OODA Analysis and Briefs

Home > OODA Analysis and Briefs

Analysis

Briefs

Researchers tie ransomware families to North Korean cyber-army

The North Korean army is continuing to try its hand at ransomware, according to a new report from cybersecurity firm Trellix. Christiaan Beek, lead scientist with the company’s threat research division, released a report on Tuesday tying four ransomware families — BEAF, PXJ, ZZZZ and CHiCHi — to the prolific Unit 180 of North Korea’s cyber-army. Trellix…
Blockchain Is Perfect Resolution For Global Supply Chain

The modern-day consumer is done with the old-fashioned modus operandi of supply chain management and the red-tapism over parcel movements. They expect better experiences concerning speed, visibility, traceability, transparency, and sustainability. To ensure this, they are willing to pay more or ready to try alternatives for their beloved brands even if a single experience goes…
Ukraine War Spurs U.S. to Ramp up Security Probe of Software Maker Kaspersky

The Biden administration ramped up a national security probe into Russia’s AO Kaspersky Lab antivirus software earlier this year amid heightened fears of Russian cyberattacks after Moscow invaded Ukraine, three people familiar with the matter told Reuters. The case was referred to the Commerce Department by the Department of Justice last year, a fourth person said,…
North Korea Fires Off Suspected Sub-Launched Ballistic Missile

North Korea reportedly launched a submarine ballistic missile off its east coast on Saturday, according to officials in Seoul and Tokyo. The launch took place just three days before South Korea’s new president is set to take office. The missile was fired in the afternoon from the Sinpo area, which is a coastal region and…
At least three killed in suspected terror attack in Israel

At least three people have been killed and four more injured in what is suspected to be a terrorist attack that took place in the Israeli city of Elad last Thursday. Israel’s emergency response services confirmed that the incident took place on Israeli Independence Day and involved two armed individuals, one with a rifle and…
Marcos family eye return to power as polls close in Philippines election

Millions of Philippine citizens lined up to vote for their next president until 19:00 local time. The man expected to win in a possible landslide victory is Ferdinand Marcos Jr, who is the son of the nation’s past dictator. Marco’s main rival is Leni Robredo who narrowly defeated Mr Marcos in the vice-presidential race in…
Microsoft, Apple and Google Team Up on Passwordless Standard

Apple, Google, and Microsoft have teamed up to support the FIDO Alliance and World Wide Web Consortium (W3B) standard, which will eventually make it easier for websites and apps to deliver end-to-end authentication through passwordless methods, such as fingerprints, face scans, or device pins. All three companies have already supported passwordless log-ins in their technology,…
Sri Lanka’s prime minister resigns amid protests over economic crisis

After weeks of protests against the government, Sri Lankan Prime Minister Mahinda Rajapaksa has resigned. Rajapaksa resigned on Monday and the country has been in a state of civil unrest since March. The protests at times had become violent as the public spoke out against the economic crisis ongoing in Sri Lanka. The economic crisis…
Crypto mixer Blender sanctioned by US Treasury for involvement in $600m Ronin theft

The US Treasury has sanctioned cryptocurrency mixing service Blender.io for its involvement in the Ronin sidechain in March. According to the Treasury, Blender.io provided services for the cyber attackers behind the Ronin attacks, resulting in a $600 million profit for the cybercriminals. Blender.io has also been blocked from completing transactions with US persons as a…
Ukrainians DDoS Russian Vodka Supply Chains

Ukrainian cyber actors have reportedly interfered with alcohol shipments delivered to Russia via distributed denial of service (DD0S) attacks targeting a critical online portal. In Russia, alcohol producers and distributors are required to register shipments with the EGAIS portal. However, the portal was reportedly taken offline by Ukrainian hacktivists earlier this month. Some entities reported…
New Mustang Panda campaign targets Europe

This week, Cisco Talos Intelligence Group reported that they had discovered a new attack campaign perpetrated by the threat actor Mustang Panda, also known as Bronze President, RedDelta, and TA416. The group focuses primarily on Europe when conducting its espionage attacks. According to security researchers, the attacks originate from China and have an emphasis on…
Sri Lanka shuts down in general strike amid calls for government to resign

Millions of public and private sector workers took part in a nationwide strike to protest the Sri Lankan government’s handling of the financial crisis. Offices, factories and public transport were left empty as the strike was called for by trade unions and civil organizations. There are widespread calls for President Gotabaya Rajapaksa to resign. Almost…
Bolsonaro says he will seek audit of voting system ahead of polls

