CyberAware UK Weekly Recap: Ransomware Arrest, Microsoft 365 Breach, and a Critical OpenBSD Exploit
This week on CyberAware UK, we took our usual Sunday look back at the stories that matter and the numbers from our partners at DarkWatch.
DarkWatch in numbers
DarkWatch recorded 137,847 captures across 27,464 entities this week, raising 2,688 alerts. There are currently ten active targets on their watch list. Activity from LockBit continued, including the use of an active dark web leak site. We also saw a new ransomware-as-a-service operation starting up — the business model where criminals rent out their tools to others. The pattern is familiar: it's less about new super-viruses and more about criminals selling kits to other criminals.
FBI arrests executive at ransomware negotiation firm
The FBI arrested an executive at a firm that negotiates ransomware payments. It's a reminder that the people offering to help you after an attack aren't always on your side. If you ever need to recover from a ransomware attack, go to a reputable, accredited firm, and don't feel pressured to pay quickly.
Malicious npm package imgdecode
A package called imgdecode on the npm registry hid a loader for shellcode inside a Windows component. This is aimed at software developers rather than home users. If you're not a developer, you can ignore it. If you are, keep your work software updated and only install packages from trusted sources.
ConnectWise credential used to access 173 Microsoft 365 tenants
Hackers used a compromised ConnectWise credential to sign in to 173 Microsoft 365 tenants. ConnectWise is a tool used by IT support companies, so this affects businesses that use managed service providers. If your employer uses an outside IT firm, ask whether they've checked their credentials and turned on multi-factor authentication.
OpenBSD root exploit demonstrated
Researchers showed a root exploit on OpenBSD that chains together a 37-year-old shared-memory bug. It's rated critical by the researchers, but it's not something that hits home computers. It's a reminder for server administrators to patch promptly.
One thing to do this week
Check your important accounts — especially email and banking — and make sure two-step verification is turned on. It's the single best protection against someone using a stolen password.
Related reading