Last week cyber news
- Channel 14 New’s Instagram account was hacked on Saturday and the attackers tried to promote a crypto project through it.
- France: 33 million social security numbers were exposed in a health insurance cyber breach.
- Bank of America warns customers of information leak due to supply chain attack.
- Washington County Pays $350,000 Ransom After Cyber Attack.
- Battery manufacturer Varta halts production following a cyber-attack. VARTA reports that all five production sites are still down due to the ransom attack that began about two weeks ago, at this stage there is no expectation of a full return to normal
LockBit 3.0 Ransomware attack throughout Israel
According to the report of the Israel National Cyber Directorate, in recent months many attacks using LockBit have been identified in Israel, with version 3.0 being the most popular. They identified various clusters of activity following these attacks, such as connecting via TeamViewer using leaked access information or those stolen using info-stealer. Windows Defender was disabled as part of the attack, as well as other processes related to information security. The LockBit group attacked quite a few organizations in Israel, including:
- Securinux company
- Sansa company
- Finds
- Chicken Gelat
- Tavlit company
- Energies
- Michaelovitz Real Estate
- Amsalem Weitz attorney office
- Intuview company
- Kostika company
- MHS company
- Giza venture capital fund
- Eurotex Textile (Aldo)
- Uvision company
- EMIT Aviation Company
In general, in the ransomware activity used by LockBit 3.0 penetration methods seem to be:
- Unsecured RDP connections
- Use of leaked access data to RMM services
- Using external VPN products
The Israeli National Cyber Directorate provided a file with identifiers – it is recommended to monitor for them in all relevant organizational security systems.
Thousands of Israeli Organizations at Risk of Cyber Attack
The Israel National Cyber Directorate alerted that approximately 30 thousand IP addresses associated with thousands of organizations in Israel, are exposed to an immediate cyber-attack due to two critical vulnerabilities that were discovered in Fortinet VPN (remote connection).
- CVE-2024-23113
- CVE-2024-21762
These vulnerabilities were publicized on 9.2.24.
If you haven’t already done so, update now!!
Caution – Bit Impersonation Alert
Beware of a new phishing campaign. Recently many messages have been sent impersonating Bit. See below for a translation of a sample message that was received.
