{"id":42492,"date":"2020-07-17T20:16:53","date_gmt":"2020-07-17T16:16:53","guid":{"rendered":"https:\/\/www.msp360.com\/resources\/?p=42492"},"modified":"2020-07-17T20:17:28","modified_gmt":"2020-07-17T16:17:28","slug":"news-you-mightve-missed-13-17-july","status":"publish","type":"post","link":"https:\/\/www.msp360.com\/resources\/blog\/news-you-mightve-missed-13-17-july\/","title":{"rendered":"News You Might&#8217;ve Missed. 13-17 July"},"content":{"rendered":"<p>What\u2019s new this week in the news for MSPs? Google launches data analyzer BigQuery Omni; Assured Workloads for Government by Google Started; Confidential VMs Available from Google; GoldenHelper malware in official Chinese tax software; AgeLocker ransomware discovered to use Google encryption tool; and Collabera hit in Maze ransomware attack.<\/p>\n<p><!--more--><\/p>\n<p>Let\u2019s see what it\u2019s all about.<\/p>\n<h2>Google Launches Data Analyzer BigQuery Omni<\/h2>\n<p>Google LLC has made available its new service <a href=\"https:\/\/cloud.google.com\/blog\/products\/data-analytics\/introducing-bigquery-omni\" target=\"\u201c_blank\u201d\" rel=\"\u201cnoopener\u201d noopener noreferrer\">called BigQuery Omni<\/a>, as they announced this week. It brings Google\u2019s BigQuery data warehouse and analytics tool capabilities to additional cloud platforms like AWS, and it will be coming soon for Microsoft Azure.<\/p>\n<p>Google BigQuery is a fully managed serverless data warehouse that allows rapid Structured Query Language queries that include interactive analysis of massive datasets.<br \/>\nBigQuery Omni addresses the problem that companies using multiple public clouds face in analyzing their data effectively.<\/p>\n<h2>Assured Workloads for Government by Google Started<\/h2>\n<p>Compliance and security around data locality and access are critical factors for government users in cloud technologies, as Google Cloud product managers Christopher Johnson and Bhavna Batra recently discussed in a blog post.<\/p>\n<p><a href=\"https:\/\/siliconangle.com\/2020\/07\/14\/google-eases-compliance-concerns-assured-workloads-government\/\" target=\"\u201c_blank\u201d\" rel=\"\u201cnoopener\u201d noopener noreferrer\">Assured Workloads for Government<\/a>, a new tier of cloud computing for government agencies, was developed to solve this problem and is now available in private beta.<br \/>\nThe new service was announced at Google Cloud Next OnAir online conference, which runs for nine weeks until September 8th.<\/p>\n<p>Assured Workloads for Government provides access to Google\u2019s full suite of cloud services, using enhanced features to ensure they meet the government\u2019s highest compliance and security standards.<\/p>\n<h2>Confidential VMs Available From Google<\/h2>\n<p>The Confidential VMs product was detailed at the Google Cloud Next OnAir online conference and <a href=\"https:\/\/siliconangle.com\/2020\/07\/14\/google-debuts-confidential-vms-keep-data-encrypted-use\/\" target=\"\u201c_blank\u201d\" rel=\"\u201cnoopener\u201d noopener noreferrer\">is now available in beta test mode<\/a>. Google\u2019s Confidential Computing portfolio of services is new tech that maintains data in an encrypted state while being processed in memory. That means it isn\u2019t exposed to other parts of the computer system at that time, and Confidential VMs is the first product in this new portfolio.<br \/>\nGoogle\u2019s Confidential VMs product is based in part on its work with the Confidential Computing Consortium.<\/p>\n<p>Google is saying Confidential VMs will ensure that data remains encrypted no matter whetherit\u2019s being used for analytics workloads, queries, or for training artificial intelligence models. The new VMs are a boon for any company using sensitive data. Still, Google believes that they will be of particular interest to clients in regulated sectors, like finance, for example.<\/p>\n<h2>GoldenHelper Malware in Official Chinese Tax Software<\/h2>\n<p id=\"last\">Golden Tax invoicing software, part of the Chinese government\u2019s Golden Tax project, is coming with an extra payload, according to Trustwave SpiderLabs, which is a new backdoor called <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/new-goldenhelper-malware-found-in-official-chinese-tax-software\/\" target=\"\u201c_blank\u201d\" rel=\"\u201cnoopener\u201d noopener noreferrer\">GoldenHelper<\/a>. Before this, Trustwave discovered the GoldenSpy backdoor concealed in the Intelligent Tax application that businesses need for Chinese bank connections.