attack - TPD's Blog

Increasing malware attacks on Linux makes trouble for Businesses

Linux servers and cloud infrastructure are being targeted in a rapid way to penetrate ransomware, cryptojacking attacks, illegal activities, and many businesses are leaving themselves vulnerable to attacks because their Linux infrastructure is misconfigured or poorly managed.

According to VMware cybersecurity researchers, malware targeting Linux-based systems is growing in volume and complexity, with a lack of attention on controlling and identifying threats against them. This follows an increase in the adoption of cloud-based services by businesses due to the emergence of hybrid working, with Linux being the most frequent operating system in these settings.

BlackByte Ransomware breaks US Critical Infrastructure Security

In the previous three months, the BlackByte ransomware group has infiltrated the networks of at least three firms in the US critical infrastructure sectors, according to the FBI. This was revealed in a joint cybersecurity advisory issued by TLP: WHITE and the US Secret Service on Friday.

According to the federal law enforcement agency, BlackByte ransomware had infected multiple the US and foreign businesses as of November 2021, including entities in at least three critical infrastructure sectors in the US, including government facilities, financial institutions, and food and agriculture. BlackByte is a ransomware-as-a-service (RaaS) group that encrypts files on infected Windows host systems, including physical and virtual servers.

Cyber-attack on ICRC

Server with personal information of above 500,000 people faced a complex Cyber security attack. That information is linked with data from Red Cross and Red Crescent Movement. This incident triggered the renowned organizations to re-check and test the security of their data.

The server containing various services and information that ICRC was working on to reconnect people separated by wars, violence, etc. was detected an anomaly. And when the deep investigation was conducted, it was found that hackers took over the system and can access the data. To reduce the damage and to ensure the security of accessed data ICRC was forced to shut the servers off. Further to estimate the loss and identify the loopholes in the system independent audit firm was hired. Still, the genuine and authentic information regarding the hosts of the attack has not been confirmed. No ransom has been demanded in exchange for data so even a random guess or illogical move would create a blunder. ICRC is willing to communicate directly and confidentially so the hackers would respect the humanitarian action and the principles of ICRC would be preserved.

Artificial Intelligence for Cyber Security

AI is always known to be by learning. By digesting billions of data items, AI enhances its ability to “understand” cybersecurity dangers and risks. AI reasoning identifies risks more quickly. In seconds or minutes, AI evaluates correlations between risks such as malware files, strange IP addresses, or insiders.

Hackers can defeat security algorithms by targeting the data they train on and the warning flags they search for, thus machine learning and artificial intelligence can assist protect against cyber-attacks. According to internet statistics, the global market for artificial intelligence in cybersecurity is predicted to increase at a CAGR of 23.6 percent from 2020 to 2027, reaching $46.3 billion.

Because AI and machine learning can swiftly scan billions of data sets and hunt down a wide range of cyber dangers, from malware to shady behavior that could lead to a phishing attack, they are becoming increasingly crucial in cybersecurity.

Artificial intelligence aspires to mimic human intelligence. It has enormous potential in the field of cybersecurity. Artificial Intelligence (AI) systems can be trained to provide threat warnings, identify new types of malware, and protect critical data for enterprises if used correctly.

Intrusion Detection using Machine Learning

Telecom operators are currently using Artificial Intelligence (AI) technologies to improve their services. Cloud providers are beginning to provide AI as a service, making the technology available to all customers. Compromising an operator is valuable to the attacker, and using AI to increase their success rate is considered a technique to do so. Telecommunications providers are also under attack from two directions: direct attacks from cybercriminals attempting to compromise their organization and network operations, and indirect attacks from those attempting to steal their subscribers’ data. Many classic attack vectors are present among the top threats now attacking each of these frontlines, but with new twists in terms of complexity or size that place new demands on telecoms businesses. The following are some of the threats:

Distributed Denial of Service (DDoS) attacks
The exploitation of vulnerabilities in network and consumer devices
Compromising subscribers with social engineering, phishing or malware
Insider threat