Ed's Threat Intel

A boy created AI-generated porn with the faces of girls he knew. Why Toronto police said he didn’t break the law

A recent case in Toronto highlighted critical gaps in Canadian legislation regarding AI-generated deepfake images, particularly concerning minors. The case exposed challenges faced by law enforcement and educators in addressing technology-facilitated misconduct, leading to policy reforms in educational institutions. While most Canadian provinces have enacted intimate image laws addressing manipulated content, Ontario remains among the few jurisdictions without explicit protections. The incident sparked important discussions about the need for updated legal frameworks to address emerging AI technologies and their potential misuse, especially as tools become increasingly accessible. This case underscores the urgent need for comprehensive legislation and institutional policies to protect individuals in the rapidly evolving digital landscape.

The Threat of SIM Swapping Attacks on Financial Institutions - SOCRadar® Cyber Intelligence Inc.

SIM swapping attacks, where cybercriminals hijack phone numbers to bypass security measures, pose a significant threat to financial institutions. These attacks, often involving social engineering and collaboration with ransomware gangs, can lead to fraudulent transactions, identity theft, and reputational damage. To protect themselves, financial institutions should implement multi-factor authentication, employee training, secure communication channels, and dark web monitoring.

US Finalizes Rule Throttling Bulk Data Sales to China

The U.S. government finalized a rule restricting the bulk transfer of sensitive data, including location, health, and biometric data, to China and Russia. The rule aims to prevent foreign powers from weaponizing data for cyberattacks, blackmail, espionage, and transnational intimidation. The rule will be effective within 90 days and includes reporting requirements after 270 days.

White House Clears HIPAA Security Rule Update

The U.S. Department of Health and Human Services (HHS) is proposing a significant update to the Health Insurance Portability and Accountability Act (HIPAA) security rule. The update, aimed at protecting sensitive patient data, includes new cybersecurity mandates such as data encryption and routine compliance checks. The White House estimates the initial implementation cost will be $9 billion, with subsequent annual costs of $6 billion.

2024 Attack Surface Threat Intelligence Report - Cogility - TacitRed - Cybersecurity Insiders

The 2024 Attack Surface Threat Intelligence Report reveals a significant increase in impactful attack surface incidents, with smaller organizations facing disproportionate risk. Challenges in managing attack surface risk include identifying active third-party exposures, maintaining accurate asset inventories, and detecting active threats. Organizations seek multi-source, curated, and prioritized threat intelligence to enhance their defense strategies and improve cyber resiliency.

Blue Yonder says November ransomware attack not connected to Cleo vulnerability - The Cyber Post

Blue Yonder, a supply chain management company, denies a connection between a recent ransomware attack and a vulnerability in Cleo file sharing software. The Clop ransomware gang claimed responsibility for exploiting the Cleo vulnerability and stealing data from Blue Yonder and other companies. Blue Yonder is investigating the claims while emphasizing no link to the November attack attributed to the Termite gang.

US adds 9th telecom company to list of known Salt Typhoon targets - The Cyber Post

A Chinese espionage campaign, known as Salt Typhoon, has breached nine U.S. telecommunications firms, including unclassified communications from senior government officials. The White House is responding with policy measures, such as an FCC rule mandating cybersecurity practices and a ban on China Telecom. The full extent of the breach remains unclear due to the hackers’ efforts to erase their tracks and inadequate logging practices.

North Korean Hackers Deploy OtterCookie Malware in Contagious Interview Campaign

North Korean threat actors, known as CL-STA-0240 or Famous Chollima, are deploying a new JavaScript malware called OtterCookie in their Contagious Interview campaign. OtterCookie, designed to steal data including cryptocurrency wallet keys, communicates with command-and-control servers and runs shell commands to facilitate data theft. This development, along with South Korean sanctions on individuals and organizations involved in a fraudulent IT worker scheme, highlights the ongoing threat posed by North Korean cyber activities.

Prioritizing patching: A deep dive into frameworks and tools – Part 1: CVSS – Sophos News

CVSS is a widely used framework for scoring vulnerability severity, providing a numerical ranking between 0.0 and 10.0. While CVSS is a useful tool, it has limitations, particularly when used alone for prioritization due to its reliance on inherent vulnerability characteristics and lack of consideration for environmental factors. Alternative schemes, such as those incorporating threat intelligence and environmental context, can provide a more comprehensive picture of risk to inform prioritization.

Volkswagen data breach of Electric cars and D Link router botnet attack - Cybersecurity Insiders

Volkswagen experienced a data breach affecting over 800,000 electric vehicle owners due to a misconfiguration in their cloud infrastructure. The exposed data, including geolocation details and contact information, raises concerns about data privacy and potential exploitation by cybercriminals. D-Link routers are also under attack by botnets exploiting legacy vulnerabilities, highlighting the importance of maintaining up-to-date security for connected devices.

Apache security advisory (AV24-731) - Canadian Centre for Cyber Security

Palo Alto Networks security advisory (AV24-730) - Canadian Centre for Cyber Security

Top 10 Identity Attacks in 2024: Protecting Credentials in a Digital World - SOCRadar® Cyber Intelligence Inc.

