Apr 30 2024
Welcome to Gone Phishing, your daily cybersecurity newsletter that always swings for the cyber fences 🏏⚾🧢🧤🙃
Today’s hottest cybersecurity news stories:
👨💻 'Muddling Meerkat' hijacks DNS to map internet on global scale 🌎
🕵️ CISA’s ransomware notification pilot is working! 800 flaws resolved 🎉
👤 Foreign states are targeting MI5! They’re shaken, but they’re not stirred 🍸
A newly discovered cyber threat named "Muddling Meerkat" has been spotted executing intricate domain name system (DNS) manoeuvres since October 2019, raising concerns about its origins and objectives. 🌐🛡️
Unveiling the Enigma 🕵️♀️🔎
Cloud security firm Infoblox disclosed that the threat actor, likely linked to the People's Republic of China (PRC), has been manipulating DNS activities to circumvent security measures and conduct network reconnaissance globally. The designation "Muddling Meerkat" alludes to the complex and bewildering nature of its operations. 🤔🔍
DNS Manipulation Tactics 🔄🔧
The cybercriminals behind Muddling Meerkat display a profound understanding of DNS, utilising DNS open resolvers and triggering queries for mail exchange (MX) records to domains under popular top-level domains. This modus operandi aims to obfuscate their activities and evade detection. 🛡️🔎
Collaboration with Great Firewall 🐉🔥
Infoblox's discovery suggests a concerning collaboration between Muddling Meerkat and the operators of the Great Firewall (GFW) of China, enabling the injection of fake DNS responses to disrupt legitimate DNS traffic. This collaboration highlights the threat actor's sophisticated capabilities and strategic alliances. 🤝🌐
Unravelling the Mystery 🕵️♂️🔓
Despite the extensive reconnaissance efforts, the exact motives behind Muddling Meerkat's prolonged campaign remain elusive. While it may serve as part of an internet mapping endeavour or strategic research, its clandestine nature underscores the need for heightened vigilance and collaboration among cybersecurity agencies. 🌐🔍
The Threat Landscape Ahead 🌐🛑
As cybersecurity experts continue to decode the enigma of Muddling Meerkat, its activities underscore the evolving threat landscape and the importance of proactive defence measures. Vigilance and collaboration are paramount in countering such sophisticated cyber threats. 🛡️💻
In a significant development in the ongoing battle against ransomware attacks, the Cybersecurity and Infrastructure Security Agency (CISA) announced promising results from its Ransomware Vulnerability Warning Pilot program. 🛡️💻
Proactive Defence in Action 🛡️⚔️
Launched in January 2023 under the auspices of the Joint Ransomware Task Force, the program aims to identify organisations susceptible to ransomware attacks due to internet-accessible vulnerabilities. 🌐🔍
A Strong Start 💪✨
CISA's proactive approach yielded fruitful outcomes, with 1,754 notifications sent to vulnerable organisations last year alone. Impressively, 852 of these organisations took immediate action by patching vulnerabilities, implementing compensating controls, or taking vulnerable devices offline following CISA's intervention. 📈🔧
Empowering Government and Critical Infrastructure 🏛️🔐
Emphasising collaboration with government agencies and critical infrastructure entities, CISA's program has become a beacon of resilience, leading to a significant reduction in risk exposure for participating organisations. 🤝💼
Tangible Benefits 📉💼
According to CISA officials, organisations enrolled in the program experienced a remarkable 40% reduction in risk exposure within the first 12 months, with noticeable improvements often seen within just 90 days. This underscores the program's effectiveness in mitigating cyber threats and fortifying defences. 🚀🔒
Targeting Vulnerabilities Where They Lurk 🕵️♂️🔍
CISA's data revealed that notifications were primarily directed towards government facilities and healthcare organisations, sectors particularly vulnerable to ransomware attacks. By identifying and addressing exposed assets, the program proactively manages vulnerabilities that might otherwise remain unnoticed. 🎯🛡️
A Crucial Contribution to Cyber Resilience 🌐🛡️
CISA believes that the program is not only disrupting the operations of ransomware groups but also bolstering deterrence efforts by denying them easy targets. With over 7,600 participating organisations and a wealth of actionable data, CISA's Cyber Hygiene Vulnerability Scanning program continues to be a cornerstone in safeguarding against cyber threats. 🤖🔒
As the cybersecurity landscape continues to evolve, CISA remains steadfast in its commitment to proactive defence, paving the way for a more resilient and secure digital future. 💻🛡️
In a recent briefing, Britain's domestic intelligence agency MI5, along with government officials, sounded the alarm on the growing threat of foreign espionage targeting the nation's research universities. 🚨🔍
A Coordinated Effort 🤝🌐
Led by Deputy Prime Minister Oliver Dowden, the briefing emphasised the need for enhanced security measures to safeguard sensitive research from hostile actors. With MI5 Director General Ken McCallum and National Cyber Security Centre's Felicity Oswald in attendance, the focus was squarely on protecting academic institutions from espionage threats. 🛡️🔒
Heightened Awareness 👀💡
MI5's warning comes on the heels of an internal security review highlighting the pervasive nature of threats facing the higher education sector. While no specific foreign states were named, concerns about espionage activities, particularly from China, loom large. 🌐🕵️♂️
A Call to Action 📢✅
Recognizing the urgent need for action, the government announced a consultation with the sector to bolster security measures and support universities in protecting cutting-edge research. Measures under consideration include security vetting of key researchers and increased transparency in funding flows. 🤝💼
Navigating Challenges 🛠️🔍
While the move aims to strengthen national security, it also raises questions about balancing openness and security in academic collaboration. Professor Dame Ottoline Leyser of UK Research and Innovation emphasised the importance of finding ways to enable collaboration while safeguarding national interests. 🤝🔒
A Collaborative Approach 🌍🤝
As the UK navigates these challenges, experts stress the need for collaboration between government, academia, and industry to address evolving threats effectively. With parallels to the US approach, informal coalitions around research security may emerge to tackle the issue head-on. 🤝🔐
As the academic sector remains on the frontline of the battle for information, proactive measures are crucial to protect against espionage and ensure the integrity of research endeavours. 💻🛡️
🗞️ Extra, Extra! Read all about it! 🗞️
Every few weeks, we carefully select three hot newsletters to show you. Reputation is everything, so any links we share come from personal recommendation or carefully researched businesses at the time of posting. Enjoy!
🛡️ Tl;dr sec: Join 30,000+ security professionals getting the best tools, blog posts, talks, and resources right in their inbox for free every Thursday 📅
💵 Crypto Pragmatist: Crypto made simple. Actionable alpha in 5 minutes, 3x a week. Join 47,000+ investors and insiders, for 🆓
📈 Bitcoin Breakdown: The best in Bitcoin, carefully curated by an alien from the future 👾
Let us know what you think.
So long and thanks for reading all the phish!
