The Week in Breach News: 07/05/23 – 07/11/23

This week: A cyberattack shuts down Japan’s largest port, Sun Life is impacted by MOVEit, a look at the phishing simulations that employees fell for last year and a deep dive into two dangerous malware attacks. 

---

---

---

The Law Foundation of Silicon Valley

https://therecord.media/thousands-affected-by-ransomware-on-law-firm

Exploit: Ransomware

The Law Foundation of Silicon Valley: Non-Profit

How It Could Affect Your Customers’ Business: This data breach is going to cost a fortune after state regulators get finished with this California-based organization.

Kaseya to the Rescue: Explore how security awareness training helps organizations defend against today’s most dangerous cyber threats in this infographic. DOWNLOAD IT>>

---

National Institutes of Health Federal Credit Union (NIHFCU)

https://www.jdsupra.com/legalnews/nih-federal-credit-union-notifies-14-1232621/

Exploit: Credential Compromise

National Institutes of Health (NIH) Federal Credit Union: Financial Institution

How It Could Affect Your Customers’ Business The financial sector has consistently been among the top sectors that cybercriminals have been attacking in the last few years.

Kaseya to the Rescue:  Credential compromise isn’t the only risk that businesses face from the dark web. Learn about five dark web dangers for businesses in this infographic. GET INFOGRAPHIC>> 

---

Advanced Medical Management

https://www.hipaajournal.com/advanced-medical-management-reports-data-breach-affecting-319485-individuals/

Exploit: Supply Chain Attack

Advanced Medical Management: Healthcare Management Services

How It Could Affect Your Customers’ Business: Security awareness training isn’t just for cyberattacks, it also helps employees become more conscientious about security overall to limit mistakes.

Kaseya to the Rescue: Learn more about how our Security Suite can help MSPs protect their clients from expensive and damaging cyberattacks and other information security trouble. GET THE FACT SHEET>>

---

Pepsi Bottling Ventures

https://www.securityweek.com/28000-impacted-by-data-breach-at-pepsi-bottling-ventures/

Exploit: Hacking

Pepsi Bottling Ventures: Soft Drink Distributor

How It Could Affect Your Customers’ Business: Employee data is a treasure trove for bad actors as it can contain PHI, PII, financial details and other information that sells fast.

Kaseya to the Rescue:  Our eBook How to Build a Security Awareness Training Program helps IT professionals design and implement an effective training program quickly. DOWNLOAD IT>> 

---

---

---

Sun Life

https://www.ctvnews.ca/business/global-cyberattack-affected-some-sun-life-members-information-company-says-1.6472126

Exploit: Supply Chain Risk

Sun Life: Insurer

How it Could Affect Your Customers’ Business: Supply chain relationships have become increasingly fraught for businesses and that trend will continue.

Kaseya to the Rescue:  Learn more about the dark web economy and see how data like this gets bought and sold on the dark web in The IT Professional’s Guide to the Dark Web. DOWNLOAD IT>>

---

---

---

Scotland – The University of the West of Scotland (UWS)

https://news.stv.tv/west-central/university-of-west-of-scotland-working-with-police-and-government-after-cyber-attack

Exploit: Hacking

The University of the West of Scotland (UWS): Institution of Higher Learning

How it Could Affect Your Customers’ Business: Targets from every part of the education sector have been popular because of the often time-sensitive nature of their business.

Kaseya to the Rescue: See how the solutions in Kaseya’s Security Suite help IT professionals minimize risk, avoid cyberattacks and build a cyber-savvy workforce. WATCH THE WEBINAR>>

---

---

Australia – Ventia

https://www.securityweek.com/critical-infrastructure-services-firm-ventia-takes-systems-offline-due-to-cyberattack/

Exploit: Hacking

Ventia: Critical Infrastructure Management

How it Could Affect Your Customers’ Business: Infrastructure attacks and attacks on companies that support it have been continuing to increase worldwide.

Kaseya to the Rescue: Follow the path to see how Managed SOC defends businesses from cyberattacks efficiently and effectively without breaking the bank in a handy infographic. GET IT>>

---

---

---

Japan – The Port of Nagoya

https://www.darkreading.com/attacks-breaches/ransomware-halts-operations-at-japan-port-of-nagoya

Exploit: Ransomware

The Port of Nagoya: Seaport 

How it Could Affect Your Customers’ Business: This is a good example of the destructive power of cyberattacks against infrastructure. For something like a port, even a few hours of downtime is a disaster.

