Ireland’s national police service, Gardai, has carried out a significant operation targeting the gang behind the ransomware attack on Ireland’s Health Service Executive (HSE) in May, which it believes has prevented other such attacks taking place globally. 

On Sunday, a spokesperson said: “A significant disruption operation which targeted the IT infrastructure of a cyber crime group has been conducted by the Garda National Cyber Crime Bureau (GNCCB).

“The Garda National Cyber Crime Bureau have seized several domains used in this and other ransomware attacks.” 

May’s ransomware attack on HSE, carried out with Conti ransomware, led to significant disruption to the Irish health service provider and many patients, costing the organization millions of euros. 

Gardai has used a so-called “splash screen” on the web domains to warn potential victims that ransomware has likely targeted their system.

The seizure of the websites reportedly “directly prevented” other ransomware attacks across the world.

“A process has also commenced between the Garda Siochana and their law enforcement partners at Europol and Interpol to provide the details of the visiting URLs to the member countries to ensure that the infected systems are appropriately decontaminated,” the spokesman said.

“To date a total of 753 attempts were made by ICT systems across the world to connect to the seized domains.

“In each instance, the seizure of these domains by the GNCCB investigation team is likely to have prevented a Conti ransomware attack on the connecting ICT system by rendering the initially deployed malware on the victim’s system as ineffective.”

Western media channels are being systematically manipulated to spread pro-Russian government propaganda and disinformation, according to a new report by the Crime and Security Research Institute at Cardiff University.

The researchers said they uncovered evidence that “provocative” pro-Russian or anti-Western statements were being systematically posted in reader comments sections in articles relating to Russia in 32 prominent media outlets across 16 countries. Russian-language media outlets subsequently used these comments as the basis of stories about politically controversial events.

These stories insinuated there is significant support among Western citizens for Russia or President Putin, using headlines such as “Daily Mail readers say…” and “Readers of Der Spiegel think…” They were also picked up and reported by other ‘fringe media’ and websites with track records of spreading disinformation and propaganda, some of whom have been linked to Russian intelligence services by Western security agencies.

In one example highlighted by the study, a small number of comments in a Mail Online story about the Taliban’s takeover in Afghanistan were used in a Russian news article under the headline “The British have compared the rise of the Taliban to power with the end of Western civilization.”

These stories were primarily published in Russia and audiences in Central and Eastern Europe, particularly Bulgaria. In total, the team discovered 242 stories that they believe were generated in this fashion. Among the websites repeatedly targeted by the influence operation are The Daily Mail, Daily Express and The Times in the UK; Fox News and Washington Post in the US; Le Figaro in France; Der Spiegel and Die Welt in Germany; and La Stampa in Italy.

The report added that there was evidence of coordination between Russian state-owned media and outlets linked to the non-state Patriot Media Group, observed and drew upon these reader comments.

While these activities were first spotted as part of research into online disinformation amid tensions between Ukraine and Russia earlier this year, the Cardiff team believes these tactics have escalated since 2018.

The researchers used data science pattern recognition and detection techniques to reader comments to make their findings, which uncovered multiple unusual behaviors associated with some accounts posting pro-Russian content. These included some users repeatedly changing their personas and locations. At the same time, on specific platforms, pro-Kremlin comments received an unusually high number and proportion of ‘up-votes compared with typical messages. Together, these multiple inauthenticity signals suggest the commenting activity was coordinated.

Professor Martin Innes, director of the Crime and Security Research Institute at Cardiff University, explained: “As mainstream social media platforms have become more alert to the risks of foreign state influence operations, so disinformation actors and propagandists have been seeking new vulnerabilities in the media ecosystem to exploit. By adopting a ‘full spectrum’ media strategy that blends together information from social and mainstream media outlets, this sophisticated campaign has had the potential to shape the thoughts, emotions and behavior of several diverse international audiences in relation to high-profile media stories.

“Most importantly, the particular tactics and techniques used to ‘hack’ the comments function in the media ecosystem make it almost impossible to attribute responsibility for the pro-Kremlin trolling behavior on the basis of publicly available open-source data. It is therefore vital that media companies running participatory websites are more transparent about how they are tackling disinformation and more proactive in preventing it.”

Andy Patel, a researcher with F-Secure’s Artificial Intelligence Center of Excellence, said media channels must do more to prevent comments being posted by nefarious actors on their sites. He says: “Comments sections on news sites attract posts from users with extreme opinions, and thus often precipitate arguments. These discussions are ripe for abuse by trolls and entities wishing to further extremist agendas. The research published by Cardiff University illustrates how such discussion threads can also be weaponized by bad-faith actors. Comments sections on sites such as these should be properly moderated. If this is not possible, the responsible thing to do is to disable comment functionality until proper moderation policies can be put in place.”

US government security experts have urged system administrators to patch two critical flaws in widely used Cisco and Atlassian products, exposing them to compromise.