In 2024, identity attacks reached new heights, with cybercriminals using sophisticated methods like deepfake video calls and polymorphic loaders to breach systems. Stolen credentials remained a prime target, enabling attacks on critical infrastructure and exposing millions of user records. Organizations must prioritize credential protection and implement robust security measures to mitigate these evolving threats.

The Best, the Worst and the Ugliest in Cybersecurity | 2024 Edition

2024 saw both positive and negative developments in cybersecurity, including law enforcement successes against ransomware gangs and a surge in vulnerabilities in major enterprise software. China-linked groups, particularly Volt Typhoon, continued to target critical infrastructure, while opportunistic threat actors capitalized on a global CrowdStrike outage. As we look ahead to 2025, collaboration and a more responsible approach to cybersecurity are crucial to combat these shared threats.

Defining & Defying Cybersecurity Staff Burnout

Cybersecurity burnout, characterized by exhaustion, cynicism, and ineffectiveness, is a serious issue exacerbated by chronic stress and lack of control. While short-term stress can be managed, burnout requires addressing underlying causes and seeking professional help. Strategies to combat burnout include prioritizing work-life balance, seeking support, and implementing coping mechanisms like therapy and sensory optimization.

2024 in AI: It’s changed the world, but it’s not all good | Malwarebytes

In 2024, AI technology showcased its potential for both good and evil, with incidents ranging from heightened ransomware threats to data breaches and scams. While AI-driven innovations like Granny Daisy fight scammers, concerns about privacy, security, and misuse persist. The year’s events raise questions about the responsible development and deployment of AI.

What’s new in Cloudflare: MASQUE now powers 1.1.1.1 & WARP apps, DEX now generally available with Remote Captures

Cloudflare announces two updates: 1.1.1.1 & WARP apps now use MASQUE, a modern HTTP/3-based protocol, for faster and more stable Internet connections. DEX, a Digital Experience Monitoring solution, is now generally available, offering detailed device visibility with Remote Captures for efficient troubleshooting.

Quantum Computing Advances in 2024 Put Security In Spotlight

Google’s announcement of its Willow chip, which reduces noise and errors in quantum computing, marks a significant milestone towards a usable quantum computer. While experts debate the timeline, the potential threat to cybersecurity, particularly encryption, is real and organizations should prepare for post-quantum technologies. Despite the lack of immediate commercial benefits, the need for quantum-safe strategies is urgent, especially for industries at risk from nation-state actors.

Cloud Atlas Deploys VBCloud Malware: Over 80% of Targets Found in Russia

Cloud Atlas, a threat actor active since 2014, is using a new malware called VBCloud in cyber attacks targeting primarily Russian users. The attack chain involves phishing emails with malicious documents exploiting vulnerabilities to download VBShower, which then installs PowerShower and VBCloud. VBCloud, utilizing public cloud storage, harvests system information and steals files, while PowerShower facilitates network infiltration.

Dark Web Profile: Storm-842 (Void Manticore) - SOCRadar® Cyber Intelligence Inc.

Storm-842, also known as Void Manticore, is an Iranian threat actor linked to the Ministry of Intelligence and Security (MOIS). They specialize in destructive wiping attacks and influence campaigns, often collaborating with Scarred Manticore to target organizations opposing Iranian interests. To protect against these attacks, organizations should strengthen access controls, prioritize patch management, and implement robust incident response plans.

Palo Alto Releases Patch for PAN-OS DoS Flaw — Update Immediately

Palo Alto Networks has released a patch for a high-severity vulnerability in PAN-OS software that could cause a denial-of-service (DoS) condition on susceptible devices. The flaw, tracked as CVE-2024-3393, impacts PAN-OS versions 10.X and 11.X, as well as Prisma Access running PAN-OS versions 10.2.8 and later or prior to 11.2.3. Palo Alto Networks recommends immediate updates to affected devices.

FICORA and Kaiten Botnets Exploit Old D-Link Vulnerabilities for Global Attacks

Cybersecurity researchers warn of a surge in malicious activity involving two botnets, FICORA and CAPSAICIN, exploiting vulnerabilities in D-Link routers. FICORA, a Mirai variant, targets globally, while CAPSAICIN, a Kaiten variant, primarily targets East Asian territories. Both botnets utilize hard-coded lists of usernames and passwords for brute-force attacks and possess DDoS capabilities.

Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization

Apache MINA has a critical vulnerability (CVE-2024-52046) that allows remote code execution through unsafe serialization. The vulnerability affects versions 2.0.X, 2.1.X, and 2.2.X and requires immediate patching.

The future of data and AI: Seven trends shaping 2025 and beyond - Help Net Security

Seven trends will shape the future of data and AI in 2025, including the rise of small language models and agentic generative AI, a reality check for AI investments, and increased consumer awareness of data privacy. Organizations will prioritize AI governance, data accuracy, and automation to navigate the evolving landscape. Industry frameworks and synthetic data will also play a crucial role in standardizing practices and protecting sensitive information.

Law enforcement agencies see AI as a key tool for reducing crime - Help Net Security

A U.S. national survey of first responders reveals strong support for AI adoption, particularly for its potential to reduce crime and enhance efficiency. Cybersecurity concerns are also high, with many agencies experiencing outages and relying on outdated technology. Public safety professionals seek data-driven solutions, integrated platforms, and mobile technology to improve outcomes and serve communities more effectively.