Start your day with intelligence. Get The OODA Daily Pulse.

Home > OODA Analysis and Briefs

Analysis

Briefs

  • Global Police Arrest 65 in Multimillion-Dollar BEC Bust

    Global law enforcement is celebrating a huge victory after disrupting a massive business email compromise hacking gang thought to have targeted hundreds of victim organizations over the past few years. The US Department of Justice and international law enforcement partners carried out Operation Eagle Sweep, a name referring to the takedown of the hacking gang,…

  • Multiple hacking groups are using the war in Ukraine as a lure in phishing attempts

    According to cybersecurity research from Google’s Threat Analysis Group (TAG), government backed hackers from Russia, China, Iran, and North Korea are exploiting Russia’s invasion of Ukraine. The attacks leverage public interest in the conflict and are designed to steal login credentials, sensitive information, and money from victims spanning several countries. The campaigns contain specific lures…

  • Web3 Security: How to Reduce Your Cyber Risk

    OODA has a deep heritage in red teaming enterprise and advanced technologies. In cybersecurity, a Red Team is a group of experienced professionals authorized and organized to test a system using realistic methods of a real adversary. The objective of a Red Team is to improve security by emulating the objectives and tactics of real-world…

  • Data-harvesting code in mobile apps sends user data to “Russia’s Google”

    Russia’s biggest Internet company has embedded code into apps found on mobile devices that allows information about millions of users to be sent to servers located in its home country. The revelation relates to software created by Yandex that permits developers to create apps for devices running Apple’s iOS and Google’s Android, systems that run the…

  • Crypto and Russia-Ukraine War: What Investors Should Know

    Cryptocurrency has been thrust into the spotlight during the Russian invasion of Ukraine. Cryptocurrencies such as Bitcoin (BTC) and Ether (ETH) have been playing an unprecedented role in the war effort in both countries. As millions of Ukrainians flee their homes and even their country, they face a cap on cash withdrawals from banks, leaving cryptocurrency…

  • FBI says Russian hackers scanning U.S. energy systems and pose ‘current’ threat

    Russian hackers have been scanning the systems of energy companies and other critical infrastructure in the United States, and state-sponsored hacking by Russia presents a “current” threat to American national security, a top FBI official told lawmakers on Tuesday. “The threat from Russia in a criminal sense, in the nation state sense, is very, very real…

  • NCSC: Time to Rethink Russian Supply Chain Risks

    One of the UK’s top security agencies has urged the public sector, critical infrastructures (CNI) and other organizations to reconsider the potential risks associated with any “Russian-controlled” parts of their supply chain. Ian Levy, technical director of the National Cyber Security Centre (NCSC), said there’s no evidence to suggest that the Russian state is about to…

  • A Cyber Threat Analysis of the Russia-Ukraine Conflict

    The Ankura Cyber Threat Investigations & Expert Services (CTIX) team conducted a technical analysis of historical and ongoing adversarial activity associated with the current Ukrainian/Russian conflict. In doing so, the CTIX team leveraged proprietary sources of threat intelligence which were then enhanced with additional data points collected from various open and closed sources. This report…

  • Palestinian Gunman Shoots Five Dead In Central Israel

    On Tuesday, a Palestinian gunman killed five people in the third suspected terrorist attack in Israel in just one week. In the past few days, two attacks conducted by Arab citizens of Israel with suspected ties to the Islamic State have occurred, leaving security forces on high alert. Tuesday’s attack occurred on the outskirts of…

  • Saudi-led coalition to halt military operations in Yemen as UN urges truce

    Late on Tuesday, the Saudi-led coalition fighting the Houthi group in Yemen said it would stop military operations on Wednesday. The announcement followed a UN call for a truce during the holy month of Ramadan. The UN has been working with the two groups, who have been at war since 2015, to secure a peace…

  • MSHTML Flaw Exploited to Attack Russian Dissidents

    A Ukrainian-based threat actor has launched a spearphishing attack against Russians that are using services that have been banned for use by the Kremlin. The attack targets Russian cities and governments that are not aligned with the actions of the Russian government. MalwareBytes identified the campaign last week, stating that it targets entities using websites,…

  • Attackers Steal $618m From Crypto Firm

    Vietnamese blockchain game developer Sky Mavis created the Ronin Network to serve as a sidechain for the company’s Axie Infinity game. The tool is used by gamers to transfer virtual coins in and out of the game. However, it has been revealed that hackers were able to break into the Ethereum sidechain and steal millions…

  • Personal Data of 620 FSB Officers Published Online

    The personal data of what the Ukrainian Defense Ministry’s Directorate of Intelligence claims to belong to Russian intelligence officers has been posted online. The data was published on Monday, and includes details such as names, addresses, and phone numbers pertaining to 620 individuals. According to Ukraine, the data belongs to officers of Russia’s Federal Security…

  • Hospitals on high alert for possible Russia cyberattacks

    Massachusetts hospitals have been warned to be on high alert for cybersecurity threats as the war in Ukraine continues. The warnings have come from several federal and industry organizations, including the White House, FBI, federal Cybersecurity and Infrastructure Security Agency, Healthcare Information and Management Systems Society, and the American Hospital Association. In a bulletin to…

