Skip to content

Absolutely no one is safe from security attacks

Software developers and vendors from all over the world are under attack by cybercriminals. It’s not that we’re at a time of year when they’re out and about, barricaded in front of offices with their malicious laptops seeking to blow everything up, no. They’re always out there actually, trying to breach information security, and in this article we’re going to give you a bit of advice on how to deal with them.

No one is safe from all kinds of threats 

Whether it’s a half-assed attack or sophisticated and destructive one (as it happen to our competitors from Solarwinds and Kaseya) evil never rests. The entire industry faces an increasingly infuriating threat landscape. We almost always wake up to some news of an unforeseen cyberattack that brings with it the consequent wave of rushed and necessary updates to make sure our system is safe… And no one is spared, true giants have fallen victims. The complexity of today’s software ecosystem means that a vulnerability in a small library could end up affecting hundreds of applications. It happened in the past (openssh, openssl, zlib, glibc…) and it will continue to do so.

As we highlighted, these attacks can be very sophisticated or they can be the result of a combination of third-party weaknesses that compromise customers, not because of the software, but because of some of the components of their environment. This is why IT professionals should require for their software vendors to take security seriously, both from an engineering and vulnerability management standpoint.

We repeat: No one is safe from all threats. The software vendor that yesterday took business away from others may very likely be tomorrow’s new victim. Yes, the other day it was Kaseya, tomorrow it could be us. No matter what we do, there is no such thing as 100% security, no one can guarantee it. The point is not to prevent something bad from happening, the point is how you manage that situation and get out of it.

 

Pandora FMS and Sgsi Iso 27001

Any software vendor can be attacked and that each vendor must take the necessary additional measures to protect themselves and their users. Pandora FMS encourages our current and future customers to ask their vendors to pay more attention in this regard. Ourselves included.

Pandora FMS has always taken security very seriously, so much so that for years we have had a public policy of “Vulnerability disclosure policy” and Artica PFMS as a company, is certified in ISO 27001. We periodically pass code audit tools and maintain locally some modified versions of common libraries.

In 2021, in view of the demand in the area of security, we decided to go one step further, and to become CNA of CVE to provide a much more direct response to software vulnerabilities reported by independent auditors.

PFMS Decalogue for better information security

When a customer asks us if Pandora FMS is safe, sometimes we remind them of all this information, but it’s not enough. That’s why today we want to go further and elaborate a decalogue of revealing questions on the subject. Yes, because some software developers take security a little more seriously than others. Don’t worry, these questions and their corresponding answers apply to both Microsoft and John’s Software. Because security doesn’t distinguish between big, small, shy or marketing experts.

Is there a specific space for security within your software lifecycle?

At Pandora FMS we have an AGILE philosophy with releases every four weeks, and we have a specific category for security tickets. These have a different priority, a different validation cycle (Q/A) and of course, a totally different management, since they involve external actors in some cases (CVE through).

Is your CICD and code versioning system located in a secure environment and do you have specific security measures in place to secure it?

We use Gitlab internally, on a server in our physical offices in Madrid. It is accessed by people with a first and last name, and a unique username and password. No matter which country they are in, their access via VPN is individually controlled and this server cannot be accessed in any other way. Our office is protected by a biometric access system and the server room with a key that only two people have.

Does the developer have an ISMS (Security Incident Management System) in place?

Artica PFMS; the company behind Pandora FMS has been ISO 27001 certified almost since its inception. Our first certification was in 2009. ISO 27001 certifies that there is an ISMS as such in the organization.

Does the developer have a contingency plan?

Not only do we have one, but we have had to use it several times. With COVID we went from working 40 people in an office in Gran Via (Madrid) to working at home. We have had power failures (for weeks), server fires and many other incidents that have put us to the test.

Does the developer have a security incident communication plan that includes its customers?

It has not happened many times, but we have had to release some urgent security patches, and we have notified our customers in a timely manner.

Is there atomic and nominal traceability on code changes?

The good thing about code repositories, such as GIT, is that this kind of issues have been solved for a long time. It is impossible to develop software in a professional way today if tools like GIT are not fully integrated into the organization, and not only the development team, but also the Q/A team, support, engineering…

Do you have a reliable system for distributing updates with digital signatures?

Our update system (Update Manager) distributes packages with digital signature. It is a private system, properly secured and with its own technology.

Do you have an open public vulnerability disclosure policy?

In our case, it is published on our website.

Do you have an Open Source policy that allows the customer to observe and audit the application code if necessary?

