{"id":44558,"date":"2020-09-18T16:06:31","date_gmt":"2020-09-18T12:06:31","guid":{"rendered":"https:\/\/www.msp360.com\/resources\/?p=44558"},"modified":"2020-09-18T16:07:12","modified_gmt":"2020-09-18T12:07:12","slug":"news-you-mightve-missed-14-18-sep","status":"publish","type":"post","link":"https:\/\/www.msp360.com\/resources\/blog\/news-you-mightve-missed-14-18-sep\/","title":{"rendered":"News You Might&#8217;ve Missed. 14 &#8211; 18 Sep"},"content":{"rendered":"<p>What's new this week in the news for MSPs? Peculiar Linux malware targeting VoIP switches; universities under new ransomware attacks; SunCrypt ransomware hits University Hospital in NJ; Google Advanced Protection users now get scans for malicious files; and Equinix hit by NetWalker ransomware Let's see what it's all about.<!--more--><\/p>\n<h2>Equinix Hit by NetWalker Ransomware<\/h2>\n<p>Equinix, one of the world\u2019s largest data center providers, <a href=\"https:\/\/www.msspalert.com\/cybersecurity-breaches-and-attacks\/ransomware\/ransomware-attacks-equinix-data-centers-and-managed-services-not-impacted\/\" target=\"_blank\" rel=\"noopener noreferrer\">disclosed a ransomware attack<\/a> on September 9. The malware did not affect Equinix\u2019s data centers, managed services, or customer-facing operations, the company says.<\/p>\n<p>The more significant issue may involve stolen data, as the Netwalker operators demand $4.5 million for the decryptor and for not releasing the stolen information.<\/p>\n<p>Datacenter providers and MSPs remain prime targets for ransomware attacks. Their systems often host or interconnect to many end-customer systems. Stealthy approaches that hide from antivirus tools are often used, according to a report from Huntress Labs.<\/p>\n<p>IT service providers and consulting firms were issued warnings about these ongoing attacks by the US Secret Service and other government agencies. Ransomware threat operators are progressively targeting point-of-sale (POS) systems. They often use business email compromise (BEC) and ransomware attacks to infiltrate networks.<\/p>\n<h2>Google Advanced Protection Users Now Get Scans for Malicious Files<\/h2>\n<p>Seeking to protect high-profile people who are likely to be targeted by online attacks,<br \/>\nGoogle launched its <a href=\"https:\/\/landing.google.com\/advancedprotection\/\" target=\"_blank\" rel=\"noopener noreferrer\">Advanced Protection program<\/a>. It has extra security features in Chrome and is now launching a new one. Those enrolled can send files they are concerned about directly to be scanned by Google\u2019s Safe Browsing malware-detection technology.<\/p>\n<p>The new feature adds to other safeguards available that protect Google accounts for public figures, such as activists, politicians, journalists, and others. Two physical security keys are required to use the Advanced Protection program, with one being a backup.<\/p>\n<h2>Peculiar Linux Malware Targeting VoIP Switches<\/h2>\n<p id=\"last\">Two distinct Voice over IP (VoIP) software switches (softswitches) are the target of some peculiar Linux malware. If compromised, they may allow cybercriminals access to a <a href=\"https:\/\/www.eset.com\/us\/\" target=\"_blank\" rel=\"noopener noreferrer\">user's phone data<\/a>.<br \/>\nAccording to ESET, a Slovakia-based antivirus and firewall vendor, the malware attacks Chinese-made software switches, such as the Linknat VOS2009 and VOS3000.<\/p>\n<div id=\"slidebox\"><a class=\"close\">\u00a0<\/a><!--HubSpot Call-to-Action Code --><span class=\"hs-cta-wrapper hs-cta-deferred\" id=\"hs-cta-wrapper-4a146d91-d63d-4e82-9aab-1f5f0c43f780\" data-portal=\"5442029\" data-id=\"4a146d91-d63d-4e82-9aab-1f5f0c43f780\"><span class=\"hs-cta-node hs-cta-4a146d91-d63d-4e82-9aab-1f5f0c43f780\" id=\"hs-cta-4a146d91-d63d-4e82-9aab-1f5f0c43f780\"><!--[if lte IE 8]><div id=\"hs-cta-ie-element\"><\/div><![endif]--><a href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/5442029\/4a146d91-d63d-4e82-9aab-1f5f0c43f780\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"hs-cta-img\" id=\"hs-cta-img-4a146d91-d63d-4e82-9aab-1f5f0c43f780\" style=\"border-width:0px;\" src=\"https:\/\/no-cache.hubspot.com\/cta\/default\/5442029\/4a146d91-d63d-4e82-9aab-1f5f0c43f780.png\" alt=\"CTA\"><\/a><\/span><\/span><!-- end HubSpot Call-to-Action Code --><\/div>\n<p>A softswitch that is compromised may allow a cybercriminal to exfiltrate private information. It can include call record details that have attached metadata. For example, the metadata may have caller and callee IP addresses, fees, other data, and the call's starting time and duration.<br \/>\nIn order to steal the metadata, the malware queries internal MySQL databases that are used by the softswitch.<\/p>\n<p>Currently, it is not known how the malware is being deployed. It is assumed that the hackers are possibly exploiting a vulnerability or using a brute-force attack.<\/p>\n<div class=\"call-to-action\">\n<div class=\"call-to-action__left\">\n<div class=\"call-to-action__tag\">ON-DEMAND WEBINAR<\/div>\n<div class=\"call-to-action__title\">Ransomware: Prevent or Recover<\/div>\n<div class=\"call-to-action__text\">Watch the webinar and prepare yourself and your customers with the right approach and the right tools<\/div>\n<!