Back in late April, with the world’s media distracted by the COVID-19 pandemic and businesses desperately trying to improve their remote desktop security, a number of cyberattacks in the Middle East showed us what the future of cyberwarfare might be. Continue reading
What’s new this week in the news for MSPs?
Google plans upgrades to improve cloud connectivity; new vulnerability impacts Linux and Windows installations; a new open-source tool from CyberArk to identify shadow admin accounts in MS Azure and AWS; new Ensiko malware aimed at Windows, macOS and Linux web servers; and Emotet malware has a new email-attachment-stealing feature. Let’s see what it’s all about.
What’s in the news this week for MSPs?
More security features coming to Gmail and G Suite; Orange S.A. suffers ransomware attack with data stolen; Emotet botnet rapidly spreading QuakBot malware; Netwalker ransomware strikes Lorien Health Services; GEDmatch the DNA matching service suffers a data breach; and hackers compromise Twilio’s TaskRouter JS SDK. Let’s see what it’s all about.
What’s new this week in the news for MSPs? Google launches data analyzer BigQuery Omni; Assured Workloads for Government by Google Started; Confidential VMs Available from Google; GoldenHelper malware in official Chinese tax software; AgeLocker ransomware discovered to use Google encryption tool; and Collabera hit in Maze ransomware attack.
Back in late April, with the world’s media distracted by the COVID-19 pandemic and businesses desperately trying to improve their remote desktop security, a number of cyberattacks in the Middle East showed us what the future of cyberwarfare might be. Continue reading
What’s new this week in the news for MSPs?
Amazon launches AWS Outposts support for its Relational Database Service; ransomware used by hackers to attack and threaten victims for GDPR breaches is targeting MongoDB users; MSP Xchanging suffers ransomware attack; Office 365 users hit by phishing attacks through OAuth apps; and more. Let’s see what it’s all about.
As an MSP, you should always be on the lookout for ways to align your managed service offerings more closely with customer demand. Expanding your knowledge of Linux and related platforms may be a good way to do this. Continue reading
What's new this week in the news for MSPs?
App2Container tool by Amazon makes its debut; many US websites hit in WastedLocker ransomware attacks; Maze ransomware allegedly strikes Xerox; and, new Thiefquest data wiper using ransomware in its attacks. Let's see what it's all about.
What's new this week in the news for MSPs?
Nutanix introduces new services to help pandemic-affected companies; AWS launches Amazon Honeycode; Maze ransomware allegedly strikes LG Electronics; newcomer WastedLocker ransomware leveraging fake program updates; and CLOP Ransomware hits Indiabulls group. Let's see what it's all about.
Before we talk about Azure PowerShell vs Azure CLI, first of all, we need a bit of background. Both are available in the Azure cloud or you can use them remotely from your workstation. On your workstation, you will have to install a module, which we will explain later, but both are available in Azure Cloud Shell. Azure CLI is short for the Azure command-line interface. Continue reading
What's new this week in the news for MSPs?
Google launches a new cloud file storage tier; AWS adds a new data migration device; AWS solves a 2.3 Tbps DDOS attack; fake data breach notification malware caught by Google; and Black Kingdom ransomware hack manipulating Pulse VPN flaws.
Let's see what it's all about.
Google has announced the launch of its new product Filestore High Scale, a cloud-based file storage tier for businesses operating high-performance computing workloads. It is said to be the next step in the development of Google's Cloud Filestore service.
With Filestore High Scale, Google has integrated the capabilities of data storage startup Elastifile Ltd., which it acquired in July 2019. The new tier lets users send shared file systems that can expand to a capacity that permits hundreds of thousands of input/output operations per second, with tens of gigabytes per second throughput and hundreds of terabytes.
Google said that other workloads that may benefit from Filestore High Scale's scale-out storage are electronic design automation, financial modeling, genomics, and video processing.