Ahead of the elections in October, Brazilian President Jair Bolsonaro’s party will seek an audit of the electronic voting system. The leader has questioned the validity of the country’s voting system which directly contradicts election officials and experts. This campaign has coincided with Bolsonaro’s decreasing approval ratings over the past months. There are concerns that…
Israel hunts Palestinian axe attackers who killed three

An attack in the Orthodox Jewish town of Elad on Thursday night left three Israelis dead. Two Palestinians are suspects for the attack with an ax and knife. This is the latest in a series of attacks by Palestiians or Israeli Arabs in Israel since March. Israel has carried out raids in the West Bank…
Moskva sinking: US gave intelligence that helped Ukraine sink Russian cruiser

The United States provided intelligence about the location and identification of the Moskva to Ukraine. The Moskva was Russia’s flagship Black Sea missile cruiser and was struck with two missiles by Ukraine. The Pentagon has not commented, however a spokesperson confirmed that the US provided the information to allow Ukraine to defend itself. The spokesman…
HRW released a report stating Russian-linked forces ‘tortured’ and ‘executed’ civilians in Central African Republic since 2019

A Human Rights Watch report has been released that reveals Russian forces have executed, tortured and beaten civilians in the Central African Republic since 2019. The report was based off of interviews with 40 people including 15 witnesses and 10 victims of violence. The abuse was committed by Russian forces carrying military grade weapons. The…
Which Blockchains are Behind the Top Metaverse Platforms?

With the rise of new technologies, the blockchain will be among the key drivers for new forms of transactions, interactions, socialization and content consumption in the years to come. The Metaverse, a shared virtual environment where individuals can socialize, interact, and conduct business, relies heavily on blockchain technology to enable peer-to-peer (P2P) exchanges and share decision…
Here’s how Google is protecting Ukrainian infrastructure and people from state-sponsored cyber attacks

Cybersecurity researchers have been warning us that the war in Ukraine is driving an increase in cyberattacks. And according to Google’s threat analysis group, that’s what’s happened over the past few weeks, with government-backed actors from countries like Russia, North Korea, China, and Iran all reportedly targeting critical infrastructure with previously recognized attack types. Thankfully,…
Cronos DeFi Project MM.Finance Suffers $2M Exploit

The biggest decentralized exchange on Cronos has been hacked. MM.Finance, an ecosystem of DeFi applications and the biggest decentralized exchange on the Cronos blockchain, has suffered a $2 million frontend attack. The project reported the incident late Thursday after the attacker breached the app’s frontend and started moving funds to their address. “We have verified and…
California governor issues executive order on crypto as state embraces blockchain technology

Tech investors and businesses in California have been betting on crypto for well over a decade. Now, the governor of the U.S. state with the largest economy is joining the party. California Gov. Gavin Newsom issued an executive order Wednesday on cryptocurrencies, laying out a road map for regulatory and consumer protections and examining ways the…
How much has the semiconductor shortage cost?

In its first quarter results the company said Covid-19 lockdowns in Shanghai and Russia’s war in Ukraine were “further increasing supply chain risk and contributing to inflationary pressures”, exacerbating the shortage. Pat Gelsinger, CEO of Intel, said: “In the supply chain, lockdowns in Shanghai and the war in Ukraine have demonstrated more than ever that the…
NHS Inboxes Hijacked to Send 1000+ Malicious Emails

More than 1,000 phishing emails have been sent from a mailbox belonging to the National Health Service that was compromised by threat actors in the past six months. Cybersecurity research firm Inky recently published a report detailing how the attackers conducted the attack, compromised the mailbox, and continued to send out phishing emails with malicious…
FBI Reports Thailand and Hong Kong Banks Used Most in BEC

The FBI has released a warning regarding business email compromise attacks, stating that banks located in Thailand and Hong Kong are used in the majority of attacks. BEC attacks have become increasingly popular over the past few years, growing to impact large enterprises, SMBs, and even personal transactions. According to the FBI, BEC attacks are…
VHD Ransomware Linked to North Korea’s Lazarus Group

