Although many people in the Western world remember Huawei as a pioneering smartphone brand, the main business of the company was selling 5G telecommunications equipment before the US government blacklisted Huawei due to national security fears. However, according to a new report from the Asia Times, this decision to ban Huawei from participating in the development of 5G networks could have economic repercussions of over $100 billion to the US and its allies.
Concerns about Huawei first arose in 2019 when the Trump administration banned the company from doing business, citing that Huawei was covertly accessing sensitive information and sending it back to China. While no concrete evidence of espionage activities was shared with the public, the subsequent Biden administration strengthened these sanctions to impede China’s access to advanced technologies, including high-end semiconductors.
However, this ongoing tech war between the two economies is impacting various stakeholders, including network operators, consultants, economists, and governments worldwide. According to a study by the Oxford Institute of Economics, opting for alternatives to Huawei will increase the overall cost of implementing 5G by over 19%. Furthermore, in a median cost scenario, this ban could lead to a $105.5 billion reduction in the GDP of countries like Australia, Canada, France, Germany, Japan, India, the United Kingdom, and the United States by 2035.
Repercussions of the Ban on Sales to Huawei
The recent ban on sales to Huawei will not only constrain the company’s ability to conduct business but also have a ripple effect on the entire supply chain, as companies like Qualcomm would lose one of their biggest customers. Therefore, policymakers will need to balance the economic benefits of utilizing Huawei’s equipment with national security risks, as telecommunication networks are vital for a nation’s development and form the backbone of advanced economies.
Alternatively, the US and its allies can develop their telecom technology, like South Korea and Japan, to reduce reliance on foreign suppliers and establish domestic intellectual property and supply chains.
In total, 26 separate ransomware-as-a-service gangs contributed to the onslaught on education.
This article is based on research by Marcelo Rivero, Malwarebytes’ ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, “known attacks” are those where the victim didn’t pay a ransom. This provides the best overall picture of ransomware activity, but the true number of attacks is far higher. For regular ransomware gang updates, check out our monthly ransomware reviews.
Ransomware gangs have made the past year a hard one for the education sector.
Between June 2022 and May 2023, there were 190 known ransomware attacks against educational institutions, and many more that went unreported and unrecorded. Between the first and second six months of that period, education experienced an 84% increase in attacks.
Known ransomware attacks against education, June 2022-May 2023
Although the attacks were carried out by a large number of different ransomware gangs, one in particular was responsible for the lion’s share (23%). Vice Society is a gang that specializes in attacking education, and almost half of its activity (43%) is directed against the sector.
Distribution of Vice Society attacks vs other ransomware gangs, June 2022-May 2023
Further findings from the data show that, while ransomware attacks against education are a global phenomenon, the USA (with 56% of known attacks) and the UK (with 15%) were hit the most frequently attacked countries between June 2022 and May 2023.
We’ll spend the rest of this blog breaking down attacks on education by gangs, countries, and which gangs attack which countries the most.
The Threat Landscape
The leading gangs that targeted the education sector between June 2022 and May 2023 include Vice Society with 43 attacks, LockBit with 33, BianLian (18), Royal (16), and AvosLocker (15).
A few of the educational institutions attacked in the last year include De Montfort School, Cincinnati State, and one that made national headlines in September: Los Angeles Unified, the second largest school district in the US. The stakes are no joke: schools and colleges have suffered an estimated 1,600 days of downtime due to ransomware attacks, and the average cost of a ransomware breach was $4.54 million in 2022.
Top ten ransomware used in attacks against education, June 2022-May 2023
In total, 26 separate ransomware-as-a-service gangs contributed to the onslaught on education.
Geographic Distribution
When we break down education sector attacks by country, it becomes clear that no region is safe from ransomware. The USA bore the brunt, with 107 reported attacks.
Known attacks on education by country, June 2022-May 2023
The United Kingdom followed distantly with 28 known attacks, while other countries like Canada, Germany, Brazil, and others also fell prey to these cybercriminals.
