New Python-based FBot Hacking Toolkit Aims at Cloud and SaaS Platforms

A new Python-based hacking tool called FBot has been uncovered targeting web servers, cloud services, content management systems (CMS), and SaaS platforms such as Amazon Web Services (AWS), Microsoft 365, PayPal, Sendgrid, and Twilio. “Key features include credential harvesting for spamming attacks, AWS account hijacking tools, and functions to enable attacks against PayPal and various

Indian Hack-for-Hire Group Targeted U.S., China, and More for Over 10 Years

An Indian hack-for-hire group targeted the U.S., China, Myanmar, Pakistan, Kuwait, and other countries as part of a wide-ranging espionage, surveillance, and disruptive operation for over a decade. The Appin Software Security (aka Appin Security Group), according to an in-depth analysis from SentinelOne, began as an educational startup offering offensive security training programs, while

CISA and FBI Issue Warning About Rhysida Ransomware Double Extortion Attacks

The threat actors behind the Rhysida ransomware engage in opportunistic attacks targeting organizations spanning various industry sectors. The advisory comes courtesy of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC). "Observed as a ransomware-as-a-service (RaaS)

Chinese Hackers Target Middle East Telecoms in Latest Cyber Attacks

A malicious campaign targeting the Middle East is likely linked to BackdoorDiplomacy, an advanced persistent threat (APT) group with ties to China. The espionage activity, directed against a telecom company in the region, is said to have commenced on August 19, 2021 through the successful exploitation of ProxyShell flaws in the Microsoft Exchange Server. Initial compromise leveraged binaries

How to Protect Yourself From Tailgating Attacks

Holding the door for someone might open the way to a cyberattack. For anyone who works in a secure building or workplace, they might want to rethink that courtesy. The hackers and thieves behind piggybacking and tailgating attacks count on it. 

Piggyback and tailgating attacks occur when an unauthorized person gains access to a restricted workplace, one that requires some form of ID to enter. While quite similar, these attacks have an important difference: 

• Piggybacking occurs when a person knowingly allows an unauthorized person into a restricted location—such as holding a secured door open for them. 
• Tailgating occurs when an unauthorized person slips into a restricted area without someone knowing—perhaps because someone left a secured door ajar. 

In both cases, these unauthorized entries can put businesses and organizations at risk. They give potential bad actors all kinds of access to sensitive information and devices.  

Trade secrets get stolen this way, as does customer information. In yet more malicious cases, bad actors might gain entry with the intent of sabotaging technology or hijacking a network. And of course, bad actors might do harm to people or property. 

Businesses and organizations that find themselves at risk include those that: 

• Have many employees, often moving inside and out of the premises. 
• Have multiple entrance points into a building. 
• Receive deliveries of food, packages, and documents regularly. 
• Employ a sizable number of subcontractors. 
• Lack training in physical and cybersecurity protocols. 

Different businesses and organizations have different forms of security in place. You might be among the many who use a smart badge or some form of biometric security to enter a building or certain areas within a building. 

However, determined bad actors will look for ways around these measures. With piggyback and tailgating attacks, it’s far easier for them to follow someone into a workplace than it is to break into a workplace. 

Common types of piggybacking and tailgating attacks 

Bad actors will simply walk in when someone holds the door for them. It’s as simple as that. Additionally, they’ll try several different tricks by: 

• Posing as a delivery driver bringing in packages or food. 
• Claiming they work in the building and that they left their ID at home. 
• Carrying a bulky load of boxes and hoping you’ll open the door to help. 
• Disguising themselves as a vendor, like a service worker or IT consultant. 
• Similarly, disguising themselves as an executive or V.I.P. who’s in a hurry. 

In all, piggybacking and tailgating attacks rely on social engineering—playing off people’s innate courtesy, willingness to help, or even discomfort with conflict. Essentially, the attacker manipulates human nature. 

How to prevent piggybacking and tailgating attacks 

A good portion of prevention falls on the owner of the building, whether that’s a business, organization, or a landlord. It falls on them to install security hardpoints like badge scanners, keypad locks, biometric scanners, and so on to keep the property secure. Moreover, employers owe it to themselves and their employees to train them on security measures.  

Yet you can take further steps to prevent a piggybacking or tailgating attack on your workplace. Some steps include: 

• Don’t hold the door for anyone you don’t recognize as an employee. 
• Direct strangers who appear lost to a reception area. 
• Always close secure doors and ensure they lock. 
• Report any issues with a secure door, such as if it doesn’t close properly or closes too slowly. 

Also consider the security of your devices or any other sensitive information you work with. If a bad actor slips into your workplace, you can take other steps to prevent theft or damage. 

• Use a lock screen on your computer to prevent access to networks and files. 
• Consider tethering your laptop to your desk with a laptop lock to prevent grab-and-run theft. 
• Securely store any printed materials.  
• Keep your personal items on your person, like your keys, smartphone, and other valuables. 

Don’t hold the door 

Some aspects of piggybacking and tailgating prevention seem like they go against our better nature. We want to be kind, helpful, and sometimes we’d simply rather avoid confrontation. Again, piggybackers and tailgaters count on that. Yet a door is only as secure as the person who uses it—or who opens it for someone else.  

The post How to Protect Yourself From Tailgating Attacks appeared first on McAfee Blog.

Implementing Defense in Depth to Prevent and Mitigate Cyber Attacks

The increased use of information technology in our everyday life and business has led to cyber-attacks becoming more sophisticated and large-scale. For organizations to thrive in this era of technology, they must develop robust security strategies to detect and mitigate attacks. Defense in depth is a strategy in which companies use multiple layers of security measures to safeguard assets. A

CISA Warns of Daixin Team Hackers Targeting Health Organizations With Ransomware

U.S. cybersecurity and intelligence agencies have published a joint advisory warning of attacks perpetrated by a cybercrime gang known as the Daixin Team primarily targeting the healthcare sector in the country. "The Daixin Team is a ransomware and data extortion group that has targeted the HPH Sector with ransomware and data extortion operations since at least June 2022," the agencies said. The