Our code is open source, anyone can review it at https://github.com/pandorafms/pandorafms. In addition, some of our customers ask us to audit the source code of the enterprise version and we are happy to do so.

Do third-party components / acquisitions meet the same standards as the other parts of the application?

Yes they do and when they do not comply we support them.

BONUS TRACK:

Does the company have any ISO Quality certification?

ISO 27001

Does the company have any specific safety certification?

National Security Scheme, basic level.

Conclusion

Pandora FMS is prepared and armed for EVERYTHING! Just kidding, as we have said, everyone in this industry is vulnerable, and of course the questions in this Decalogue are crafted with a certain cunning, after all we had solid and truthful answers prepared for them beforehand, however, the real question is, do all software vendors have answers?

If you have to monitor more than 100 devices you can also enjoy a FREE 30-day TRIAL of Pandora FMS Enterprise. Cloud or On-Premise installation, you choose!!! Get it here.

Finally, remember that if you have a small number of devices to monitor, you can use the OpenSource version of Pandora FMS. Find more information here.

Don’t hesitate to send us your questions, the great team behind Pandora FMS will be happy to help you!

Dimas P.L., de la lejana y exótica Vega Baja, CasiMurcia, periodista, redactor, taumaturgo del contenido y campeón de espantar palomas en los parques. Actualmente resido en Madrid donde trabajo como paladín de la comunicación en Pandora FMS y periodista freelance cultural en cualquier medio que se ofrezca. También me vuelvo loco escribiendo y recitando por los círculos poéticos más profundos y oscuros de la ciudad.

Dimas P.L., from the distant and exotic Vega Baja, CasiMurcia, journalist, editor, thaumaturgist of content and champion of scaring pigeons in parks. I currently live in Madrid where I work as a communication champion in Pandora FMS and as a freelance cultural journalist in any media offered. I also go crazy writing and reciting in the deepest and darkest poetic circles of the city.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

AI in Cybersecurity: Friend or Enemy for Your Business?

The dynamic nature of cyber threats demands advanced cyber security solutions, and artificial intelligence (AI) has emerged as a powerful ally in fortifying your business’s cybersecurity defenses. Here’s a look at the risks, AI-powered attacks, insider threats, and the undeniable benefits of integrating AI into your cybersecurity strategy.

Risks of Using AI at the Workplace:

According to the latest annual McKinsey Global Survey, one-third of respondents have reported regular usage of generative AI in at least one organizational function. This means that a significant 60 percent of organizations with established AI adoption are incorporating generative AI into their operations. Additionally, 40 percent of these organizations anticipate increased investments in AI as a result of generative AI, while 28 percent confirm that their board of directors has already placed generative AI on their agenda.

The increasing prevalence of generative AI, as highlighted in the latest McKinsey Global Survey, underscores the growing role of artificial intelligence across various sectors. However, this surge in AI adoption also amplifies concerns about its potential misuse, especially in AI systems. One notable risk is “corpus poisoning” in AI cybersecurity, where malicious actors exploit AI’s training data to introduce vulnerabilities or biases. This threat exposure reminds us that while AI holds immense potential for innovation and productivity, it must be approached with a vigilant commitment to safeguarding against misuse and ensuring its responsible deployment in our evolving digital landscape.

At SafeDNS, we recognize the seriousness of this threat, which is why we have introduced a new category called “Generative AI” specifically designed to manage and regulate the usage of machine learning and generative AI in workplace environments.

AI-Powered Attacks & Cyber Threats:


In April 2018, TaskRabbit,

an online labor marketplace, fell victim to a massive cybersecurity breach. During this incident, the platform was targeted by hackers whose origins could not be traced. This breach stands out as one of the largest data breaches to date, affecting 3.75 million users. Users’ sensitive data, including social security numbers and bank account details, was compromised, leading to a temporary shutdown of the site and preventing users from accessing their accounts. Notably, this incident highlighted the adaptability of AI-driven threats, as the platform didn’t fully recover until September, ultimately affecting a staggering 145 million users.

 

With the rise of AI in cybersecurity attackers are harnessing its power to exploit AI technologies for malicious purposes. AI-powered attacks can adapt in real-time, making them challenging to detect and defend against.

Automated Precision: AI equips attackers with the ability to automate and execute attacks with unparalleled precision. From identifying vulnerabilities to crafting convincing phishing emails, these attacks are efficient and highly targeted.

Adaptive Threats: AI-driven attacks are not static; they evolve. Machine learning algorithms enable attackers to see new threats and adapt their strategies in real-time, making it challenging for traditional security tools and measures to keep up with emerging threats.