Comparatively speaking, however, the education sector in the UK suffered far more than in other countries. Education was the target in 15% of known attacks in the UK from June 2022 to May 2023, compared to only 3% in France, 4% in Germany, and 8% in the USA.
The Gang-Country Dynamics
In general, the ransomware activity of the top gangs seems to adhere to a common trend: Most of them spread their attacks across multiple countries, displaying a diverse geographical targeting.
However, we do find an intriguing outlier that challenges the established patterns: Vice Society’s strong focus on the United Kingdom. Vice Society was responsible for 66% of known attacks on UK education institutions May 2022 to April 2023.
UK education ransomware attacks by gang, June 2022-May 2023
It is worth remembering that our numbers only reflect attacks where a ransom wasn’t paid, and the true number of attacks is far larger.
This activity is distinct from the typical spread of ransomware attacks seen among other top gangs, which generally have a more balanced distribution across several countries, including the United States, Canada, and various European countries, charted below.
USA education ransomware attacks by gang, June 2022-May 2023
Global education ransomware attacks by gang, June 2022-May 2023
Looking Ahead
To recap, our key findings include:
A significant increase in attacks: The education sector experienced a steep rise in ransomware attacks, with a 84% increase observed over a 6-month period. This was the third highest increase among all monitored sectors.
Leading ransomware gangs: Vice Society was the most active ransomware gang in the education sector, responsible for 23% of all attacks. LockBit and BianLian also targeted the sector heavily, alongside a host of other groups.
Geographic distribution: The USA bore the brunt of the attacks, accounting for more than 50% of the total, while the UK accounted for 15%. However, relative to the total number of attacks in each country, the education sector in the UK was targeted more frequently.
Vice Society’s unusual UK focus: Vice Society focused heavily on the UK education sector, responsible for 64% of all known ransomware attacks on this sector. This contrasts with the typical distribution of ransomware gangs in a given country, which is usually spread more or less proportionally.
Looking ahead, it is anticipated the trend of ransomware gangs targeting the education sector will persist or even intensify. The reality is that tight budgets of many educational institutions force them to struggle with outdated equipment and limited staff, making them an easy target for ransomware gangs.
But with knowledge comes power. The more the education sector knows about ransomware threats like Vice Society, the better prepared they are to defend against them.
Prevent intrusions. Stop threats early before they can even infiltrate or infect your endpoints. Use endpoint security software that can prevent exploits and malware used to deliver ransomware.
Detect intrusions. Make it harder for intruders to operate inside your organization by segmenting networks and assigning access rights prudently. Use EDR or MDR to detect unusual activity before an attack occurs.
Stop malicious encryption. Deploy Endpoint Detection and Response software like Malwarebytes EDR that uses multiple different detection techniques to identify ransomware, and ransomware rollback to restore damaged system files.
Create offsite, offline backups. Keep backups offsite and offline, beyond the reach of attackers. Test them regularly to make sure you can restore essential business functions swiftly.
Don’t get attacked twice. Once you’ve isolated the outbreak and stopped the first attack, you must remove every trace of the attackers, their malware, their tools, and their methods of entry, to avoid being attacked again.
Amazon has just marked down the Google Pixel Buds Pro, making them very affordable once again. They are now just $159.99. This is not quite an all-time low for the Pixel Buds Pro, but it is the lowest we’ve seen since Black Friday last November.
Pixel Buds Pro are the first “pro” pair of earbuds from Google, giving you better battery life, but more importantly ANC. So with this pair of earbuds, you can get up to 11 hours of continuous playback, and up to 31 hours with the included carrying case. That carrying case isn’t super bulky either. It’s about the same size as the older Pixel Buds, which is really more of an egg size.
Google made the Pixel Buds Pro to fit comfortably in your ears. They were designed for a comfortable, secure fit with sensors that help to reduce the plugged-ear feeling.