AWS Snowcone is a new device added by Amazon to its family of data migration devices. This device is small and very portable, weighing only 4.5 pounds and measuring just nine by six by three inches. It provides up to 8 terabytes of storage for businesses using edge computing workloads, where space, power, and cooling features are limited.
AWS Snowcone operates on two central processing units. It has 4 gigabytes of memory for computing operations, a USB-C connection, and an optional battery unit.
In a blog post, Amazon Chief Evangelist Jeff Barr shared that Snowcone's primary objective is data migration, “Internet of Things,” transportation, content distribution and tactical edge computing, logistics, and autonomous vehicles use cases. What's more, the device is tamper-proof, dust-tight, water-resistant, and can transfer data using the AWS DataSync service.
AWS Snowcone will be available first in the AWS East (Northern Virginia) and AWS West (Oregon) regions, and additional regions will be added soon.
Amazon Web Service reported that it was able to diminish a distributed denial-of-service attack of 2.3 terabits per second in February. It is the most massive DDoS attack on record to date. According to the details given in the AWS Shield Threat Landscape Report- Q1 2020, this attack continued for three days. Those behind the attack failed to knock Amazon cloud services offline.
The method used is the so-called Connection-less Lightweight Directory Access Protocol reflection-based attack. In this type of attack, the attacker sends a CLDAP request to an LDAP server with a spoofed sender IP address — the target's IP address. The server then mounts a bulked-up response to the target's IP address, causing the reflection attack, hence the name.
The server is unaware of the attack when it receives multiple, apparently legitimate requests to establish communication, according to Imperva. From each open port, it answers each attempt with an SYN-ACK packet. This will eventually cause the server's connection overflow tables to flood and genuine clients will be denied access.
To distribute malware and scams, bad actors have begun pushing fake notices about data breaches at big company names. These direct people to risky websites. The groups behind them are mixing Google Sites, black SEO, and spam pages.
Google Alerts, which uses predefined terms set by users to monitor search results, has helped in the spread of these false notifications. Some companies found in the notifications include Dropbox, Hulu, Ceridian, Shein, PayPal, Target, Chegg, EA, Canva, HauteLook, Mojang, InterContinental Hotels Group, and Houzz. These companies have suffered a data breach at some point in the past.
If a user follows any of these links picked up by Google Alerts, they find themselves on landing on pages with download offers for undesired extensions and malware, and fake giveaways.
Aside from using compromised websites, these groups also make their own pages. In many instances, they have used Google Sites to host their content.
A fake giveaway of iPhone 11 devices was one of the malicious links used as a redirect, claiming to have been set up by Google for its “Membership Rewards” program.
Using spam pages to redirect users to pages that pose a risk is not new; this is just the latest example by a malware group.
Businesses with unpatched Pulse Secure VPN software or initial access on the network are the target of the operators of the Black Kingdom ransomware. The malware was captured in a honeypot computer system that let security researchers examine and document its methods of operation.
A Pulse Secure VPN (CVE-2019-11510) critical vulnerability affecting earlier versions of its software was leveraged by the malware operators.
Researchers noted that the ransomware built endurance by mimicking a legitimate scheduled task for Google Chrome. According to REDTEAM.PL's analysis, it's likely that a scheduled task runs base64-encoded string code in a hidden PowerShell window to get a script named “reverse.ps1”, and then opens a reverse shell on the infected host.
Security researcher GrujaRS first spotted Black Kingdom ransomware in February, when it appeared to have appended a .DEMON extension to encrypted files.
The sample examined communicated with the same IP address seen in REDTEAM.PL's report. The ransom note sought $10,000, to be deposited to a bitcoin wallet, and threatened that failure to do so would lead to the data being destroyed or sold.
Learn about common ransomware attack scenarios and what to do if one of these attacks affects your clients:
Further reading Ransomware Attack Scenarios
I hope this update has been helpful. MSP360 is your resource for MSP news. Stay home, stay safe and healthy, and remember to check back next week for more highlights.