<\/p>\n<div id=\"slidebox\"><a class=\"close\">\u00a0<\/a><!--HubSpot Call-to-Action Code --><span class=\"hs-cta-wrapper hs-cta-deferred\" id=\"hs-cta-wrapper-4a146d91-d63d-4e82-9aab-1f5f0c43f780\" data-portal=\"5442029\" data-id=\"4a146d91-d63d-4e82-9aab-1f5f0c43f780\"><span class=\"hs-cta-node hs-cta-4a146d91-d63d-4e82-9aab-1f5f0c43f780\" id=\"hs-cta-4a146d91-d63d-4e82-9aab-1f5f0c43f780\"><!--[if lte IE 8]><div id=\"hs-cta-ie-element\"><\/div><![endif]--><a href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/5442029\/4a146d91-d63d-4e82-9aab-1f5f0c43f780\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"hs-cta-img\" id=\"hs-cta-img-4a146d91-d63d-4e82-9aab-1f5f0c43f780\" style=\"border-width:0px;\" src=\"https:\/\/no-cache.hubspot.com\/cta\/default\/5442029\/4a146d91-d63d-4e82-9aab-1f5f0c43f780.png\" alt=\"CTA\"><\/a><\/span><\/span><!-- end HubSpot Call-to-Action Code --><\/div>\n<p>While the GoldenHelper backdoor differs entirely from GoldenSpy, the delivery process is similar. The backdoor is also used to get access to the systems of international businesses in China.<\/p>\n<p>Researches have found that the GoldenHelper campaign whichcirculated the malware had been in operation from January 2018 to July 2019. In April 2020, the GoldenSpy campaign followed.<br \/>\n\u201cGoldenHelper malware utilizes sophisticated techniques to hide its delivery, presence, and activity,\u201d Trustwave explained.<\/p>\n<p>GoldenHelper has multiple suspicious features, which include:<\/p>\n<ul>\n<li>Installing or upgrading to system-level access (UAC bypass) doesn\u2019t need the user\u2019s permission<\/li>\n<li>Filenames are created randomly(obfuscation)<\/li>\n<li>It uses a timestamp for \u201cLast write\u201d and \u201cCreation\u201d (timestamping)<br \/>\nUsing .jpg, .gif, .zip bogus filenames, it tries to download executable files (obfuscation)<\/li>\n<li>Management of locations of what to download and where to put it is based on DNS resolution (DNS control), where the malware uses hardcoded logic<\/li>\n<\/ul>\n<p>The security threat posed remains, because it can\u2019t be determined if it\u2019s still operational, even if the GoldenHelper campaign isn\u2019t active anymore.<\/p>\n<div class=\"call-to-action\">\n<div class=\"call-to-action__left\">\n<div class=\"call-to-action__tag\">ON-DEMAND WEBINAR<\/div>\n<div class=\"call-to-action__title\">Ransomware: Prevent or Recover<\/div>\n<div class=\"call-to-action__text\">Watch the webinar and prepare yourself and your customers with the right approach and the right tools<\/div>\n<!--HubSpot Call-to-Action Code --><span class=\"hs-cta-wrapper hs-cta-deferred\" id=\"hs-cta-wrapper-dcb611f1-612b-448d-8afd-7e3fea1fccc0\" data-portal=\"5442029\" data-id=\"dcb611f1-612b-448d-8afd-7e3fea1fccc0\"><span class=\"hs-cta-node hs-cta-dcb611f1-612b-448d-8afd-7e3fea1fccc0\" id=\"hs-cta-dcb611f1-612b-448d-8afd-7e3fea1fccc0\"><!--[if lte IE 8]><div id=\"hs-cta-ie-element\"><\/div><![endif]--><a href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/5442029\/dcb611f1-612b-448d-8afd-7e3fea1fccc0\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"hs-cta-img\" id=\"hs-cta-img-dcb611f1-612b-448d-8afd-7e3fea1fccc0\" style=\"border-width:0px;\" src=\"https:\/\/no-cache.hubspot.com\/cta\/default\/5442029\/dcb611f1-612b-448d-8afd-7e3fea1fccc0.png\" alt=\"CTA\"><\/a><\/span><\/span><!-- end HubSpot Call-to-Action Code -->\n<\/div>\n<div class=\"call-to-action__right\"><img decoding=\"async\" style=\"max-width: 300px;\" src=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2020\/03\/Ransomware_-Prevent-or-Recover-1.png\" alt=\"Webinar icon\" \/><\/div>\n<\/div>\n<h2>AgeLocker Ransomware Discovered to Use Google Encryption Tool<\/h2>\n<p>The Age encryption tool created by a Google employee is being used by a new and targeted <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/new-agelocker-ransomware-uses-googlers-utility-to-encrypt-files\/\" target=\"\u201c_blank\u201d\" rel=\"\u201cnoopener\u201d noopener noreferrer\">ransomware named AgeLocker<\/a> to encrypt victims\u2019 files. A consultant recently created a topic in online forums about new ransomware used in an attack against their client. When they reviewed the encrypted files, they found that a text header was added to each file that starts with the URL \u201cage-encryption.org\u201d.