A British train company has been criticized for running a cybersecurity test that made employees think they would receive a bonus for working hard during the pandemic.

West Midlands Trains sent an email purporting to be from the company’s managing director, Julian Edwards, out to its approximately 2,500 employees. The missive thanked staff for toiling through 2020 and told them that they would receive a one-off payment as a reward for their efforts. 

But what appeared to be a welcome bonus during difficult times was actually a phishing simulation. When workers clicked on a link that appeared to connect to a personal thank you from Edwards, they were greeted with a message stating that the email was a cybersecurity test.

“This was a test designed by our IT team to entice you to click the link and used both the promise of thanks and financial reward,” read the message, reported by The Guardian.

The leader of the trade union the Transport Salaried Staffs’ Association (TSSA) slammed the simulation as “crass and reprehensible” because many West Midlands Trains workers had been ill with the coronavirus and one had died after contracting COVID-19.

Manuel Cortes, general secretary of the TSSA, said: “This was a cynical and shocking stunt by West Midlands Trains, designed to trick employees who have been on the frontline throughout this terrible pandemic—ensuring essential workers were able to travel.

“The company must now account for their totally crass and reprehensible behavior. They could and should have used any other pretext to test their internet security. It’s almost beyond belief that they chose to falsely offer a bonus to workers who have done so much in the fight against this virus.”

A spokesperson for West Midlands Trains said that the simulation was an accurate representation of threat actors’ attack methods.

“We take cybersecurity very seriously. We run regular training and it’s important to test your resilience,” said the spokesperson.

“The design of the email was just the sort of thing a criminal organization would use—and thankfully it was an exercise without the consequences of a real attack.”

Final examinations at the oldest technological research university in America have been canceled following a cyber-attack.

Much of the computer network of Rensselaer Polytechnic Institute (RPI) was forced to shut down after unauthorized access was detected on Friday. Student assessments, research, and other academic activities have been impacted.

On May 8, the Institute took to Instagram to share news of the attack, stating: “Rensselaer is investigating a trespass into our university network.

“We have temporarily suspended access to the network as we work with law enforcement and cybersecurity experts to determine the extent of the trespass.”

Students whose online exams were impacted by the attack were told that they would be accommodated.

On May 9, the Institute announced that because of the security incident, all final examinations, term papers, and project reports that were due in today and tomorrow had been canceled.

In a social media post, RPI said: “As you are likely aware, suspension of access to the Rensselaer network has impacted final exams, research, and other academic activities. 

“We are writing to communicate that all final exams and submissions (e.g., term papers, project reports) scheduled or due for Monday (May 10th) and Tuesday (May 11th) are cancelled.”

Staff at RPI are taking steps to ensure that students’ futures are not negatively affected by the attack.

“Modifications to grading polices designed to accommodate this disruption are being developed and will be communicated in due time,” said the Institute.

RPI did not share any further details of the incident such as what information may have been accessed. The institute has not shared when its network will be up and running again but stated yesterday that “information about exams scheduled for Wednesday (May 12th) will be forthcoming.”

Jesse Madrid, a junior at RPI, told Chron: “We started looking around and we couldn’t access anything—LMS (the Student Information System), our RPI email, anything.

“People were making jokes at first, but now it’s day three.”

Rensselaer Polytechnic Institute, which has around 7,900 students, is a private university sited in the city of Troy, New York. Information Technology and Web Science are among the academic disciplines taught at the Institute.

The UK authorities took down over 700,000 malicious and phishing sites last year, a huge increase from 2019, according to the National Cyber Security Centre (NCSC).

The GCHQ body revealed the figures in its annual Active Cyber Defence (ACD) report. ACD is the NCSC’s four-year-old strategy to protect the public sector and, where possible, a broader audience.

It does so via a toolkit of around 14 initiatives, headed by the Takedown Service, which involves finding and removing malicious websites from the internet.

As well as 700,000+ websites, the service removed 1.4 million malicious URLs. Although COVID-19 scams surged in 2020, the NCSC said that the 15-fold increase in the volume of sites taken down was due to an expansion of the service, which saw it invest in a wider set of measures to address “different categories of campaigns.”

Among the institutions protected by the ACD last year was the NHS. The NCSC claimed to have detected and blocked 122 phishing campaigns spoofing the health service, up from just 36 in 2019. This included fake vaccine lures and over 40 malicious apps masquerading as official titles such as NHS Test and Trace in third-party app stores.