You can make and take calls on the Pixel Buds Pro. Thanks to the beamforming mics, you’re going to get crystal clear calls, even in noisy settings. As they are able to block out the background noise. Like with Airpods, the Pixel Buds Pro can easily switch between your devices. So you can go from using them with your phone, to your tablet, or your laptop. That’s thanks to Google’s Fast Pair feature.
Finally, the Pixel Buds Prom are also water resistant. So you can wear them in the rain, or to the gym, and not worry about them getting damaged at all. That’s a big deal if you’re looking for a pair of earbuds to wear at the gym to workout with. Not to mention they sound incredible when using them at the gym, or really anywhere else.
You can pick up the Google Pixel Buds Pro from Amazon today by clicking here. This sale won’t last long though.
As ChatGPT goes on a record-breaking run, Google Bard is slowly catching up to it. After a host of updates in May, Google began June by giving its generative AI tool access to your precise location (with your permission) so it could provide more accurate local results. Now, the company is readying several new features for the tool.
Google Bard will save your chat history and let you upload files
According to reputed app researcher Jane Manchun Wong, who has an excellent track record of finding unreleased or in-development features, Google Bard will soon gain support for chat history. The service currently doesn’t retain your previous queries on the website itself. You can only check your Bard activity through your Google account. Even then, you can only see your queries but not Bard’s responses. ChatGPT, on the other hand, keeps your chat history readily accessible on the website and lets you jump to it with a single click.
Additionally, Google will let you rephrase Bard’s responses according to specific tones. Wong says you’ll be able to make the responses more formal, more casual, funnier, shorter, or longer. It appears these options will reside within a new button in the bottom toolbar where you currently find buttons to like/dislike a response or Google your query for more results. Microsoft has added a similar function to its ChatGPT-powered Bing AI chatbot on its SwiftKey keyboard app. It lets you refine any text in Professional, Social Post, Casual, and Polite tones.
The same toolbar will seemingly contain a button to share a file with Bard. You can upload a file directly from your computer or pull one up from Google Drive. Last but not least, Google is readying text-to-speech support for Bard. Once available, you will be able to convert Bard’s text responses to audio. ChatGPT doesn’t have these abilities, though OpenAI could be working on new updates for the tool. These new Bard features are still in development too. It’s unclear when Google plans to roll them out. We will let you know when we have more information.
The most recent update for Bard allows it to request access to your precise location. Google says this will enable the service to give your more accurate results when searching for restaurants or other points of interest nearby. Currently, Bard uses the location details from your places (home or work addresses) or IP addresses. Google’s AI tool is available in English, Japanese, and Korean languages in more than 180 countries and territories.
A new web skimming campaign uses compromised legitimate sites to act as command and control servers.
Security researchers at Akamai have published a blog about a new Magecart-alike web skimming campaign that uses compromised legitimate sites as command and control (C2) servers.
A web skimmer is a piece of malicious code embedded in web payment pages to steal personally identifiable information (PII) and credit card details from customers of the site.
Since the code is executed on the client’s side, the malicious behavior is hard to detect by the website’s owner since it will not be picked up by web application firewalls (WAFs) and other measures to keep the server safe.
This campaign is different since it relies on legitimate but compromised sites to make the traffic look genuine. Since these sites normally operate as legitimate businesses, they are less likely to raise suspicion when connecting to a victim. The target sites are running digital content management systems like Magento, WooCommerce, WordPress, and Shopify, but contain a variety of vulnerabilities.
The Akamai researchers uncovered numerous digital commerce websites that have fallen victim, and say that it is reasonable to assume that there are additional legitimate websites that have been exploited as part of this extensive campaign.
Some of the victim organizations see hundreds of thousands of visitors per month which could potentially result in thousands of victims that have their credit card data and PII stolen. Especially since the campaign has been going unnoticed for close to a month for many of the victims.