Scale and Speed: AI allows for simultaneous cyber attacks on a massive scale. It can scan networks, breach systems, and exfiltrate data at speeds that were previously unattainable, posing a significant threat to organizations.

The Benefits of AI in Cybersecurity:

Consider using AI for your business’s cybersecurity to stay ahead in the rapidly changing world of digital security. Despite security concerns and risks, AI offers some benefits when integrated into your cybersecurity strategy:

  • Anomaly Detection: AI can analyze vast amounts of data in real-time, identifying anomalies and alerting security teams to potentially risky activities. This early warning system allows cybersecurity teams for swift incident response to mitigate cyber threats, minimizing damage.
  • Enhanced ROSI: According to IBM, organizations with mature security AI and automation capabilities experience a 40% higher return on security investment (ROSI). This statistic underscores the value of AI in their security teams by optimizing cybersecurity resources and reducing incident response times to security incidents.

In conclusion, AI plays a dual role in cybersecurity, presenting risks and rewards for businesses. While it can enhance threat detection and response, there are concerns about AI-driven attacks and data manipulation. Balancing these factors is crucial for businesses to harness AI’s potential as a valuable ally in the dynamic world of digital security. It’s a reminder that responsible implementation and vigilance are essential to ensure AI remains a friend to cybersecurity professionals rather than an enemy in the fight against cyber threats. Remember to utilize AI, but also keep in mind that your adversaries are not idle; they too are leveraging AI. Take proactive measures to stay ahead of the evolving threat landscape and continuously adapt your cybersecurity strategies to effectively counter AI-powered attacks, and strengthen your organization’s security posture using AI-based cybersecurity systems to defend against false positives and optimize your cybersecurity artificial intelligence-powered solutions for a safer digital environment.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

How to manage passkeys on Apple devices

Apple’s entrance into the world of passkeys began with iOS 16, which marked the introduction of this technology within the ecosystem. By the time iOS 17 rolled out, Apple had seamlessly woven passkey support for Apple ID and started allowing third-party apps such as NordPass to manage passkeys on mobile devices.

Now Apple users no longer need to remember their Apple ID password and can access and use passkeys outside the ecosystem, on any device, at any time.

This progression isn’t just about technological milestones. It paints a picture of a future where our digital interactions are both more secure and more intuitive.

Today we’ll unpack the nuances of the passkey technology and explore and showcase how easy it is to enable, store, and manage passkeys on the NordPass iOS app.

How passkeys work

Before we get into the ins and outs of passkeys, let’s start with passwords. Passwords, while familiar, come with a set of challenges, issues, and potential risks. Weak or reused passwords have been behind more than 80% of security breaches in the past few years. Passkey technology, however, offers a much more secure and hand alternative to traditional passwords.

At the heart of this technology is a dual-key mechanism. When you opt for a service that supports passkey authentication, two cryptographic keys work in tandem: a public key, which is stored on the service’s server, and a private key, kept securely on your device. The beauty of this pairing is its dependency — one key is ineffective without the other.

The authentication process is multi-layered. During login, the server sends a request to your device, which responds with the corresponding passkey. Your identity is then verified at the device level, often through extra layers of authenticity such as biometrics like Face ID or Touch ID. Access is granted only when both keys match and biometric verification succeeds.

This approach offers enhanced security on multiple fronts. Passkeys are resilient to phishing and eliminates the issues of password reuse or forgetfulness. Yes, with passkeys you don’t need to remember or type out crazy strings of characters. The added layer of biometric verification ensures that even if your device is compromised, your data remains out of reach. Passkeys are here and they are taking over for good reason.

How to enable passkeys on iOS devices

With the introduction of iOS 17, Apple has made it even more convenient for users to embrace the security of passkeys. Integrating this feature into your daily routine is simple, especially with the help of NordPass. Keep in mind that support for passkey management on NordPass is available only for devices running iOS17 and iPad OS17 or later.

Here’s a step-by-step guide to enabling passkeys of your iOS device:

  1. Download and install NordPass on your iOS devices.

  2. Go to the “Settings” on your device.

  3. Scroll down and select “Passwords.”

  4. Authenticate your identity as prompted.

  5. Now, tap on “Password options.”

  6. Browse and select “NordPass.” A checkmark will appear, indicating it’s enabled.

  7. Finalize the process by unlocking the NordPass vault.

That’s it, you’ve enabled passkey-based authentication on your iOS device.