Security researchers at Trellix discovered new VHD ransomware linked to North Korea’s Lazarus group. Although the researchers suspect that the malware has been around since March 2020, it has never been tied to a group. Researchers at Trellix examined source code and Bitcoin transactions to link the ransomware to the Lazarus group. The threat actor…
Russian hacker group APT29 targeting diplomats

The group behind the SolarWinds supply chain attack, APT29, is targeting diplomats through phishing methods designed to deploy malware. Security researchers at Mandiant discovered the attack. APT29 is a cyber espionage group believed to be sponsored by the Russian Foreign Intelligence Service, the SVR. APT is also referred to as Nobelium by cybersecurity researchers. The…
Togo agrees to mediate in Mali political crisis

President Faure Gnassingbe of Togo has agreed to mediate in Mali’s political crisis. Mali’s military government is facing pressure to re-establish civilian rule. There have been negotiations within the administration of Mali’s government about how long it will take to restore order since August 2020 when the military seized power. Gnassingbe was announced as a…
Accused Colombian drug lord Dairo Usuga ‘Otoniel’ extradited to the US, source says

The Colombian National Police has stated the accused Colombian drug-trafficker Dario Usuga was extradited to the United States on Wednesday to face charges. Usuga is considered to be the drug lord of the “Clan del Golfo,” a cartel that controls cocaine routes through Mexico and into the United States. Usuga is expected to appear in…
Crypto Cons: Scammers Make a Killing off War in Ukraine

The war in Ukraine is a global tragedy that has taken thousands of lives, with no end in sight. But for various groups of high-tech scammers, the grisly conflict has been a goldmine. With over $900 million raised by Ukraine and Ukrainian charities since Russia’s February 24 invasion began, fraudsters from around the world have been…
The Rise Of Web3: What Cybersecurity Concerns Should We Look Out For?

Web3 is the kitschy term that refers to the next iteration of our internet—including cryptocurrencies, decentralized networks, the blockchain and more. While for many people the concept of Web3 seems a futuristic, light-years-away idea, the truth is that it’s much more impending than we think, with many elements already firmly entrenched in the wider public…
Russia is losing the cyberwar against Ukraine, too

When Russia launched its all-out attack against Ukraine in February, the world expected the invaders to roll over the country quickly. That didn’t happen, and Ukraine today, though still under assault, has so far thwarted Russia’s ambitions to conquer it. Russia has also been fighting a quieter war against Ukraine, a cyberwar, deploying what had been…
Polkadot launches cross-chain messaging system to solve blockchain’s bridge problem

Blockchain platform Polkadot has launched a new cross-chain communications protocol, saying it will do away with cumbersome bridging mechanisms that have cost the crypto industry billions in cyber attacks. The newly launched XCM messaging system is intended to promote Polkadot’s multichain ecosystem, which is being built on the premise of full interoperability. XCM channels are said…
System shock: supply chains suffer in Russia-Ukraine war

Global supply chains were already reeling from the Covid-19 pandemic. Now the Russia-Ukraine war has added a new wave of challenges, with sanctions and conflict restricting the flow of critical resources. Russia is ranked as the 16th-largest exporter by the World Trade Organisation, though it has particular strengths, with petroleum, coal and gas top of its…
Healthcare and Education Sectors Most Susceptible to Cyber Incidents

According to the UK’s Information Commissioner’s Office, the healthcare and education sectors are the industries most vulnerable to cyberattacks. The ICO used data from 2021 to come to the conclusions, and the findings were analyzed by CybSafe. Attacks against healthcare and education organizations made up a third of security incidents int he UK last year,…
State-Backed Chinese Hackers Target Russia

According to Google, financially motivated actors across the globe are still using the war in Ukraine as a phishing lure for campaigns. Recently, Chinese threat groups have been targeting Russia, the tech giant says. In Google’s Threat Analysis Group (TAG) quarterly bulletin reported that the governments of China, Iran, North Korea, and Russia were responsible…
EU to ‘significantly increase’ military aid to Moldova

The European Council President Charles Michel has promised to increase the EU’s military aid to Moldova. Tensions have been rising in the neighboring country to Ukraine as a series of explosions occurred in a pro-Russia separatist region. Michel told a news conference with Moldova’s President Maia Sandu that armed forces and military equipment would be…
North Korea launches ballistic missile, Japan and South Korea say