In this campaign there were two kinds of victim sites:
Host victims: Legitimate websites that are hijacked for the purpose of hosting the malicious code used in the attack. They are compromised to behave as an attacker-controlled server.
Web skimming victims: Instead of directly injecting the attack code into the website’s resources, the attackers employ small JavaScript code snippets as loaders to fetch the full attack code from the host victim website.
In some cases, the exploited host websites appear to have been abused in both ways.
The code used on the web skimming victims is designed to look like popular third-party services such as Google Tag Manager or Facebook Pixel. This method is popular among web skimmers because it helps the malicious code blend in seamlessly, disguising its true intentions.
CMS security in a nutshell
Spilling your customers’ PII and credit card details can be very damaging for your reputation, so it’s important to make sure they can visit and use your website safely.
There are a few obvious and easy-to-remember rules to keep in mind if you want to use a CMS without compromising your security:
Choose your CMS with both functionality and security in mind
Choose your plug-ins wisely
Update as soon as you can
Keep track of the changes to your site and their source code
If you allow uploads, limit the type of files to non-executables and monitor them closely.
For websites that require even more security, there are specialized vulnerability scanners and application firewalls that you may want to look into. This is especially true if you are a popular target for people that would love to deface or abuse your website.
If the CMS is hosted on your own servers, be aware of the dangers that this setup comes with some additional risks. Use network segmentation to keep the website server separated from other work servers.
IOCs
Malwarebytes Browser Guard blocks the receiving domains of the stolen data:
byvlsa.com
chatwareopenalgroup.net
Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.
Twitter has been on shaky ground for several months now, and it seems that things are not looking up just yet. According to a report from The New York Times, the number of US users using Twitter to post ads is declining.
One of the major issues that Twitter dealt with after Elon Musk took over was the Exodus of many people using Twitter for ad space. Selling ads is a major source of income for Twitter, and Elon Musk bought the company with the sole plan of making it profitable. So, this was an issue.
Elon Musk even stated that “Almost all advertisers have come back”, and that the company’s ad business was up and running again. However, the reality for US-based users might not be so bright.
US users don’t want to use Twitter for ads
Despite Elon Musk’s claims, the number of US users using Twitter as their personal billboard is dropping. Between the first week of April and the first week of May, Twitter wracked in 89 million dollars from its US ad business. That’s a whopping 59% drop year over year. It’s a tough break for the company.
An internal document states that the company does normally fall short of its US weekly sales projections, and it could be by as much as 30%. Still, a 59% drop year over year points to a major issue.
The company’s ad staff points to the current content on Twitter as being the culprit behind this. They pointed to factors like pornography, hate speech, and ads featuring marijuana and online gambling. Not many people want to advertise in a market with so much negative content. Thus, they’re taking their ad money to different platforms. This is similar to why a lot of advertisers exited YouTube.
It seems bleak, and it’s only made worse by the fact that the company projects that its US Revenue could see a 56% drop each week compared to the same time last year. Only time will tell if Twitter can revitalize its ad business.
The company did recently employ Linda Yaccarino, the NBCUniversal executive. Hopefully, she will be able to push Twitter into a new direction.
According to the BBC, senior NBCUniversal executive Joe Benarroch has joined Twitter. He’s the second Twitter executive that’s coming from NBCUniversal.
Last month, Elon Musk appointed Linda Yaccarino as the new chief executive of Twitter. She previously served as NBCUniversal’s head of advertising. The billionaire clarified that Yaccarino would focus on business operations while he stayed focused on product development. Now, Twitter has snapped up its second executive from NBCUniversal again as a part of Musk’s efforts to reshape the Twitter leadership team.
Senior NBCUniversal executive Joe Benarroch joins Twitter
Benarroch’s responsibility in Twitter boils down to focusing on business operations in the company’s New York office. According to Benarroch’s Linkedin profile, he has worked as an executive and senior vice president of communications and advertising at NBCUniversal since 2018. Benarroch work records also show he’s been employed at Facebook from 2012 to 2018.
