International Efforts Yield Success In Combating Cyber Crime

(RTTNews) - In a significant stride towards bolstering cyber security measures, the Department of Homeland Security's Cyber Safety Review Board or CSRB is set to investigate the July breach of Microsoft Exchange Online, attributed to suspected Chinese hackers. DHS Secretary Alejandro Mayorkas emphasized the urgent need to comprehend the vulnerabilities within cloud computing, crucial for delivering services to the American populace.

This initiative marks the third investigation undertaken by the CSRB, a recently formed entity. The board's inaugural review delved into the enduring Log4j vulnerabilities, projecting their impact for the next decade. Its subsequent report spotlighted the tactics of hacking group Lapsus$ and provided ten recommendations for fortifying environments against such threats.

Praising this move, Senator Ron Wyden (D-OR) commended President Biden and CISA Director Jen Easterly for heeding his call to scrutinize the Microsoft breach. Wyden expressed concerns over the security negligence exhibited by Microsoft in safeguarding the cloud accounts of US government officials, emphasizing the need to address and rectify such shortcomings.

CISA Director Jen Easterly emphasized that the CSRB's findings would contribute significantly to advancing cyber security practices across cloud-based systems, encompassing both government and enterprise realms. Importantly, it is noteworthy that the CSRB does not possess regulatory or enforcement powers. Instead, its mandate revolves around distilling valuable lessons for informed enhancements in the future, a notion reiterated by the DHS.

In parallel, the Government Accountability Office reported that over 880 out of more than 4,000 recommendations to federal agencies regarding cyber security issues had yet to be fully implemented as of December 2022, underlining persistent challenges in the domain.

Meanwhile, security researchers from Proofpoint unearthed a sophisticated phishing campaign employing EvilProxy, an evolving threat that seeks to bypass multi-factor authentication. This campaign, which has been active since March, specifically targets high-profile corporate individuals. The nefarious actors behind this effort have reportedly compromised a significant number of "VIP" targets, including C-level executives, CFOs, and CEOs, exploiting their positions of influence.

EvilProxy, described as a "phishing as a service" application, employs deceptive tactics such as fake login pages and redirects to deceive users into divulging their credentials. This versatile threat can steal session cookies and MFA tokens, granting unauthorized access to compromised accounts within moments.

The past week saw remarkable successes in the realm of international law enforcement combating cyber crime. Europol reported the arrest of five individuals connected to cyber crime hosting site LolekHosted.net, along with the seizure of servers and shutdown of the site. The platform had facilitated a range of malicious activities, including malware distribution, DDoS attacks, botnet management, and more.

Interpol, on the other hand, achieved significant breakthroughs, apprehending over 100 individuals across Europe and Africa linked to the Black Axe crime/cyber crime syndicate. In addition to identifying more than 1,000 suspects, authorities managed to freeze 208 bank accounts and seize assets totaling over €?2.15 million ($2.4 million). Black Axe, infamous for its aggressive mafia-style operations, has engaged in a litany of cyber criminal activities, spanning business email compromise schemes, romance scams, credit card fraud, and money laundering, among others.