RSA keys from SSH server signing errors (19 nov)
https://www.bleepingcomputer.com/news/security/researchers-extract-rsa-keys-from-ssh-server-signing-errors/

Konni Campaign Distributed Via Malicious Document (20 nov)
https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document

CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits (20 nov)
https://www.trendmicro.com/en_us/research/23/k/cve-2023-46604-exploited-by-kinsing.html

Is this the real life? Is this just fantasy? Caught in a landslide, NoEscape from NCC Group (20 nov)
https://research.nccgroup.com/2023/11/20/is-this-the-real-life-is-this-just-fantasy-caught-in-a-landslide-noescape-from-ncc-group/

The ‘Gram Scam: Meta Phishing Attack Lures Victims via Spoofed Copyright Infringement Policy (20 nov)
https://perception-point.io/blog/the-gram-scam-meta-phishing-attack-lures-victims-via-spoofed-copyright-infringement-policy/

New “Agent Tesla” Variant: Unusual “ZPAQ” Archive Format Delivers Malware (21 nov)
https://www.gdatasoftware.com/blog/2023/11/37822-agent-tesla-zpaq

Navigating the SMB Threat Landscape: Key Insights from Huntress’ SMB Threat Report (21 nov)
https://www.huntress.com/blog/navigating-the-smb-threat-landscape-key-insights-from-huntress-smb-threat-report

PlayCrypt Ransomware-as-a-Service Expands Threat from Script Kiddies and Sophisticated Attackers (21 nov)
https://adlumin.com/post/playcrypt-ransomware-as-a-service-expands-threat-from-script-kiddies-and-sophisticated-attackers/

Digitalisering i vården skapar nya risker (21 nov)
https://www.foi.se/nyheter-och-press/nyheter/2023-11-21-digitalisering-i-varden-skapar-nya-risker.html

StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (21 nov)
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a

A Touch of Pwn – Part I (21 nov)
https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/

Comparative Study Results on Linux and Windows Ransomware Attacks, Exploring Notable Trends and Surge in Attacks on Linux Systems (21 nov)
https://blog.checkpoint.com/security/comparative-study-results-on-linux-and-windows-ransomware-attacks-exploring-notable-trends-and-surge-in-attacks-on-linux-systems/

Atomic Stealer distributed to Mac users via fake browser updates (21 nov)
https://www.malwarebytes.com/blog/threat-intelligence/2023/11/atomic-stealer-distributed-to-mac-users-via-fake-browser-updates

InfectedSlurs Botnet Spreads Mirai via Zero-Days (21 nov)
https://www.akamai.com/blog/security-research/new-rce-botnet-spreads-mirai-via-zero-days

Cyberattackerna allt fler – svenska vården extra utsatt (22 nov)
https://computersweden.idg.se/2.2683/1.780449/cyberattackerna-okar-varden-extra-utsatt

Malware dev says they can revive expired Google auth cookies (21 nov)
https://www.bleepingcomputer.com/news/security/malware-dev-says-they-can-revive-expired-google-auth-cookies/

Informationssäkerhet och blandat

Reflecting on 20 years of Patch Tuesday (17 nov)
https://msrc.microsoft.com/blog/2023/11/reflecting-on-20-years-of-patch-tuesday/

Radioinslag: Angripare riktar in sig mot svenskt näringsliv – vill slå ut verksamhet (20 nov)
https://sverigesradio.se/artikel/angripare-riktar-in-sig-mot-svenskt-naringsliv-vill-sla-ut-verksamhet

Radioinslag: Dålig koll på cybersäkerhet – så kan företag skydda sig (20 nov)
https://sverigesradio.se/avsnitt/dalig-koll-pa-cybersakerhet-sa-kan-foretag-skydda-sig–2

Var vaksam i julhandeln – bedragare lurar med paketbluffar (20 nov)
https://internetstiftelsen.se/nyheter/var-vaksam-i-julhandeln-bedragare-lurar-med-paketbluffar/

EU cybersecurity exercise: foster cooperation, secure free and fair EU elections (21 nov)
https://www.enisa.europa.eu/news/eu-cybersecurity-exercise-foster-cooperation-secure-free-and-fair-eu-elections

Will Quantum Computing change the way we use encryption? (23 nov)
https://betanews.com/2023/11/23/will-quantum-computing-change-the-way-we-use-encryption/

CERT-SE i veckan

Flera sårbarheter i Citrix Netscaler ADC och Netscaler Gateway (uppdaterad 2023-11-20)