“I am looking forward to bringing my experience to Twitter and to working with the entire team to build Twitter 2.0 together,” Benarroch said in his latest Linkedin post.
Benarroch’s contribution to the platform is yet to be discovered. However, his prolific experience in advertising and communications could help Twitter makeover its business model and reduce its reliance on plummeting advertising revenues.
Since Musk’s takeover, many Twitter executives have left the company for various reasons and were replaced by Musk like-minded people. But it seems that even these new people don’t have a guaranteed role in the company. Last week, Twitter’s head of trust and safety, Ella Irwin, left the company. She was supposed to be the successor of former head Yoel Roth, who resigned in November 2022.
The reasons for Irwin’s departure are yet unknown. However, some reports claim that Elon Musk and Irwin had a disagreement over Twitter content moderation policies. The departure came after Musk publicly criticized Twitter’s decision to limit the visibility of the “What is a Woman” documentary by the conservative media DailyWire. Musk said, “This was a mistake by many people at Twitter.” The issue was solved after Musk’s intervention.
Ransomware is creating additional work for a major Spanish bank. Globalcaja, said to have more than 300 offices in Spain and close to half a million customers, has fallen victim to the Play ransomware gang.
The gang claim to have swiped both private and personal information in the attack—including passport scans, contracts, and client / employee documents—which happened last week, but have not revealed exactly how much has been taken. The bank released a statement on June 2, which reads as follows:
COMUNICADO OFICIAL
En el día de ayer, registramos un ciberincidente, consistente en un ataque informático a algunos equipos locales a través de un virus tipo #ransomware.
El mismo no ha afectado al transaccional de la entidad (ni las cuentas ni los acuerdos de los clientes se… pic.twitter.com/LeQdNN8r1i
Yesterday, we registered a cyber incident, consisting of a computer attack on some local computers through a type #ransomware virus.
It has not affected the transaction of the entity (neither the accounts nor the agreements of the clients have been compromised), so it can operate with total normality in electronic banking (Ruralvía), as well as in ATMs.
From the outset, in #Globalcaja we activated the security protocol created for this purpose, which led us, out of prudence, to disable some office posts, temporarily limiting the performance of some operations.
We continue to work hard to finish normalizing the situation and analyze what happened, prioritizing security at all times.
We apologize for any inconvenience caused.
According to The Record, the bank has not said whether or not a ransom will be paid to the attackers. If there is a bright side here, it’s that people’s actual accounts and transactions have not been accessed. If the bank chooses not to pay the ransom, however, everything taken may be dumped online. Considering the haul is supposed to include passport scans and more, this may still end up causing many problems for those folks in the stolen data.
The Play Ransomware group will quite happily leak data in cases where no ransom is forthcoming. Data taken from the city of Oklahoma was leaked in small amounts in March of this year, after several service shutdowns caused by Play brought the city to a standstill. Elsewhere, the gang brought the city of Antwerp to a grinding halt (do you see a pattern here?) with a similar ransomware outbreak. They’re also responsible for the H-Hotel attack which followed the classic ransomware pattern of disrupt and exfiltrate where possible.
There’s no additional information on offer from Globalcaja, so if you’re a customer or client you’ll have to keep an eye on its website and social media channels for updates in the short term. The supposed publication date for the pilfered information is the June 11, so the clock is most definitely ticking.
Detect intrusions. Make it harder for intruders to operate inside your organization by segmenting networks and assigning access rights prudently. Use EDR or MDR to detect unusual activity before an attack occurs.
Stop malicious encryption. Deploy Endpoint Detection and Response software like Malwarebytes EDR that uses multiple different detection techniques to identify ransomware, and ransomware rollback to restore damaged system files.