On Wednesday, North Korea fired a ballistic missile into the water off its east coast according to Japan and South Korea. South Korea’s Joint Chiefs of Staff stated the missile was launched from an area of the North Korean capital of Pyongyang, Sunan. Japanese Deputy Defense Minister, Makoto Oniki, stated the missile flew at a…
This unpatched DNS bug could put ‘well-known’ IoT devices at risk

IoT security researchers at Nozomi Networks have warned that a popular library for the C programming language is at risk for DNS cache-poisoning attacks. The bug in the library is roughly 10 years old, and could not be fixed by the owners and maintainers of the library. Security researcher Andrea Palanca was the first to…
Three Looming Questions We Need To Answer Before The Metaverse Becomes Reality

As the CTO of a cybersecurity company, people often assume I obsess over all the bad things that could happen online. In reality, I’m a stubborn optimist. Particularly when it comes to technology, my default is to think about the positive implications of new developments before I think about the negative ones. And that’s why I remain…
Europe is bracing itself for cyber warfare, but is it ready?

When the systems of three oil and transport companies in Europe and Africa were brought down on February 2, 2022, Europe was preparing for a coming war in Ukraine and the impact of tensions on the Russian border were beginning to be felt in global energy markets. The cyberattack sparked a wave of anxiety that a…
Why The DeFi Sector Has Seen $1.57B In Exploits And Already Exceeds 2021 Record

Per a report from blockchain security firm Peck Shield, the DeFi sector has been under attack with a profitable season for bad actors. The total amount extracted from different crypto projects has already surpassed the total recorded last year. The security firm claims that around $1,57 billion have been obtained from hackers and other bad…
A stealthy new espionage group is targeting corporate mergers and acquisitions

A new espionage actor is breaching corporate networks to steal emails from employees involved in big financial transactions like mergers and acquisitions. Mandiant, which first discovered the advanced persistent threat (APT) group in December 2019 and now tracks it as “UNC3524”, says that while the group’s corporate targets hint at financial motivation, its longer-than-average dwell…
SEC doubles down on crypto regulation by expanding unit

The United States Securities and Exchange Commission (SEC) announced Tuesday that it would nearly double the number of personnel responsible for safeguarding investors in cryptocurrency markets. As per the announcement, the SEC’s Cyber Unit, which includes the Crypto Assets and Cyber team, will hire 20 new people for 50 dedicated positions. The SEC stated that the 20…
Mobile health apps leak sensitive data through APIs, report finds

Knight Ink recently partnered with mobile security company Approov to hack 30 different mobile health apps to analyze whether they pose a threat to valuable health information belonging to users. Cybersecurity researcher Alissa Knight notes how lucrative health information is to cyberattacks, stating that a single PHI record goes for ten times the price of…
One of the Most Powerful DDoS Attacks Ever Hits a Crypto Platform

Cloudflare confirmed that a cryptocurrency platform was recently the victim of one of the biggest distributed denial of service attacks ever recorded after it was bombarded with over 15 million requests. DDoS attacks are often measured in multiple ways, such as by the volume of the data, the number of packets, or the number of…
Google Offers $1.5M Bug Bounty for Android 13 Beta

Google has expanded its bug-bounty program to include $1.5 million for a lucrative Android 13 Beta exploit that targets the Titan M security chip that is included with Pixel phones. Google has promised an outsize to focus on security and privacy, indicated by the bounty increase. In addition to the $1.5 million pledge, Google announced…
Japan and Thailand agree to new defense deal

On Monday, the leaders of Japan and Thailand announced a new defense agreement and plans to increase their economic relations. Japanese Prime Minister Fumio Kishida was just wrapping up the last leg of his three-nation tour of Southeast Asia in Thailand. Defense hardware and technology would be transferred from Japan to Thailand according to the…
Iranian oil minister meets Venezuela’s Maduro in Caracas

Venezuela welcomed Iran’s oil minister, Javad Owji, in an official visit on Monday. The minister met with President Nicolas Maduro and discussed overcoming the sanctions imposed by the United States on both Iran and Venezuela. The two officials met at the presidential palace in Caracas and according to President Maduro, deepened the ties of cooperation…
Mali: Military government breaks defense accords with France

It was announced Monday afternoon that Mali’s ruling military has broken its defense accords with France. The announcement was the latest sign of failing relations between France and Mali. The military claimed France had committed “flagrant violations” of its national sovereignty through its troops stationed in the country. Spokesman Colonel Abdoulaye Maiga said French forces…
India’s SpiceJet under investigation after severe turbulence injures passengers