Also spoofed was the TV Licensing agency, which was hit by a surge of scam emails in July 2020 when entitlements for pensioners changed, and tax office the HMRC, which was the most phished brand last year.

Overall, more than 11,000 government-themed phishing campaigns were taken down — more than double the 2019 figure.

Meanwhile, the Suspicious Email Reporting Service, only launched in April 2020, received nearly four million reports by the end of the year, leading to the removal of over 26,000 scams not previously identified by the Takedown Service.

NCSC technical director, Ian Levy, said the ACD was made possible through partnerships at home and abroad.

“This has never been more important than in the last year, where it was vital for us to do everything we could to protect our most critical services and the wider public during the pandemic,” he added.

“The bold defensive approach taken by the ACD program continues to ensure our national resilience and so I urge public bodies, companies and the general public to sign up to the services available to help everyone stay safe online.”

The full ACD report is available to read here.

The US and UK governments have released new information on the current tactics of Russian cyber-spies, including 11 vulnerabilities dating back to 2018 that are being used for initial access.

The new report, Further TTPs associated with SVR cyber actors, was released by the UK’s National Cyber Security Agency (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency and FBI.

It updates readers on the activities of the Russian Foreign Intelligence Service (SVR) — also known as APT29, Cozy Bear, and The Dukes — blamed for the recent SolarWinds attacks and many other espionage campaigns.

In a classic cat-and-mouse game, the SVR appears to have recently changed its tactics in response to a previous report issued by the US and UK, in an attempt to stay hidden.

This includes exploitation of widely reported Microsoft Exchange Server bugs, they claimed.

The report also listed 11 flaws in products from Fortinet, Cisco, Oracle, Zimbra, Pulse Secure, Citrix, Elasticsearch, VMware and F5 which are being exploited by the SVR to gain access to victim networks.

“This list should not be treated as exhaustive,” the report warned.

“The group will look to rapidly exploit recently released public vulnerabilities which are likely to enable initial access to their targets.”

The government report also flagged the SVR’s use of legitimate tool Cobalt Strike, as well as a custom backdoor (GoldMax), downloader (Sibot), HTTP tracer tool (GoldFinder), and open source Red Team command and control framework (Sliver), in post-compromise activity.

Organizations should be particularly careful to protect their administrator mailboxes as these are a common target for SVR attackers, who use access to better understand the victim’s network and to obtain further privileges and credentials for persistence and lateral movement.

Gurucul CEO, Saryu Nayyar, argued that as long as unpatched systems remain openly accessible, attacks will continue.

“The payloads may change depending on what the threat actor is after, but attackers will continue to leverage vulnerabilities in web servers, routers and virtualization software until there aren’t any vulnerable hosts to exploit,” she added.

“This series of attacks is a reminder of how important it is to patch security vulnerabilities, and to make sure the network is protected with an up-to-date security stack.”

The US government has been forced to issue emergency legislation after a ransomware attack knocked offline the country’s largest fuel pipeline.

Colonial Pipeline confirmed over the weekend that it had suffered a serious cyber-attack.

“Quickly after learning of the attack, Colonial proactively took certain systems offline to contain the threat. These actions temporarily halted all pipeline operations and affected some of our IT systems, which we are actively in the process of restoring,” it said in an update on Sunday.

“While our mainlines (Lines 1, 2, 3 and 4) remain offline, some smaller lateral lines between terminals and delivery points are now operational. We are in the process of restoring service to other laterals and will bring our full system back online only when we believe it is safe to do so, and in full compliance with the approval of all federal regulations.”

The government legislation is designed to relax rules restricting the transportation of fuel by road.

However, if the outage persists there are likely to be shortages and price rises across the 12 states the pipeline travels through and beyond. Reports suggest it carries 2.5 million barrels a day, representing nearly half of the East Coast’s supply of diesel, gasoline and jet fuel.

According to the BBC, the attack was launched by the Russian-speaking DarkSide group, who claim to have also stolen 100GB of data in a classic “double extortion” play.

“Being able to take systems offline and begin a process of restoration is undeniably important, but there is an additional threat if this data is exposed. It underlines the importance of international collaboration to bring down these highly coordinated groups early in their development if we want to protect our critical services,” argued Nominet government cybersecurity expert, Steve Forbes.

“As we watch the domino effect of this cyber-attack, it is very apparent that impact is not limited to systems and software — victims will come in all shapes and sizes, from industries to individuals.”