Create offsite, offline backups. Keep backups offsite and offline, beyond the reach of attackers. Test them regularly to make sure you can restore essential business functions swiftly.
Don’t get attacked twice. Once you’ve isolated the outbreak and stopped the first attack, you must remove every trace of the attackers, their malware, their tools, and their methods of entry, to avoid being attacked again.
Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.
Motorola’s new Moto G stylus 2023 is the latest in the company’s line of affordable phones that come with a built-in stylus. Of course, you know that, seeing as you purchased one, and you’re looking for ways to personalize it. Well, here is a useful guy to help you customize the theme on your Moto G stylus 2023.
Before we get started, Android Headlines has more content for you to read on this phone. We have our full review which will explain the ins and outs of this phone’s performance, display, battery, Etc. Also, if you want to know how to stretch the battery life even further, you can click here.
How to customize the theme on your Moto G Stylus 2023
One thing about Motorola is that it gives you a ton of options to help you personalize the theme on your phone so that you feel like it’s your phone. This is great for people who love to tinker with the aesthetics of their software. It goes far beyond just changing the wallpaper, but that’s where we’re going to start.
Wallpaper
The first stop on our journey is changing the wallpaper. On the home screen, hold your finger down and wait for the drop-down menu to appear. Tap on the Wallpapers button. There, you will see the wallpaper customization UI. Up top, you’ll see a preview of your current wallpaper: how it looks on your lock screen and the home screen. Under that, you’ll see four buttons.
These are the options for the wallpapers that you can use. The My Photos button, obviously, will take you to your image library and let you assign your own wallpaper. The Stylized option will let you choose a photo from your gallery, and it will let you apply different photo effects to it. These include effects like monochromatism, embossing, watercolor, Etc.
The next button is the Dynamic button. You will see a collection of Motorola-specific wallpapers that will change. Some are live wallpapers, some will change based on the time of day, and some will change when you swipe the screen.
The last option is the Curated Image option. This is a constantly updating library of professionally photographed images provided by Google.
Simply tap on the photo or wallpaper you want to apply. When you do, you’ll have the option to apply it to your lock screen, only your home screen, or both.
System colors
One of the neat things you can do with this phone is change the overall color scheme of the software. Hold your finger down on the home screen, and press the Personalize button. There, you will see a grid of different ways you can customize your phone. Tap on the Colors option which is right under the wallpaper section.
There, you will see different ways that you can customize your phone’s color scheme. You can choose from one of the several basic colors. When you tap on one, you will see the preview above change to match the color. The multicolored wheel will allow you to dial in the specific hue of the color you want. When you do that, you will see that color added to the basic colors palette.
When you tap on the color wheel, you will see another option labeled Gallery. This will allow you to choose a picture from your gallery, and extract colors from that specific picture to use in your theme.
Wallpaper colors
One of the main features of material you, is the ability to take colors from your wallpaper and apply it to your color scheme. When you add a new wallpaper, the system will do that automatically. However, you have four options of colors extracted from your color scheme. Under the basic colors, you will see a section called Wallpaper Colors. Choose one of the four options, and that will be your new color scheme.
App icons
Your app icons are a big part of the theme on your Moto G Stylus 2023. This is why Motorola gives you some customization options for them. In the personalization screen, tap on the Icon Shape button to allow you to choose from five different shapes for your app icons. These are all pretty common app icon shapes, and you can choose which ones better suit your style.
Now, to adjust the layout. Of course, your apps sit on a grid on your phone, and you can adjust the grid so that you can fit more or fewer app icons on your screen. In the customization screen, tap on the Layout button in the bottom section.
You have seven different options for grid layouts. There’s 5×6, 5×5, 4×6, 4×5, 4×4, 3×4, and 2×2. When you tap on an option, you will see the preview change to show how it will look. The smaller the numbers get, the larger your app icons will be. So, if you have a hard time seeing the screen, then you may want to adjust the app credit accordingly.