<\/p>\n<p>The URL takes you to a repository on GitHub for an encryption utility called Age, created by Filippo Valsorda, cryptographer and Go security lead at Google.<\/p>\n<p>The threat actors behind AgeLocker are using the Age command-line tool to encrypt a victim\u2019s files, instead of encryption algorithms like AES+RSA.<\/p>\n<p>While it hasn\u2019t been determined how the threat actors are getting access to their victims\u2019 computers, once they do, they use the Age encryption tool to encrypt the victim\u2019s files. A custom extension created with the victim\u2019s initials is appended to each encrypted filename while encrypting the data.<\/p>\n<p>Threat actors ask for seven bitcoins, the equivalent of approximately $64,500, to decrypt the files.<\/p>\n<h2>Collabera Hit in Maze Ransomware Attack<\/h2>\n<p>A Maze ransomware attack against IT staffing firm Collabera was successfully launched by cyber attackers, <a href=\"https:\/\/www.theregister.com\/2020\/07\/14\/collabera_ransomware\/\" target=\"\u201c_blank\u201d\" rel=\"\u201cnoopener\u201d noopener noreferrer\">according to The Register<\/a>.<\/p>\n<p>In the attack, the hackers used Maze to access Collabera employees\u2019 names, addresses and other personal information, and infect its systems.<\/p>\n<p>Collabera identified the malware on its network on June 8th and restored access to its backup files while investigating the nature and extent of the incident.<\/p>\n<p>In response to the attack, Collabera is offering two years of Experian credit and identity monitoring services to its staff. It has also advised employees to review their bank, credit card, and other financial statements and report any suspicious transactions or fraudulent activities.<\/p>\n<p>Maze infects a system, encrypts its files and demands a ransom to recover the files, according to cybersecurity company McAfee. What\u2019s more, if a Maze victim does not make the payment, the cyber-attackers will release the victim\u2019s stolen information.<\/p>\n<blockquote><p>Learn about common ransomware attack scenarios and what to do if one of these attacks affects your clients:<\/p>\n<p><span class=\"further-reading \">Further reading<\/span> <a href=\"https:\/\/www.msp360.com\/resources\/blog\/ransomware-attack-scenarios-and-how-to-be-protected\/\">Ransomware Attack Scenarios<\/a><\/p><\/blockquote>\n<h2>That\u2019s a Wrap<\/h2>\n<p>I hope this update has been helpful. MSP360 is your resource for MSP news. Stay home, stay safe and healthy, and remember to check back next week for more highlights.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>What\u2019s new this week in the news for MSPs? Google launches data analyzer BigQuery Omni; Assured Workloads for Government by Google Started; Confidential VMs Available from Google; GoldenHelper malware in official Chinese tax software; AgeLocker ransomware discovered to use Google encryption tool; and Collabera hit in Maze ransomware attack.<\/p>\n","protected":false},"author":84,"featured_media":42494,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[877,885],"tags":[],"class_list":["post-42492","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-articles","category-other"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/42492","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/users\/84"}],"replies":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/comments?post=42492"}],"version-history":[{"count":0,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/42492\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media\/42494"}],"wp:attachment":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media?parent=42492"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/categories?post=42492"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/tags?post=42492"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}