How to save and use passkeys with NordPass on iPhone

Harnessing the power of passkeys through NordPass on your iPhone is a step towards a more secure and smooth online experience. This feature simplifies the login process, ensuring both convenience and protection. Here’s how you can make the most of it.

Saving a passkey in NordPass:

  • Navigate through websites or apps as you typically do.

  • Be attentive to sites or apps offering passwordless login options.

  • When presented with an option to use a passkey or integrate one into an account, choose it.

  • A NordPass prompt will emerge, guiding you to save the passkey.

  • Follow the provided steps to ensure it’s securely stored.

Logging in with a stored passkey:

  • Access the website or app where you’ve saved the passkey.

  • Select the passwordless login feature.

  • NordPass will prompt you to use the stored passkey.

  • Adhere to the on-screen guidelines to authenticate and access your account seamlessly.

By joining the passkey revolution, you position yourself at the center of the seamless and secure online life. Try it today!

How to manage passkeys in NordPass

Navigating the online world can be a daunting experience. However, with the introduction of passkeys, the process has become not only more secure but also more user-friendly and instant. Let’s delve into how you can manage passkeys using NordPass.

What can you do with a passkey in NordPass?

  • View passkey creation date. NordPass allows you to see when a particular passkey was created. This feature provides an added layer of transparency, ensuring you always know the age of your digital keys.

  • Share passkeys safely. With NordPass, sharing passkeys is quick and intuitive. Whether it’s for business or personal use, you can securely share your passkeys with trusted individuals without compromising security.

  • Add secure notes. Alongside your passkeys, NordPass provides the option to add secure notes. This feature is especially useful for adding extra information or reminders related to a particular service or account.

Why choose NordPass for passkey management?

NordPass isn’t just another password manager. It’s a comprehensive digital life manager for those on the go. With the introduction of passkeys, NordPass further pushes the envelope of what a password manager can be.

All NordPass users can now store and manage passkeys, ensuring they can access apps and websites securely. NordPass also syncs your passkeys across all devices and operating systems. Unlike many other password managers, NordPass offers seamless sharing of passkeys, making it a top choice for those who prioritize both security and convenience.

Furthermore, NordPass is actively working towards a passwordless future. We support passkey storage but are also in the process of introducing passwordless access to the NordPass app. This means you will soon be able to access your Nord Account and NordPass with just a tap, thanks to biometrics.

In a rapidly evolving online world, it’s crucial to stay ahead of the curve. With NordPass, you are not only equipped with the latest in security technology but are also prepared for the inevitable shift towards a passwordless future.

 

Login experience
Now that you’re signed-up for an online service with a passkey, logging in is quick, easy and secure. All you need to do is tap the suggested passkey for that account and you are logged in.

How do passkeys work? 
Understanding passkeys and how this technology works can be somewhat tricky, mostly because passwords have been an integral part of our digital lives for so long. So first let’s recap the old and familiar before getting into passkeys. By the end we should understand the whole passkeys vs. passwords deal and why passkeys are the way of the future.

Password technology explained
Passwords — we know them all too well, and most of us have some idea of how they work. But let’s quickly recap.

Password-based authentication is relatively simple and straightforward. Say you create a password for a new online account. That password is then stored in an encrypted format on a server. When you use the password to access that account, the system compares the password you enter with the one in its database. If the two match — you’re good to go.

Simple, right? Well the catch is that this kind of user authentication presents quite a few serious security concerns. People tend to reuse simple and easy-to-crack passwords for multiple accounts, which is a hacker’s dream — crack a single account and you have access to a person’s entire digital life. Databases that store passwords can be breached. In fact, Verizon’s Data Breach Report notes that up to 80% of successful breaches are attributed to weak or stolen passwords.

Passkey technology explained
You can think of passkeys as a new and improved type of password. Both are used to verify a user’s identity upon sign up and login. However, the technology behind passkeys operates in a different way.

Whenever you sign up for an online service which supports passkey authentication, two keys are generated — public and private, both of which are used to authenticate the user when logging in.

The public key is stored in the website’s server, while the private key is stored on your device, whether it’s a phone, tablet, desktop, or laptop. Without each other the two keys are useless.

Upon logging in, the server sends a request to your device, and that request is then answered by a related passkey. The user’s identity is also verified on the device level via biometrics. Finally if the pair of keys match you’re granted access to your account.

Passkeys are widely considered to be a more secure and convenient form of authentication compared to passwords, as they reduce the risk of forgetting or reusing passwords. Passkeys are also resistant to phishing attacks as they can’t be stolen from your device by a third-party.

