CyberWednesday: Top 10 Cybersecurity Updates #10

This week we delve into the critical events that continue to shape the cybersecurity landscape. From disruptive mergers and advanced malware attacking critical infrastructure to high-speed API attacks and new regulatory measures, these stories offer important insights for businesses. Read our detailed analysis to stay up to date and ahead of threats.

1. Iran-Linked IOCONTROL Malware Targets SCADA and IoT Platforms

Iranian state-sponsored hackers have unveiled IOCONTROL, a highly sophisticated malware targeting IoT and SCADA systems in the U.S. and Israel. This advanced malware exploits vulnerabilities in embedded Linux devices, including IP cameras, routers, PLCs, and other critical OT components. IOCONTROL leverages the MQTT protocol for encrypted command-and-control communications, enabling attackers to execute arbitrary commands, perform lateral movement, and disrupt vital operations.

Significant incidents have been observed in water utilities and fuel management systems, where attackers have exploited default configurations and exposed interfaces. One targeted device, Gasboy’s fuel control system, suffered malware infiltration that allowed attackers to manipulate payment systems and potentially steal sensitive customer data.

The malware’s modular design makes it versatile, allowing deployment across a wide range of devices. This underscores the increasing vulnerability of operational technology (OT) systems to cyber threats. Organisations managing critical infrastructure must adopt stronger segmentation, patch exposed systems promptly, and implement advanced monitoring solutions.

(Source: The Hacker News)

2. Researchers Crack Microsoft Azure MFA in an Hour

A significant vulnerability in Microsoft Azure’s multifactor authentication (MFA) system was discovered, allowing researchers to bypass authentication in under 60 minutes. The flaw arose from the absence of a rate limit for failed MFA attempts, enabling attackers to rapidly exhaust potential combinations of six-digit codes. This exploit, dubbed "AuthQuake," was further facilitated by an extended validity period for MFA codes, providing attackers additional time to succeed.

Researchers demonstrated that the vulnerability allowed unauthorised access to sensitive Microsoft 365 assets, including Outlook emails, OneDrive files, and Teams chats. In some cases, account holders received no notifications of these attempts, making the attack low-profile and difficult to detect.

Microsoft has since implemented stricter rate-limiting measures and reduced the timeframe for valid MFA codes to mitigate risks. This incident emphasises the importance of securing MFA systems, monitoring suspicious login attempts, and employing additional behavioural analytics to protect sensitive accounts.

(Source: DarkReading.com)

3. Germany Sinkholes Botnet of 30,000 BadBox-Infected Devices

Germany’s Federal Office for Information Security (BSI) dismantled a botnet of 30,000 devices infected with pre-installed BadBox malware. These devices, including photo frames and streaming gadgets, were shipped with outdated Android software, making them susceptible to exploitation. The malware was used for ad fraud and as a proxy network for malicious activities.

The BSI redirected traffic from the botnet to a sinkhole and partnered with internet providers to notify affected consumers. This incident serves as a stark reminder of the dangers posed by insecure supply chains, especially in IoT devices.

(Source: Securityweek.com)

4. Security Researchers Set API Honeypot to Dupe Hackers

Cybersecurity firm Wallarm recently conducted a honeypot experiment, deploying fake APIs to observe attack behaviours. The findings were startling: within 29 seconds of deployment, the APIs began receiving malicious traffic. The attacks targeted common endpoints such as /status, /info, and /metrics, demonstrating how quickly hackers exploit exposed APIs.

Port 80 emerged as the most frequently targeted, with over 19% of attacks directed there. Interestingly, the study revealed that APIs have surpassed traditional web applications in popularity as an attack surface, reflecting a broader trend in cybercrime.

The results underscore the importance of securing APIs with robust authentication, endpoint protection, and rate-limiting mechanisms. By adopting these measures and monitoring traffic in real-time, organisations can significantly reduce the risk of API exploitation.