Kaseya to the Rescue: In today’s volatile cybersecurity landscape, insurers are requiring businesses to have certain solutions in place. See how Datto EDR satisfies insurance requirements. LEARN MORE>>

---

---

---

---

---

---

JULY 18 | 3 PM PDT, 6 PM EDT | 8 AM AEST (JULY 19)Join us for an informative webinar with the product managers for BullPhish ID, Dark Web ID, Passly and Graphus as we highlight the latest product innovations. You will learn about new time-saving product integrations and the latest new product features and enhancements, including mini-demos of the most exciting features. You’ll learn about:

• New integrations between our Security products and other products in the Kaseya family
• New Personal Spam Filter from Graphus
• New BullPhish ID automation features
• What’s on the Security products’ roadmaps for Q3 and beyond

This must-see webinar is just one week away! REGISTER NOW>>

---

---

---

What Phishing Tricks Do Employees Fall For?

Our award-winning security awareness training and phishing simulation solution, BullPhish ID, helps companies train employees to practice safe security behaviors and recognize phishing messages. After all, employees need help spotting and stopping threats, as these results from a year of security awareness training and phishing simulation with BullPhish ID show. See which phishing messages employees fell for in a new infographic. DOWNLOAD THE INFOGRAPHIC>>

Did you miss… the Keys to Selecting a Managed SOC checklist? GET IT>

---

---

---

---

Ransomware attacks are the bane of every IT professional. That notorious type of malware can serve as a multi-purpose attack for cybercriminals of all stripes, from your run-of-the-mill cybercrime gang to sophisticated nation-state threat actors. But that’s not the only type of malware that’s out there that can cause massive, expensive damage to a business. Take a look at the ransomware lifecycle and the process by which wiper malware inflicts a massive blow on its victims to understand why these attacks are so popular and what IT professionals can do to keep businesses out of trouble.  

---

Excerpted in part from our new 2023 edition of Ransomware 101. DOWNLOAD IT>> 

---

What is a typical ransomware attack lifecycle?  

---

Ransomware can enter a company’s environment in many ways, including through email or direct deployment. The most common way for a company to fall victim to a ransomware attack is through email. About 90% of cyberattacks, like ransomware attacks, start with a phishing email landing in a user’s inbox. Here’s the lifecycle of a ransomware attack conducted through phishing: 

1. A ransomware gang forms. 

2. They recruit affiliates and hire personnel like developers and hackers. 

3. The gang decides to target Company X and plans to take their data and systems hostage.  

4. They gather the necessary resources, usually from the dark web, to craft a spear phishing email that will entice an employee of Company X into clicking on it. 

5. The email makes it past Company X’s Secure Email Gateway (SEG) or other email security and lands in an employee’s inbox. 

6. The employee takes the bait, opens the email and interacts with it by visiting a poisoned website or downloading a tainted attachment. 

7. The malicious payload infects the employee’s computer with a ransomware client that takes control of it. 

8. The infected computer then establishes a connection with the cybercriminals’ network.  

9. The malware begins encrypting Company X’s systems and/or exfiltrating data. 

10. The cybercriminals contact Company X with a ransom demand, payable in cryptocurrency. 

11. Company X must decide if they will pay the extortionists (which may be illegal) or attempt to recover their data or restore their network another way. 

---

---

How Do Ransomware Gangs Make Money?   

---

When a company pays a ransom, that money travels far and wide across the dark web. Ransoms don’t just go to one person or organization — even an ancillary participant in a ransomware attack will profit. That’s a major reason why cybercriminals of every stripe are quick to jump into a ransomware operation. Those criminals have a high chance of walking away with substantial cash, and everyone gets paid.   

The big, powerful ransomware gangs rarely run campaigns themselves. Instead, they operate Cybercrime-as-a-Service platforms that cybercriminals can use to conduct operations, attract talent, network with freelancers and receive payments. The boss gang makes their money from their cut of the profits when a successful ransomware attack occurs under their auspices. Those attacks are conducted by allied independent contractors known as affiliates. The affiliates are the ones doing the day-to-day work of mounting a successful ransomware attack.   

The affiliate is responsible for running everything about a ransomware attack — from planning to execution to receiving payment — against their chosen target. The affiliate may be a smaller gang or just a group of freelancers getting together for one job. Sometimes, the boss gang supplies the malware or the affiliate may prefer to use their own. However, if an affiliate gets the job done, if their attack is successful, they’re obligated to send a cut up the chain to the boss — the gang that runs the platform — generally 10–20% of the take, as well as pay any subcontractors that they’ve hired. The rest of the money is theirs to enjoy.   