--HubSpot Call-to-Action Code --><span class=\"hs-cta-wrapper hs-cta-deferred\" id=\"hs-cta-wrapper-dcb611f1-612b-448d-8afd-7e3fea1fccc0\" data-portal=\"5442029\" data-id=\"dcb611f1-612b-448d-8afd-7e3fea1fccc0\"><span class=\"hs-cta-node hs-cta-dcb611f1-612b-448d-8afd-7e3fea1fccc0\" id=\"hs-cta-dcb611f1-612b-448d-8afd-7e3fea1fccc0\"><!--[if lte IE 8]><div id=\"hs-cta-ie-element\"><\/div><![endif]--><a href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/5442029\/dcb611f1-612b-448d-8afd-7e3fea1fccc0\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"hs-cta-img\" id=\"hs-cta-img-dcb611f1-612b-448d-8afd-7e3fea1fccc0\" style=\"border-width:0px;\" src=\"https:\/\/no-cache.hubspot.com\/cta\/default\/5442029\/dcb611f1-612b-448d-8afd-7e3fea1fccc0.png\" alt=\"CTA\"><\/a><\/span><\/span><!-- end HubSpot Call-to-Action Code -->\n<\/div>\n<div class=\"call-to-action__right\"><img decoding=\"async\" style=\"max-width: 300px;\" src=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2020\/03\/Ransomware_-Prevent-or-Recover-1.png\" alt=\"Webinar icon\" \/><\/div>\n<\/div>\n<h2>Universities Under New Ransomware Attacks<\/h2>\n<p>Academic institutions are being urged to ensure that their networks are resilient enough to protect them against the new string of ransomware attacks making the rounds. This warning was issued by the UK's National Cyber Security Centre (NCSC) \u2013 the cyber arm of GCHQ. It comes following a recent <a href=\"https:\/\/www.zdnet.com\/article\/ransomware-an-executive-guide-to-one-of-the-biggest-menaces-on-the-web\/\" target=\"_blank\" rel=\"noopener noreferrer\">spate of hackers targeting universities during August<\/a>.<\/p>\n<p>The NCSC has already monitored several ransomware attacks against universities, where varying amounts of damage occurred, depending on the level of cybersecurity the institutions had in place.<\/p>\n<p>\"This criminal targeting of the education sector, particularly at such a challenging time, is utterly reprehensible,\" said Paul Chichester, director of operations at the NCSC. Universities have been advised to adopt some new cybersecurity protocols to reduce the severity of ransomware attacks.<\/p>\n<p>These suggestions include securing RDP services with <a href=\"https:\/\/www.msp360.com\/resources\/blog\/mfa-for-msps\/\">multi-factor authentication<\/a>, effective vulnerability management, <a href=\"https:\/\/www.msp360.com\/resources\/blog\/windows-patch-management-best-practices\/\">patching<\/a>, installing <a href=\"https:\/\/www.msp360.com\/resources\/blog\/top-5-antivirus-solutions-for-managed-service-providers\/\">antivirus software<\/a>, and ensuring staff and students are aware of the risks posed by <a href=\"https:\/\/www.msp360.com\/resources\/blog\/types-of-phishing\/\">phishing emails<\/a>.<br \/>\nUp-to-date and tested offline backups for universities have also been recommended.<\/p>\n<h2>SunCrypt Ransomware Hits University Hospital in NJ<\/h2>\n<p>A massive <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/university-hospital-new-jersey-hit-by-suncrypt-ransomware-data-leaked\/\" target=\"_blank\" rel=\"noopener noreferrer\">48,000-document data breach occurred<\/a> after University Hospital in NJ suffered a ransomware operation. The University Hospital is a New Jersey State-owned teaching hospital founded in 1994.<\/p>\n<p>Although SunCrypt began operations in 2019, they have become more active since establishing a dedicated leak site.<\/p>\n<p>Data allegedly stolen from UHNJ during a September ransomware attack has been leaked by the SunCrypt operators. The data leak contains patient-information release-authorization forms, social security numbers (SSNs), copies of driving licenses, dates of birth (DOB), and information about the board of directors.<\/p>\n<p>A cybersecurity source informed BleepingComputer that the TrickBot trojan infected a hospital employee in August. Ryuk, and often Maze, ransomware attacks are traditionally known to use TrickBot to lead into their attacks. SunCrypt has confirmed they are a part of the \u201cMaze cartel\u201d.<\/p>\n<h2>That's a Wrap for News You Might've Missed<\/h2>\n<p>I hope this update has been helpful. MSP360 is your resource for MSP news. Stay home, stay safe and healthy, and remember to check back every week for more highlights.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>What&#8217;s new this week in the news for MSPs? Peculiar Linux malware targeting VoIP switches; universities under new ransomware attacks; SunCrypt ransomware hits University Hospital in NJ; Google Advanced Protection users now get scans for malicious files; and Equinix hit by NetWalker ransomware Let&#8217;s see what it&#8217;s all about.<\/p>\n","protected":false},"author":84,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[877,885],"tags":[],"class_list":["post-44558","post","type-post","status-publish","format-standard","hentry","category-blog-articles","category-other"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/44558","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/users\/84"}],"replies":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/comments?post=44558"}],"version-history":[{"count":0,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/44558\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media?parent=44558"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/categories?post=44558"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/tags?post=44558"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}