(Source: ITPro.com)

5. Android Zero-Day Exploited in Spyware Campaigns

Amnesty International exposed a spyware campaign targeting journalists in Serbia, leveraging a zero-day vulnerability in Android devices. The malware, dubbed NoviSpy, was linked to Cellebrite forensic tools, raising ethical concerns over their use in unauthorised surveillance.

The spyware enabled attackers to bypass encryption, extract sensitive information, and activate device cameras and microphones. This campaign reinforces the urgent need for organisations to enforce strict device policies, educate users on potential risks, and ensure timely updates to patch known vulnerabilities.

(Source: Securityweek.com)

6. CISA Issues Best Practices to Secure Microsoft 365 Cloud Environments

The Cybersecurity and Infrastructure Security Agency (CISA) has introduced Binding Operational Directive (BOD) 25-01, which mandates enhanced security measures for Microsoft 365 environments. These measures include the use of the SCuBA assessment tool to ensure compliance with Secure Configuration Baselines (SCBs).

The initiative, while targeted at US federal agencies, offers valuable insights for enterprises globally. Organisations can adopt these practices to address common cloud misconfigurations, reduce attack surfaces, and enhance overall resilience against advanced threats.

(Source: cybersecuritynews.com)

7. Apple Pushes Major iOS and macOS Security Updates

Apple has released critical updates for iOS 18.2 and macOS Sequoia 15.2, addressing vulnerabilities in components like the kernel, WebKit, and ImageIO. These flaws, if exploited, could lead to data leakage, sandbox escapes, or arbitrary code execution.

Given the widespread use of Apple devices in enterprise environments, IT teams must prioritise applying these patches to mitigate potential risks. This development highlights the importance of maintaining a robust patch management strategy.

(Source: Securityweek.com)

8. Arctic Wolf Acquires Cylance Endpoint Security for $160M

Arctic Wolf has acquired Cylance from BlackBerry in a $160M deal aimed at enhancing its endpoint security offerings. This acquisition strengthens Arctic Wolf’s Aurora platform by integrating AI-driven capabilities for more comprehensive threat detection and response.

The move reflects the growing demand for unified security solutions capable of addressing modern enterprise threats. Organisations are encouraged to explore such integrated platforms to streamline security operations and bolster cyber defences.

(Source: Securityweek.com)

9. Cohesity Completes Merger with Veritas, Becoming Largest Data Protection Software Provider

Cohesity has successfully merged with Veritas, forming the world’s largest provider of data protection software. The $7 billion acquisition brings together Cohesity’s advanced AI and security capabilities with Veritas’ extensive workload support and global footprint. The combined company now serves over 12,000 customers, including 85 Fortune 100 enterprises and nearly 70% of the Global 500.

This merger enhances Cohesity’s ability to provide advanced cyber resilience tools, multicloud support, and generative AI-driven insights into enterprise data. As cyber threats grow in scale and complexity, this collaboration aims to deliver industry-leading solutions to safeguard sensitive information and improve operational efficiency.

For enterprises, this development signifies an expanded range of tools to address challenges in data protection, ransomware recovery, and compliance, all while leveraging next-generation AI capabilities.

(Source: Securitybrief.asia)

10. Cyberattack Disrupts Canadian Business Unit of LKQ Corporation

LKQ Corporation, a leading provider of auto parts with operations spanning 1,600 locations worldwide, recently disclosed a cyberattack targeting its Canadian business unit. The incident, reported to the SEC, highlights ongoing cybersecurity challenges for multinational corporations.

The attack, detected on November 13, caused operational disruptions for several weeks. Although LKQ states that the financial impact is not expected to be significant, the event underscores the vulnerabilities inherent in decentralised IT systems. The corporation has since restored near-full operational capacity and is working with cybersecurity insurers to recover associated costs.

While the nature of the attack remains unclear, no known ransomware groups have claimed responsibility. This raises questions about the evolving tactics of cybercriminals and the resilience of corporate IT infrastructures against sophisticated threats.

(Source: Securityweek.com)