In a rare move, US Cyber Command took to Twitter before the Labor Day holiday weekend on Friday to address the Atlassian bug.

“Mass exploitation of Atlassian Confluence CVE-2021-26084 is ongoing and expected to accelerate. Please patch immediately if you haven’t already—this cannot wait until after the weekend,” it warned.

Atlassian issued a patch for the vulnerability in its popular web-based collaboration platform on August 25. The developer said that if exploited, the Open Graph Navigation Library (OGNL) bug would allow an unauthenticated user to execute arbitrary code on a Confluence server or datacenter instance.

OGNL was also exploited by the attackers who breached Equifax in 2018 via Apache Struts 2 vulnerability CVE-2018-11776.

Also, at the end of last week, the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert urging admins to patch a critical vulnerability affecting Cisco Enterprise Network Function Virtualization Infrastructure Software (NFVIS).

Impacting version 4.5.1 of the product, CVE-2021-34746 could allow a remote attacker to take control of an affected system.

“This vulnerability is due to incomplete validation of user-supplied input that is passed to an authentication script,” Cisco explained.

“An attacker could exploit this vulnerability by injecting parameters into an authentication request. A successful exploit could allow the attacker to bypass authentication and log in as an administrator to the affected device.”

There are no workarounds to address the vulnerability, leaving patching as the only option for impacted organizations.

The two alerts came as US government experts warned that ransomware threat actors are increasingly likely to strike ahead of holiday weekends.

Alongside prompt patching, national security advisor, Anne Neuberger, recommended organizations deploy multi-factor authentication, up-to-date backups and strong passwords. She also recommended organizations to review their incident response plans.

If you liked this article, be sure to check out this upcoming Online Summit session:

The US Securities and Exchange Commission (SEC) has warned investors not to fall for scams capitalizing on the Hurricane Ida recovery and clean-up operation.

The regulator’s Office of Investor Education and Advocacy claimed that disasters including hurricanes, floods and oil spills often attract opportunistic fraudsters, who use email and social media to promote their scams.

“These scams can take many forms, including promoters touting companies purportedly involved in clean-up and repair efforts, trading programs that falsely guarantee high returns, and classic Ponzi schemes where new investors’ money is used to pay money promised to earlier investors,” it explained.

“Fraudsters also may target individuals receiving compensation from insurance companies.”

The SEC said it took several enforcement actions against individuals and companies trying to cash in on the aftermath of Hurricane Katrina in 2005.

Some made misleading statements about the potential high-profits their companies could reap from clean-up efforts to inflate their share price and facilitate classic “pump and dump” scams.

“One of the best ways to avoid investment fraud is to ask questions. Be skeptical if you are approached by somebody touting an investment opportunity. Ask that person whether he or she is licensed and whether the investment they are promoting is registered with the SEC or with a state,” the regulator urged.

“Check out their answers with an unbiased source, such as the SEC or your state securities regulator. Know that promises of fast and high profits, with little or no risk, are classic signs of fraud.”

In terms of volume, investment scams numbered only around 8,800 last year, putting them in the bottom half of the most common types of cybercrime by victim count, according to the FBI.

However, they ranked at number three in total losses, costing victims over $336m in 2020. That puts the category behind only romance scams ($600m) and Business Email Compromise ($1.9bn).

If you liked this article, be sure to check out this upcoming Online Summit session

One of America’s largest school districts has informed students, alumni, parents and employees that personal data from the past 11 years was exposed after a third-party gained unauthorized access to it.

The Dallas Independent School District (ISD) claims to serve 145,000 students in 230 schools across the region and boasts 22,000 employees.

However, it revealed last Friday that it was notified about a data security incident on August 8. Although the district is still working out which data was exposed for each victim, students, employees and contractors between 2010 and the present were likely affected.

“An unauthorized third party accessed our network, downloaded data, and temporarily stored it on an encrypted cloud storage site. The data have since been removed from the site,” it noted.

“To date, our cybersecurity experts have found no evidence indicating the data was otherwise accessed, disseminated, or sold. However, we cannot be 100% sure until our ongoing investigation is complete.”

The breached data includes full names, addresses, phone and social security numbers, dates of birth and employment and salary info for current and former employees and contractors.

For current and former students, it includes full names, social security numbers, dates of birth, parent and guardian info and grades. According to the alert, some students’ custody status and medical conditions may also have been exposed.

The district is offering 12 months of credit monitoring and ID theft recovery services and said it is continuing to investigate and remediate the incident. However, it’s still unclear what the attacker’s motives were.

“We confirmed that the unauthorized third party removed the data from the encrypted cloud storage site and has informed us the data was not disseminated or sold to anyone,” Dallas ISD claimed.

It’s also not clear how the attacker managed to access the electronic records, although the district claimed that its IT team had been working with forensic experts to fix “specific vulnerabilities that were exploited during this event.”