A low-cost airline in India, SpiceJet, is under government investigation after one of the plane’s autopilot malfunctioned. The malfunction caused significant turbulence and injured multiple passengers on board. The flight was traveling from Mumbai to Durgapur, West Bengal on May first. The autopilot function stopped working for two minutes on the B737-800 aircraft and the…
Beyond Bitcoin: Understanding Blockchain Security Implications

The blockchain market is expected to grow 68.4% over the next four years, with 86% of senior executives believing blockchain will become a mainstream-adopted technology. While the majority of the world has been fixated on various cryptocurrencies—including bitcoin, ethereum and the emerging non-fungible token (NFT) market—organizations have adopted blockchain technology behind the scenes. To do…
Crypto Hackers Stole More Than $370 Million In April Alone

In April alone, hackers stole more than $370 million in crypto from several web3 projects, according to a cybersecurity firm, with nearly $100 million being stolen over the weekend. In the last month, there were 31 hacks affecting crypto or web3 projects, including Beanstalk, Fei Protocol, Deus Finance, and Bored Ape Yacht Club, according to a…
Romania under cyberattack coming from Russia’s Killnet

The pro-Russian hacker group Killnet, which has already claimed several attacks that have taken place in recent days against some official sites in Romania, threatened on Saturday, April 30, that it would target almost 300 other sites, Economica.net reported. Newspapers, major public institutions, hotels, boarding houses, booking sites and political parties are considered. Among the institutions…
More than $13 million stolen from DeFi platform Deus Finance

Decentralized finance (DeFi) platform Deus Finance confirmed reports that an attacker used an illicit method to steal millions of dollars on Wednesday evening. Two blockchain security firms, PeckShield and CertiK, said Deus Finance was hit with a variation of a “flash loan attack.” Flash loan attacks involve hackers borrowing funds that do not require collateral, buying…
Tech Journalist Says: Bored Ape Yacht Club Just “Broke” the Ethereum Blockchain

According to CNET: “The Bored Ape Yacht Club crashed Ethereum on Saturday night. As part of the upcoming Bored Ape metaverse called Otherside, developer Yuga Labs on Saturday launched a new NFT collection that consists of 100,000 land deeds for the virtual world. Interest in the drop was immense — too much for the Ethereum…
Hundreds trapped in Mariupol steelworks despite evacuations

Hundreds of people are trapped in a steel plant in the southern Ukrainian city of Mariupol despite a group of evacuees escaping on Sunday. The plant has become the last stronghold of Ukrainian resistance in the city and therefore was a Russian target for bombardment over the past several weeks. The Azoystal plant’s commander, Danys…
At least 10 killed, many more feared dead after explosion at Kabul mosque

At least ten individuals have been killed and 30 more wounded after an explosion occurred in the capital city of Kabul, Afghanistan. The blast took place after Friday prayers at a mosque in the city, a time in which the building would have been busy or crowded. Eyewitnesses of the disaster stated that they feared…
Massive New Security Update For 3.2 Billion Chrome Users Confirmed

Google Chrome security has experienced a busy past few weeks and there is no sign of slowing down. Just days after two emergency fixes for vulnerabilities being exploited in the wild and a record number of Chromium zero-days across 2021 was announced, Google has released another massive security update that applies to billions of Chrome…
EU Prepares Ban on Russian Oil

The European Union is expected to propose ending purchases of Russian oil in the bloc by the end of 2022. A ban on refined oil products from Russia is expected to occur by the year-end as well. The proposals are expected to be announced and circulated on Tuesday to the 27 countries and are a…
Nigeria: Five dead after Lagos building collapse

A three-story building collapsed in Lagos, Nigeria, killing at least five people. Many people are feared trapped in the residential building that was located in Nigeria’s commercial capital. 23 people have been rescued, including 7 children according to Ibrahim Farinloye from Nigeria’s National Emergency Management Agency. The building collapsed on Sunday night in the Oyingbo…
Directorate of Enforcement seizes $725 million from Xiaomi India

The Directorate of Enforcement (ED), India’s anti-money laundering agency, has reportedly seized roughly $725 million in assets from Xiaomi India after the ED found that the company broke foreign exchange laws. According to the ED, the company began operations in India in 2014 and commenced illegal activity in 2015. The directorate claimed that the comapny…