Admin - RH-ISAC - Page 3 of 9 Blog

On May 23, 2023, Cofense researchers reported a phishing campaign with threat actors leveraging paid time off (PTO) and vacation requests as a lure theme. Context The report is based on a Phishing Defence Center (PDC)-reported a phishing campaign where threat actors sent emails to users claiming to be from ‘HR Departments’ and providing the users with links…

With cybersecurity being a flourishing industry with promising job opportunities, recent college graduates may have their sights set on a career in cyber threat intelligence. The notion that graduates must obtain a degree in computer science, computer programming, or machine learning to land a career in cybersecurity is no longer the case. Many skills developed…

Context On May 16, 2023, ZScaler threat researchers reported the technical details of a new ransomware-as-a-service (RaaS) operation they’ve observed being advertised on dark web forums. ZScaler researchers provided the following key takeaways: CryptNet is a new ransomware-as-a-service that has been advertised in underground forums since at least April 2023 The CryptNet threat group claims…

Context On May 4, 2023, VulnCheck researchers released a proof-of-concept (POC) exploit for CVE-2023-27350. According to the report, the exploit bypasses current detection options for attacks leveraging the vulnerability. Technical Details According to NIST, CVE-2023-27350 “allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to…

This month’s member spotlight is Christopher (Chris) De La Rosa, senior threat intelligence analyst at DICK’S Sporting Goods. During our conversation with Chris, he expanded upon his unconventional path leading to his career in threat intelligence and his day-to-day duties. Keep an eye out for Chris at the upcoming RH-ISAC Summit as he is hoping…

On April 13, 2023, Cado Labs researchers reported the technical details of a new malware they dubbed “Legion.” Context According to the report, Legion is written in Python and includes credential harvesting and SMTP hijacking capabilities. Researchers reported that the tool is currently being sold on Telegram. Technical Details According to researchers, key features of…

As the ISAC for the global retail and hospitality sectors, RH-ISAC will host several in-person events in Europe this quarter to continue to serve companies that have a strong presence in the region, including Nestlé, Ahold Delhaize, Natural &Co, Tesco, and Danone. Additionally, RH-ISAC has programming to serve cybersecurity personnel in the Asia-Pacific market and…

Context On April 11, 2023, 3CX released the initial results of Mandiant’s incident response and investigation into the supply chain attack that compromised 3CXDesktopApp. According to the report, the activity is attributable to the North Korean threat group UNC4736. Technical Details According to Mandiant: “the attacker infected targeted 3CX systems with TAXHAUL (AKA “TxRLoader”) malware….

Context On April 6, 2023, CSO reported on a research report from ESG on the challenges that face cyber security leaders when making decisions based on cyber threat intelligence. According to the report, “95% of enterprise organizations (those with more than 1,000 employees) have a threat intelligence budget, and 98% plan to increase spending on…

Context On March 29, 2023, Trend Micro security researchers reported a new malware they named “OpcJacker.” According to the report, OpcJacker includes multiple capabilities such as: Keylogging Taking screenshots Stealing sensitive data from browsers Loading additional modules Replacing cryptocurrency addresses in the clipboard for hijacking purposes Trend Micro researchers assessed that: The primary objective of…