The ongoing threat from ransomware. Calendar phishing. AI flexes its muscles.
Cross-border travel. Supply chain risks. And Russia goes for Zimbra.
Ransomware
Despite recent law enforcement successes, ransomware continues to scourge organisations, with small and medium-sized businesses experiencing the largest share of attacks. Black Kite’s annual report lists more than 7,500 publicly named victims in the year to March, its fourth consecutive record. In the UK, Proofpoint says 58% of organisations hit by ransomware ignored official advice and paid their attackers. To add insult to injury, more than a fifth of them ended up facing a further ransom demand or had their data released anyway.
While insurance can help with the cost of a ransomware attack, the real impact lies in the disruption caused by such incidents. Standard advice is to maintain offline backups and a tested incident response plan. That’s sound, but the reality is that ransomware attacks cause significant disruption regardless of how well an organisation is prepared. The key is to try to prevent them in the first place. As Proofpoint says, “Organisations that continue treating ransomware as an endpoint or recovery problem are missing where these attacks most frequently begin: people, identities and trusted communications.”
Threats
Calendars: Use of “calendar phishing” is on the rise. This is where fake meeting invitations appear in Outlook, Google Calendar or Apple Calendar, with links to fake login pages, malicious attachments or bogus invoices. Unexpected calendar invites should be treated with the same suspicion as unsolicited emails: don’t click links or attachments, don’t respond, and configure your calendar to require manual approval before new events are added. Panda
Printer: A couple of incidents from Latin America underline why it’s vital to ensure remote access tools are configured and protected properly. Kaspersky explains how attackers exploited Microsoft’s Remote Desktop Protocol (RDP) services and Windows’ built-in BitLocker encryption to lock files. They then printed ransomware demands on the victims’ office printers.
Odyssey: Within hours of the release of Christopher Nolan’s latest epic, criminals were targeting anyone looking for a pirate copy online. As usual, there were two main tactics: popups claiming a browser was missing a required “component,” and an executable program masquerading as a video. Malwarebytes
Profiler: A newly discovered Windows information stealer not only harvests credentials and data, but also uses an AI-powered profiling system to rank infected victims by how valuable they are. Varonis doesn’t specify how devices are infected but says the tool is designed to target more than 300 applications, with subscriptions starting at $80 a month.
Locked: Meanwhile, an information stealer is also targeting Mac users. It bombards victims with fake password prompts while repeatedly crashing key macOS applications in an effort to force users to enter their passwords. Once unlocked, it steals browser credentials, password manager data, cryptocurrency wallets and other sensitive information. The stealer relies on a victim pasting a command into the Terminal app. Group-IB
AI
Breakout: Big story of the week comes from OpenAI, where some of its models escaped their test environment and breached another company’s servers in order to perform a task they’d been given. OpenAI admitted that the testing took place without controls “used to prevent models from pursuing high-risk cyber activity.” Staff were reportedly “freaked out” but “unsurprised” by the incident, which comes as AI labs compete aggressively with each other to develop their models.
One obvious lesson is that if told to achieve a goal at any cost, that is exactly what the latest AI models will do. An Oxford University philosopher came up with a scenario to illustrate this (way back in 2003). Called “Paperclip Maximiser,” it imagines telling an advanced AI that “I want as many paperclips as possible.” Initially, the AI improves manufacturing processes, but doesn’t stop there because it was told to maximise the number of paperclips. This requires harvesting the planet’s entire iron resources, and that includes all the iron in human blood. It’s obviously a thought experiment, but the OpenAI incident demonstrates very clearly why care is required when telling AI models what to do.
Cheaters: Just to underline this, a report from the UK’s AI Security Institutefound that, when given a task, AI models will often break the rules and cut corners to complete it. Not just one model. All of them.
Shadow: AI adoption in the UK has nearly tripled since 2023, according to a survey by the Office for National Statistics. Its figures are based on organisations with 10 or more employees. We would be flabbergasted if the actual figure is not far higher. It’s just that much of the use takes place in the shadows, creating a vast security risk for those organisations.
Dating: Users of dating platforms are feeding their conversations into AI chatbots and asking them to write replies, analyse what went wrong, and generate opening lines. It’s called “chatfishing,” and the dating platforms say there’s not much they can do about it. The Next Web
US
Panopticon: 404 Media has got hold of a leaked document showing the range of surveillance and investigative capabilities that Immigration and Customs Enforcement (ICE) officials enjoy. It extends from smartphone location data and social media monitoring to facial recognition apps and vehicle tracking.
Kill switch: US Secretary of State Marco Rubio has told diplomats to counter the idea that Washington can remotely disable US technology abroad. In a cable seen by Reuters, Rubio said the government doesn’t have a “kill switch” and urged diplomats to portray attempts to build rival ‘sovereign AI’ systems as wasteful.
In brief
Travel: A US federal appeals court has ruled that border agents may manually search travellers’ phones without any suspicion of wrongdoing, a decision with significant implications for journalists and others handling confidential information. It follows several high-profile cases in which reporters have had devices seized at borders, including journalist Richard Medhurst, who was arrested on arrival at Heathrow Airport under the UK Terrorism Act. Anyone travelling internationally with sensitive material should assume their devices may be examined. This makes it essential that devices don’t have anything stored on them that the owner wouldn’t want an outsider to see.
Chain: 26% of UK businesses have experienced a cyber incident that originated in their supply chain over the last year, according to research from business continuity specialist Databarracks. Its annual survey of 500 UK IT decision-makers found that 89% of businesses assess their suppliers when they begin working with them, and many of them decide to work with them even after identifying security issues.
Lessons: A security veteran has a personal account illustrating how clever social engineering attacks have become. Despite 30 years in the business, Torsten George very nearly had his mobile account hijacked. There are a number of lessons from his tale. The most important is never, ever to disclose a one-time code to a caller, no matter how credible they might seem. Security Week
Email: Apple says it has fixed a vulnerability in its Hide My Email feature which made it possible to reveal a user’s real email address. The feature is designed to allow users to sign up for services without handing over their actual email address. It’s a useful feature but it will be rendered largely useless later this year by changes Apple is making that will allow services to identify the addresses and block them. 404 Media
Cameras: Dutch intelligence says Russia is systematically hijacking internet-connected security cameras across Europe and Ukraine in order to monitor military transport routes, weapons shipments bound for Kyiv, and the locations of Ukrainian troops.
Updates
Zimbra: A Russian state-sponsored hacking group is targeting organisations running Zimbra Collaboration Suite (ZCS), according to Western intelligence agencies. A joint advisory says the campaign is ongoing and relies on a zero-click flaw. This means simply viewing a malicious email is enough for attackers to gain “extensive and sustained” access to the victim’s account. One of the vulnerabilities was patched last November, but the agencies believe it had been abused long before then. Administrators are urged to confirm all updates have been applied; where that isn’t feasible, the advisory recommends moving to an alternative email platform.
Adobe: Fix for a ghastly vulnerability in the Acrobat Chrome extension that meant an attacker could access the content of a WhatsApp Web account. The cause was the engine underlying Adobe’s integration with WhatsApp Web. It could be exploited by a victim simply opening a booby-trapped web page. It’s a great example of why web versions of “end-to-end” encrypted messengers are far less secure than the standalone apps. Guardio
WordPress: Important updates to address two vulnerabilities that, if chained together, could allow an attacker to access a system and run code remotely.
Oracle: Third quarterly Critical Patch Update includes patches for 1,449 security issues, with Oracle E-Business Suite accounting for about 28% of the issues.