---

---

Ransomware isn’t the only malware threat businesses face 

---

While ransomware gets more press attention, cybercriminals have a much more devastating weapon in their arsenal: wiper malware. This nightmarish attack is designed to completely, irrecoverably erase a victim’s data, making recovery a major challenge. The malware attacks the physical location where the data is stored and deletes it permanently. This data assassin spreads throughout a network quickly.  

Many cybercriminal gangs use wipers to cover up their traces after an intrusion, and this is a go-to attack for nation-state threat actors. The Russia-Ukraine war gave rise to a new round of wiper malware attacks in 2022, as several versions of wipers were used to disrupt the critical infrastructure of Ukrainian systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released an advisory to businesses and government agencies advising vigilance against new strains of wiper malware that emerged during that conflict. 

---

---

How does wiper malware work? 

---

The most straightforward way to wipe out data from a system is to overwrite the data in a specific physical location with other data. This process is arduous for cybercriminals as they have to write several gigabytes or terabytes of data, which is highly time-consuming and can open them up to detection. But wiper malware greatly speeds up that process by first destroying two particular files in the system and then erasing the data in minutes.  

• The first file that gets annihilated in a wiper malware attack is the Master Boot Record (MBR), which identifies the operating system’s location during the boot process. If the cybercriminals succeed in destroying the MBR, the boot process crashes, making the files inaccessible unless forensic methodologies are used, and sometimes that won’t even work. 
• The next to go is the Master File Table (MFT), which exists in every NTFS file system, containing the physical location of files in the drive, their logical and physical size and other related metadata. As many big files cannot use consecutive blocks in the hard drive, they are fragmented to accommodate the storage of large files. The MFT comes in handy here, as it stores the information of where each fragment is present in the drive. If the cybercriminals get hold of your MFT, you can still access your small files using forensic tools but accessing large files is practically impossible since the link between fragments is lost. This is a critical step in making data unrecoverable. 

---

---

The Kaseya Security Suite helps IT professionals mitigate cyber risk. 

---

Major protection from today’s most dangerous and damaging cyberattacks doesn’t have to come with a major price tag with Kaseya’s Security Suite.

Dark Web ID — Our award-winning dark web monitoring solution is the channel leader for a good reason: it provides the greatest amount of protection around with 24/7/365 human and machine-powered monitoring of business and personal credentials, including domains, IP addresses and email addresses. 

BullPhish ID — This effective, automated security awareness training and phishing simulation solution provides critical training that improves compliance, prevents cyberattacks and reduces an organization’s chance of experiencing a cybersecurity disaster by up to 70%. 

Graphus — Automated email security is a cutting-edge solution that puts three layers of AI-powered protection between employees and phishing messages. It works equally well as a standalone email security solution or supercharges your Microsoft 365 and Google Workspace email security.  

Kaseya Managed SOC powered by RocketCyber — Our managed cybersecurity detection and response solution is backed by a world-class security operations center that detects malicious and suspicious activity across three critical attack vectors: endpoint, network and cloud.  

Datto EDR — Detect and respond to advanced threats with built-in continuous endpoint monitoring and behavioral analysis to deliver comprehensive endpoint defense (something that many cyber insurance companies require). 

---

---

---

July 18: Kaseya + Datto Connect Local Boston REGISTER NOW>>

July 18: ID Agent & Graphus Q3 Product Update Webinar REGISTER NOW>>

July 24: Cyber Insurance Fast-Track Program Webinar REGISTER NOW>>

July 20:  Kaseya + Datto Connect Local Baltimore REGISTER NOW>>

July 21: Kaseya + Datto Connect Local Baltimore IT Professionals Series REGISTER NOW>>

July 27: Cyber Security Round Table: Cyber Insurance 101 REGISTER NOW>>

August 3: Kaseya + Datto Connect Local Doral Miami REGISTER NOW>>

August 15: Kaseya + Datto Connect Local Detroit REGISTER NOW>>

August 17: Kaseya + Datto Symposium Long Branch REGISTER NOW>>

August 22: Kaseya + Datto Connect Local Kansas City REGISTER NOW>>

August 29: Kaseya + Datto Connect Local San Diego REGISTER NOW>>

September 14: Kaseya + Datto Connect Local San Antonio REGISTER NOW>>

October 2 – 4: Kaseya DattoCon in Miami REGISTER NOW>>

---

---

---

---

---