  • Supply chain implications of the Russia-Ukraine conflict

    Supply chains are once again being tested, this time by the extraordinary events in Ukraine. The time has long since passed when supply chain disruptions can be treated as one-off events, with organizations scrambling to mitigate the disruption to their business and to keep goods, funds, and information flowing across the supply chain. The conflict…

  • Russians plan to launch alternative to Google Play on Victory Day

    Russian tech developers are building an alternative to Alphabet Inc’s (GOOGL.O) Google Play store and plan to launch it on May 9, a national holiday in Russia that celebrates victory in World War Two, the organisation behind the initiative said on Tuesday. YouTube and Google Play this month suspended all payment-based services in Russia, including subscriptions,…

  • ‘Most Severe’ Cyberattack Since Russian Invasion Crashes Ukraine Internet Provider

    A “powerful” cyberattack has hit Ukraine’s biggest fixed line telecommunications company, Ukrtelecom. Described as the most severe cyberattack since the start of the Russian invasion in February, it has sent the company’s services across the country down. Victor Zhora, deputy head of the State Service for Special Communications and Information Protection, confirmed to Forbes that the…

  • Using Russian tech? It’s time to look at the risks again, says cybersecurity chief

    Organisations using Russian-linked software or products have been told to take time to consider the risk involved with using those technologies following Russia’s invasion of Ukraine. New guidance from the National Cyber Security Centre (NCSC) – part of GCHQ – says organisations in several key areas in particular should reconsider the risk of using Russian-controlled products…

  • Critical Sophos Security Bug Allows RCE on Firewalls

    Sophos has recently alerted the public to a critical vulnerability in its firewall product that could allow for remote code execution. The flaw is an authentication bypass issue tracked as CVE-2022-1040 and lies in the User Portal and Webadmin of Sophos Firewall. The flaw affects version 19.5 MR3 and older. If exploited, an attacker could…

  • Ukraine Suffers Significant Internet Disruption Following Cyber-Attack

    Ukraine’s national telecommunications provider, Ukrtelecom, has suffered from a significant cyberattack that led to a severe disruption to internet connectivity in the region. Ukrtelecom provides fixed internet for a large portion of Ukraine’s geographical area. The telecom confirmed the incident yesterday and reported that it is gradually restoring connectivity after mitigating the attack. Ukrtelecom temporarily…

  • Transparent Tribe APT returns to strike India’s government and military

    The Transparent Tribe hacking group has allegedly re-emerged with a new malware arsenal. The group is targeting India’s government and military in a new campaign. Transparent Tribe has been active since at least 2013 and has operated in 30 countries. The APT tends to focus primarily on India and Afghanistan, however. Transparent Tribe is suspected…

  • Mexico’s 43 missing students: Experts slam ‘falsified’ inquiry

    A group of experts have accused the Mexican government of falsifying its investigations into the disappearance of 43 students in 2014. There has been video footage released of the military planting evidence at the scene where authorities said the students were killed. The international experts said the Mexican government withheld or falsified evidence from them…

  • Canada edges closer to F-35 jets deal with Lockheed Martin worth up to $15 billion

    Canada has picked Lockheed Martin Corp as the bidder to supply 88 new jets. Procurement Minister Filomena Tassi mentioned Monday that the US company is set to sign the multibillion-dollar contract. Canada has been under pressure to boost their defense spending as the war in Ukraine continues.  Canada has been attempting to replace its F-18…

  • Japan to revise foreign exchange law to end crypto loophole for sanctions on Russia

    Japan will revise its foreign exchange law to prevent Russia from evading Western financial sanctions following Moscow’s invasion of Ukraine through cryptocurrency assets, top government officials said on Monday. The government will submit a revision of the Foreign Exchange and Foreign Trade Act to the current parliament session to strengthen protections against potential sanctions-busting by Russia…

  • Google and Apple close loophole that was letting Russians use payment services

    In 2014 Russia annexed Crimea and NATO nations retaliated with economic sanctions. This prompted the Central Bank of Russia to establish Mir cards, a national payment system linked to 150 banks in the Russian Federation. Cut to eight years later, another invasion, this time of Ukraine itself. Even stronger sanctions loomed, but Russians could still…

  • In charts: Cyber security risks and companies’ readiness

    Cybersecurity concerns could once be written off as the preserve of large companies. But, in today’s networked world — where many are still partly working remotely as a result of the pandemic, and Russia’s invasion of Ukraine is raising cyber warfare threats — that era is long gone. According to Santha Subramoni, global head of…

  • Russia and China ‘most likely’ behind state-sponsored cyber threats: Trellix

    State-sponsored cyber attacks have been increasing— and Russia and China are among the most likely suspects of being behind these successful cyberattacks that resulted in data loss, service disruption, and industrial espionage, said a new report published by Trellix, a cybersecurity company and the Center for Strategic and International Studies (CSIS). For the uninitiated, state-sponsored attacks…