Store passkeys with NordPass 
All NordPass users now have the ability to store and manage passkeys in NordPass and use them to access apps and websites. NordPass syncs your passkeys across all of your devices as well as operating systems and enables you to safely share passkeys whenever needed. It is important to note that sharing passkeys is not as easy with alternative systems as it is with NordPass.

We’re excited to let you know that with the release of iOS 17, passkey storage is now available on NordPass app for iOS devices. This is a monumental step for us, ensuring that you, our users, enjoy a seamless experience across all platforms and devices.

In addition to mobile access, you can also reach your passkeys on NordPass via the desktop app, web vault, Firefox, and Chrome-based browser extensions. We’re also thrilled to share that support for the Safari extension is on the priority list and will be launched later this year.

Password managers are highly reliant on platform vendors when it comes to passkey technology. Therefore, we welcome the latest move from Apple because it serves as a huge milestone in replacing passwords with more advanced online authentication solutions. With tech giants allowing third-party integrations, internet users will get more user-friendly services and, as a result, will be more keen to stick to using passkeys

– Sorin Manole,

Product Strategist @ NordPass

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Cybercrime During Economic Downturns

The Economic Climate & its Impact on Cybersecurity

Increased cybercrime during economic downturns is inevitable, and brings a host of challenges for businesses worldwide. History has shown that during such periods, companies often make drastic cuts to their budgets, with areas like IT and cybersecurity also being affected. This creates vulnerabilities that cybercriminals are quick to exploit. To this point, a study by Bridewell, cites that 34% of organizations across the UK’s critical national infrastructure expect to see an increase in cyberattacks as a result of the current economic crisis.

Why Do Cyberattacks Spike During Financial Downturns?

It’s a multi-faceted issue. Firstly, businesses tend to cut costs in areas deemed non-essential, often affecting cybersecurity infrastructure and training. Moreover, layoffs during struggling economies can mean fewer personnel to manage and monitor IT systems, leading to security gaps. Criminals groups, well aware of these vulnerabilities, escalate their activities, seeking to capitalize on weakened security postures.

The Cost of Cybercrime in a Fragile Economy

Recessions are tough enough on their own, but when combined with the financial burdens of a cyberattack, the effects can be devastating. The average cost of a data breach is already sitting at a hefty $4.45 million. For companies already struggling with economic downturns, such financial hits can be the final blow, leading to bankruptcy or severe reputational damage.

Industries Most at Risk During Financial Crises

During economic downturns, certain industries inherently face a more challenging operational environment, making them attractive targets for cybercriminals.

Financial Services

With an uptick in customers concerned about their investments and seeking loan accommodations, these institutions see increased online traffic. This surge can be exploited by attackers to hide malicious activities amidst the flurry of genuine transactions. Additionally, financial desperation might make employees more susceptible to bribery or internal fraud.

Healthcare

In recessionary times, the healthcare sector can find itself overwhelmed. Not only do they grapple with strained resources, but they also face a rise in patients transitioning to digital health platforms. Cybercriminals can capitalize on this by deploying fake telehealth platforms, luring patients with discounted services, only to compromise their health data.

Other notable trends include medical phishing scams where attackers pose as health insurers or pharmacies to extract sensitive information, taking advantage of patients’ quests for affordable treatments.

Manufacturing

The interconnected nature of modern manufacturing, often termed as Industry 4.0, means a cyber incident can halt production lines, disrupt supply chains, and even cause physical damage. During economic downturns, to cut costs, some manufacturers might delay necessary security updates or overlook security training, making them low-hanging fruits for threat actors.

Government Services

Economic crises put pressure on government bodies as they work to implement relief measures, manage public unrest, and maintain essential services. This can lead to a swift digitization of services without adequate cybersecurity measures in place. Public data becomes more accessible and, hence, a lucrative target.

Retail and E-Commerce

Tough economies often prompt a shift in consumer behavior. While in-store purchases might decline, online shopping can rise as customers hunt for bargains. Such uptrends become treasure troves for cybercriminals. For instance, they may target popular shopping events like Black Friday sales, with fake websites to phish unsuspecting shoppers. Additionally, as retailers extend or adjust their supplier networks to cut costs, attackers find more entry points to exploit.

