Author: Crystal Hewett

Deadbolt Ransomware Hits More Than 3,600 QNAP NAS Devices

Deadbolt ransomware hits more than 3,600 QNAP NAS devices – The Record by Recorded Future

More than 3,600 network-attached storage (NAS) devices from Taiwanese company QNAP have been infected and had their data encrypted by a new strain of ransomware named Deadbolt.

According to a copy of the ransom note, device owners are told to pay up to 50 Bitcoin ($18.6 million) to release a master decryption key that unlock all of the victims’ files.

Although at least 3,600 QNAP NAS devices have been hit so far by the attackers, QNAP was quick to formally acknowledge the attacks, after hundreds of users flocked to its support forum to report their files being encrypted.

While it is unclear if QNAP has been in contact with the attackers or if it had paid any ransom demand, the company has silently force-installed several firmware updates for some of its customers, according to one of its support agents` comments on Reddit.

Deadbolt and other ransomware attacks are still continuing to take place. The Australian Cyber Security Centre (ACSC) receive average of 164 cybercrime reports per day, or one report every 10 minutes.

Protect your business from the threat of a cyber attack today. Contact Acurus for a free assessment on your organisations cyber security below.

Contact



    How Microsoft Aligns and Matures Essential 8 Mitigation Strategies

    The Essential Eight are a baseline set of security controls that been recommended by The Australian Cyber Security Centre to help mitigate malicious cyber activity for organisations. To help with the implementation of these controls, the Australian Signals Directorate (ASD) has defined an Essential Eight maturity model, detailing the different levels of maturity to help organisations fully align with the Essential Eight. Microsoft have aligned applications and programs to assist with this process. Microsoft have solutions aimed at 5 of the Eight controls as detailed further below:

    1. Patching of Operating Systems & Applications

    Maturity Level 1: partly aligned, “extreme risk” vulnerabilities are handled within 1 month
    Maturity Level 2: mostly aligned, the window narrows to 2 weeks
    Maturity Level 3: fully aligned, “extreme risk” vulnerabilities must be dealt within 48 hours with automated confirmation of successful patching, and removal of software no longer supported by the vendor.

    Microsoft Solutions for Patch Management

    • Microsoft Endpoint Manager
    • Windows Update for Business
    • Microsoft Defender for Endpoint

    2. Multifactor Authentication & Restrict Admin Privileges

    Maturity Level 1: use MFA to authenticate all users of remote access solutions.
    Maturity Level 2: use MFA to authenticate all users of remote access solutions, and all privileged users (for example, system administrators) and any other positions of trust.
    Maturity Level 3: use MFA to authenticate all users of remote access solutions, and all privileged users (for example, system administrators) and any other positions of trust, and all users when accessing important data repositories.

    Microsoft Technology for MFA

    • Azure AD MFA

    3. Application Controls

    Maturity Level 1: application control of executables for workstations and servers
    Maturity Level 2: builds on Level One, extending application control to include executables, software libraries, scripts, and installers
    Maturity Level 3: builds on Level Two, adding Microsoft’s latest block rules to prevent application whitelisting bypasses.

    Microsoft Solutions to Control Applications

    • Windows Defender Application Control
    • AppLocker
    • AaronLocker

    4. User Application Hardening & Office Macros

    Maturity Level 1: Users must first approve execution of macros, users cannot change macro settings, browsers must
    block or disable Flash
    Maturity Level 2: Builds on Level 1 to also block macros in documents from the Internet, and to block web ads and Java in browsers.
    Maturity Level 3: Builds on Level 2 and Level 1 to restrict macros to those from trusted sources and to disable Flash and Object Linking and Embedding (OLE) in Microsoft Office.

    Products Within Microsoft Office:

    • Active Directory
    • System Center Configuration Manager (SCCM)
    • Intune
    • Microsoft Defender Application Guard
    • Microsoft Defender for Office 365
    • Cloud-powered Microsoft Defender for Endpoint

    5. Daily Updates

    Maturity Level 1: Make monthly backups of key data, store for 1 to 3 months, and test partially at least once per year
    Maturity Level 2: Shift gears to back up weekly instead of monthly, on non-rewritable media, with full testing at least once a year and partial testing at least twice a year
    Maturity Level 3: Shift gears again to back up daily, store for at least 3 months, test full restoration at the start and when technology changes, with partial testing at least once per quarter.

    Microsoft Solution for Daily Backups

    • Azure Backup
    • Office 365 Backup

    Acurus has assisted iconic Australian brands in building their cyber security foundations to align with the Essential 8. We can help you to create a unified solution, which meets all needs of the Essential 8 and mitigates malicious cyber activity for your organisation.

    If you’d like help with developing or implementing your essential 8 strategy contact us on 1300 119 561 or let us contact you by expressing your interest below.

    Contact



      What is the Essential 8 and Why Should You be Interested?

      What is the Essential 8?

      The Essential Eight is a baseline set of mitigation strategies that have been developed by the Australian Cyber Security Centre (ACSC). These mitigation strategies have been developed by the ACSC to help organisations protect themselves against various cyber threats regardless of their industry.