Font & display size
Now, let’s adjust the font. On the personalization screen, tap on the Fonts section on the right side of the screen. This will give you four different options for different fonts that you can use. When you tap on one, the font will change across the entire interface.
When you’re done, back out and go to the Display Size and Text section on the bottom section. There, you will be able to adjust how large you want the text and the interface as a whole. There are four options for text size, if you have trouble seeing, then you will want to opt for a larger size. On the bottom, there’s the option to make the text bold and add an outline to the text to give it more contrast.
Display size
On the same screen, you can adjust the display size. Adjusting the display size will change the size of everything. This includes app icons,UI elements, and text.
Dark mode and Peak display
On the bottom of the personalize screen, you will see the dark mode option. Applying dark mode will turn all of the light elements in your UI to a dark shade of brown. This includes backgrounds, menus, and themed app icons.
When you go to the Dark Mode screen, you will have the option to enable and disable it. Also, you’ll have the option to have it turn on automatically When the sun goes down.
Peak display
The peak display is a dim screen that you see when your phone is locked, or asleep. It gives you a quick glance at the time, your battery, and your notifications. You can customize it using three different options. It’s also an important part of the theme on your Moto G Stylus 2023.
When you tap on the peak display option, you will see your choices. One will show the time and your battery percentage, one will show you the time and the weather, and the last one will show you an analog clock. You can choose the one that suits your fancy. The third option will give you some customization settings.
Pre-built themes
Lastly, there are some pre-built themes that you can quickly choose if you want to customize your phone in one tap. On the Themes option. This will show you five pre-built themes that have everything selected like the wallpaper, app icon shape, and color scheme.
When you tap on one, you will quickly see the theme applied to your phone. However, if you want to make your own theme, tap on the little “+” icon in the top right corner. This will show you a UI that will allow you to change the wallpaper, font, color, and icon shape for your theme. You can even name your theme.
With this knowledge, you can now fully personalize the theme on your Moto G Stylus 2023, and truly break it in. Stay tuned to Android Headlines for more news about this phone and other Android devices.
It’s no secret that over the past few years, threat actors have been ramping up their efforts to scam people of their hard-earned money and gain unauthorized access. However, according to a new report from cybersecurity researchers at Citizen Lab, scammers are now using PDF files to promote their online hacking services on various US government agency websites, including those of California, North Carolina, and New Hampshire, as well as on prominent university websites like UC Berkeley, Stanford, and Yale.
As per the report, the PDF files advertise a range of illicit services, including hacking into social media accounts like Instagram and Facebook, providing cheats for computer games, and generating fake followers. Moreover, these threat actors carefully crafted the PDFs to make the advertised services appear safe and legitimate. However, further investigation revealed that these hacks were fake, with the main objective being to attract users to compromised websites and delay them using a fake CAPTCHA mechanism, ultimately allowing the threat actors to profit.
How were the scammers able to advertise on government websites?
Interestingly, instead of directly hacking the websites, scammers took advantage of security vulnerabilities and misconfigurations in the content management systems (CMS) and other services used by the compromised websites to upload these PDFs. As a result, they were able to disguise their uploads as legitimate content.
“They show up when you have misconfigured services, unpatched CMS [content management system] bugs, and other security problems,” said senior researcher Scott-Railton.
Fortunately, the immediate damage from this campaign appears to be minimal, and the Cybersecurity and Infrastructure Security Agency (CISA) is actively collaborating with the affected entities and providing assistance to address the compromises. However, this incident raises serious concerns about security vulnerabilities within government and educational institutions. This is because people generally trust government websites, so if hackers had other nefarious intentions, the potential repercussions could have been massive. Therefore, organizations must remain vigilant, regularly patch and update their systems, and implement stringent security measures to protect against emerging threats.
Known ransomware attacks against education, June 2022-May 2023
Distribution of Vice Society attacks vs other ransomware gangs, June 2022-May 2023