The Lifeline: Multi-Layered Cybersecurity Strategies

When the stakes are higher than ever, businesses can’t afford to take chances. This’s where a multi-layered cybersecurity approach comes into play:

Network Access Control (NAC): This is an essential component of any cybersecurity strategy. NAC solutions allow businesses to define who or what can access their networks. By determining and enforcing policies on which devices or users can access the network, it reduces the potential attack vectors, essentially closing the door to many potential threats.

Passwordless Authentication: As the name suggests, this approach does away with passwords, which have long been a weak link in the security chain. Instead, passwordless authentication uses more secure methods like certificates, biometrics or hardware tokens. By eliminating the risks associated with weak or stolen passwords, businesses can further bolster their defenses.

Regular Training & Simulations: One of the most common ways cybercriminals access systems is through human error. Regular training ensures that employees recognize and avoid threats. Simulated phishing attacks, for instance, can prepare staff for real-world scenarios.

Software Updates: Keeping all software, especially software, up-to-date is critical. These updates often contain patches for known vulnerabilities that criminals could exploit.

Backup, Backup, Backup: Having a robust backup ensures that, even if data is compromised, it can be restored without paying ransoms or losing critical information.

Combatting Cybercrime During Economic Downturns

The ripples of economic downturns touch every corner of the business world, including the cybersecurity landscape. Increased cybercrime during economic downturns offer a stark reminder that as threats evolve, our defenses should as well. By understanding these dynamics, and adopting a multi-layered security approach, businesses have a fighting chance to weather the storm, both financially and digitally.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

ESET Research: Iran-aligned OilRig group deployed new malware to its Israeli victims, collecting credentials

  • ESET Research analyzed two OilRig campaigns that occurred throughout 2021 (Outer Space) and 2022 (Juicy Mix) by this Iran-aligned APT group. 
  • The operators exclusively targeted Israeli organizations and compromised legitimate Israeli websites for use in OilRig’s Command & Control (C&C) communications.
  • They used a new, previously undocumented backdoor in each campaign: Solar in Outer Space, then its successor Mango in Juicy Mix.
  • A variety of post-compromise tools were deployed in both campaigns. They were used to collect sensitive information from major browsers and the Windows Credential Manager.


BRATISLAVA, MONTREAL — September 21, 2023 — ESET researchers have analyzed two campaigns by the Iran-aligned OilRig APT group: Outer Space from 2021, and Juicy Mix from 2022. Both of these cyberespionage campaigns targeted Israeli organizations exclusively, which is in line with the group’s focus on the Middle East, and both used the same playbook: OilRig first compromised a legitimate website to use as a C&C server and then delivered previously undocumented backdoors to its victims while also deploying a variety of post-compromise tools mostly used for data exfiltration from the target systems. Specifically, they were used to collects credentials from Windows Credential Manager and from major browsers, credentials, cookies and browsing history.

In their Outer Space campaign, OilRig used a simple, previously undocumented C#/.NET backdoor ESET Research has named Solar, along with a new downloader, SampleCheck5000 (or SC5k), that uses the Microsoft Office Exchange Web Services API for C&C communication. For the Juicy Mix campaign, the threat actors improved on Solar to create the Mango backdoor, which possesses additional capabilities and obfuscation methods. Both backdoors were deployed by VBS droppers, presumably spread via spearphishing emails. In addition to detecting the malicious toolset, ESET has also notified the Israeli CERT about the compromised websites.
ESET named the Solar backdoor based on the use of an astronomy-based naming scheme in its function names and tasks; we named Mango, another new backdoor, based on its internal assembly name and its filename.

Solar backdoor possesses basic functionalities and can be used, among other things, to download and execute files, and automatically exfiltrate staged files. An Israeli human resources company’s web server, which OilRig compromised at some point prior to deploying Solar, was used as the C&C server.

For its Juicy Mix campaign, OilRig switched from the Solar backdoor to Mango. It has a similar workflow to Solar and overlapping capabilities, with some notable technical changes. ESET identified an unused detection evasion technique within Mango. “This technique’s goal is to block endpoint security solutions from loading their user-mode code hooks via a DLL in this process. While the parameter was not used in the sample we analyzed, it could be activated in future versions,” says ESET researcher Zuzana Hromcová, who co-analyzed the two campaigns of OilRig.

OilRig, also known as APT34, Lyceum, or Siamesekitten, is a cyberespionage group that has been active since at least 2014 and is commonly believed to be based in Iran. The group targets Middle Eastern governments and a variety of verticals, including chemical, energy, financial and telecommunications.

For more technical information about OilRig and its Outer Space and Juicy Mix campaigns, check out the blogpost “OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes” on WeLiveSecurity. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×