      1. Application Control

      2. Application Patching

      3. Configure Microsoft Office Macro Settings

      4. User Application Hardening

      5. Restrict Administrative Privileges

      6. Patch Operating Systems

      7. Multi-factor authentication

      8. Daily Backups

      While implementation of the Essential Eight does not guarantee against cyber attacks, it significantly reduces your organisation’s attack surface, the risk of being compromised, and your ability to successfully recover/continue business if you are attacked.

      Why the Essential 8?

      As COVID-19 has changed the landscape of organisations, increasing the number of remote workers, cyber attacks have also evolved to target businesses through differing mechanisms. In an effort to protect your organisation, the Essential 8 allows you to implement a cyber threat management strategy and maturity journey. Implementing the Essential 8 is a journey. It allows for quick improvements of your overall cyber security, while giving a clear roadmap to long term improvements.

      How will Acurus help you achieve compliance?

      Leveraging our extensive cyber security experience, Acurus will significantly improve your organisation’s cyber threat management capabilities. Partnering with leading technology vendors like Microsoft, Fortinet and Tanium, Acurus can perform a comprehensive cyber security gap assessment, and create a plan unique to your business to address each area of the Essential 8.

      Utilising features from our partners Acurus can quickly and efficiently:

      • Align your endpoints to a common security standard, facilitating User Application hardening and restricting administration privileges
      • Enable Application Control and Patching, including managing office macro settings
      • Remove unwanted 3rd party applications
      • Perform vulnerability scanning
      • Detect unmanaged endpoints
      • Efficiently patch operating systems

      Acurus will help you to create a unified solution, which meets all needs of the Essential 8, while also simplifying endpoint management, allowing them to be viewed and managed from a single dashboard, maximising your resources and driving down your 3rd party software exposures.

      If you’d like help with developing or implementing your essential 8 strategy contact us on 1300 119 561 or let us contact you by expressing your interest below.

      Contact

       



        30% Rise In Ransomware Attacks Over Holiday Season

        Report reveals 30% rise in ransomware attacks during the holidays – Cyber Security Connect

        Darktrace has reported that its security researchers discovered a 30% increase in the average number of attempted ransomware attacks globally over the holiday season in every consecutive year from 2018 to 2020 compared, with the monthly average.

        According to Justin Fier, director of cyber intelligence and analytics at Darktrace, the largest rise in attempted ransomware attacks is between Christmas and New Year’s when attackers know there will be fewer eyeballs on screens defending against threats.

        “Based on what we’ve seen in previous years, holidays are consistent target periods for cyber attackers.” He said.

        “Business leaders should know that there is available technology that can identify and respond to the initial warning signs of ransomware before attackers can hold critical systems hostage, even when human security teams are out of office.”

        For over ten years, Acurus has helped businesses defend their online assets through 24/7 monitoring and safeguarding of their digital security.

        Don’t be victim to ransomware this Christmas. Contact us today for a free assessment on your organisations cyber security. Work from Anywhere Securely – Acurus

        SA Government Hit By Cyber Attack

        SA government hit by cyber attack – Cyber Security Connect

        South Australian Premier Steven Marshall is among 38,000-80,000 employees with personal information exposed as a result of a ransomware attack on external  payroll software  provider Frontier Software.

        According to the SA government, the personal information includes names, dates of birth, tax file numbers,  home addresses, bank account details, remuneration and superannuation contributions.

        The breach is currently under investigation, with the government offering support to affected employees.

        As organisations become more reliant on SaaS products, it’s crucial when making purchasing decisions to consider  potential SaaS providers’ security posture and practices, as it can and will have direct impacts on their customers  when they suffer outages due to cyber incidents.

        Attackers are increasingly using an organisation’s supply chain partners to gain access to confidential and sensitive  information, particularly if they identify a weak link. As such, it’s imperative organisations are working closely with  their supply chains to understand the security of businesses they collaborate with and work together to address  vulnerabilities.

        For over ten years, Acurus has been trusted by Australia’s largest household brands, including Energy Australia, Officeworks, Bakers Delight, Red Energy, and Reece Plumbing.

        If you need cyber security assistance, post incident or need to bolster your cyber security position to avoid detrimental attacks contact us today for free cyber security gap assessment. Work from Anywhere Securely – Acurus

        Zoho: Patch new ManageEngine bug exploited in attacks

        Zoho: Patch new ManageEngine bug exploited in attacks ASAP (bleepingcomputer.com)

        Business software provider Zoho urged customers today to update their Desktop Central and Desktop Central MSP installation to the latest available version.

        Zoho’s ManageEngine Desktop Central is a management platform that helps admins deploy patches and software automatically over the network and troubleshoot them remotely.

        The warning comes after the company patched a critical vulnerability which could allow attackers to bypass authentication and execute arbitrary code on unpatched ManageEngine Desktop Central servers.

        A quick search using Shodan has revealed over 3,200 ManageEngine Desktop Central instances running on various ports and exposed to attacks.

        For over ten years, Acurus has been trusted by Australia’s largest household brands, including Energy Australia, Officeworks, Bakers Delight, Red Energy, and Reece Plumbing.

        If you need cyber security assistance, post incident or need to bolster your cyber security position to avoid detrimental attacks contact us today for free cyber security gap assessment. Work from Anywhere Securely – Acurus