  • The Supply Chain Crisis Is About to Get a Lot Worse

    The supply chain is in chaos—and it’s getting worse. Air freight warehouses at Shanghai Pudong Airport are log-jammed as a result of strict Covid testing protocols imposed on China’s biggest city following a local outbreak. At the city’s port, Shanghai-Ningbo, more than 120 container vessels are stuck on hold. In Shenzhen, a major manufacturing hub…

  • Estonian Tied to 13 Ransomware Attacks Gets 66 Months in Prison

    An Estonian man named Maksim Berezan was sentenced to more than five years in US prison for his participation in at least 13 serious ransomware attacks that resulted in approximately $53 million in losses. US prosecutors stated that Berezan enjoyed a lengthy career of being able to access hacked bank accounts across the world to…

  • Google Issues Emergency Security Update For 3.2 Billion Chrome Users—Attacks Underway

    Google has issued an emergency security update pertaining to all Chrome users after it received confirmation that attackers were exploiting a high-severity zero-day vulnerability in the platform. The emergency update is highly unusual as it addresses just one security flaw, validating its urgency. Google published a Chrome stable channel update announcement on March 25, confirming…

  • DOJ Indicts Russian Gov’t Employees Over Targeting Power Sector

    The US Department of Justice (DoJ) has indicted at least four Russian government employees over their connection to plans to launch cyberattacks against critical infrastructure in the US and beyond. The plans reportedly included attacking at least one nuclear power plant. The supply-chain attack design would have targeted the US energy sector and hundreds of…

  • Utah Becomes Latest US State to Pass a Data Privacy Law

    This month, Utah became the latest state to pass a landmark data privacy law. The Utah Consumer Privacy Act (UCPA) will take effect in two years and apply to organizations that boast an annual revenue of $25 million or more that conduct businesses in Utah or produce products and services targeted at Utah residents. The…

  • War in Ukraine: Anti-war Russians intimidated on their doorsteps

    Citizens in Russia that have spoken out against the country’s war in Ukraine have had their homes vandalized by pro-Kremlin forces. Graffiti has labeled people inside apartments as “traitors” and have featured messages with the letter “Z” in a pro-Kremlin message in support of the war. An editor of a radio station that had to…

  • El Salvador proclaims state of emergency as homicides soar

    A state of emergency law was approved by El Salvador’s legislative body early Sunday. The state of emergency was proclaimed due to a rising homicide rate, driven by gangs Barrio 18 and MS-13. 62 homicides were reported by El Salvador’s police on Saturday. In response to the homicide rate, the freedom of association and the…

  • Senate releases report looking at Russia’s ransomware attacks, attempts on U.S. businesses

    America’s Data Held Hostage is the name of the just-released report by the U.S. Senate’s Committee on Homeland Security. The report provides a profile of three anonymous companies of varying sizes that were all attacked by the Russia-based ransomware group REvil and the experiences of those companies during the incident response. “Ransomware is a type of…

  • Crypto Market Breaks $2 Trillion Again. What Next?

    The total amount invested in cryptocurrency broke above $2 trillion this week, according to data from CoinGecko. It’s the first time since early March that the market has passed this price barrier. At time of writing, crypto’s total market cap sat at $2.12 trillion, up about 3% in the past 24 hours. Cryptocurrency prices have struggled…

  • Russia is considering selling its oil and gas for bitcoin as sanctions intensify from the West

    Faced with stiffening sanctions from Western countries over its invasion of Ukraine, Russia is considering accepting bitcoin as payment for its oil and gas exports. In a videotaped news conference held on Thursday, the chair of Russia’s Duma committee on energy said in translated remarks that when it comes to “friendly” countries such as China…

  • US charges four Russian hackers over cyber-attacks on global energy sector

    The US has unveiled criminal charges against four Russian government officials, saying they engaged in two major hacking campaigns between 2012 and 2018 that targeted the global energy sector and affected thousands of computers across 135 countries. In one now-unsealed indictment from August 2021, the justice department said three alleged hackers from Russia’s Federal Security Service…

  • Global Supply Chains Face Disruption Following Russia’s Invasion Of Ukraine

    The soaring energy prices caused by Russia’s invasion of Ukraine have plunged the energy sector into a state of crisis. Europe, which ordinarily sources almost 40% of its gas from Russia, is particularly vulnerable. The price of natural gas in Europe has seen a tenfold increase since the start of 2021. Beyond soaring energy prices and…

  • UK police arrest seven individuals suspected of being hacking group members

    The London Police force has released a statement confirming that seven individuals between the ages of 16 and 21 have been arrested in connection to illegal hacking on behalf of the Lapsus$ group. The city of London Police did not provide many details concerning the case, however, two of the individuals arrested were behind the…

  • Ukrainians claim to have destroyed large Russian warship in Berdyansk

    Ukrainian armed forces claim to have destroyed a large Russian landing ship in the port of Berdyansk in southern Ukraine Thursday. The port has been occupied by Russian forces and Russian warships, and was hit by many explosions early on Thursday. Images showed fires across the dockside and secondary explosions heard across the city.  The…

  • EU signs US gas deal to curb reliance on Russia

    A major deal between the US and the European Union has been made on liquified natural gas to reduce Europe’s dependence on Russian energy sources. The US will provide the EU with extra gas, approximately 10% of the gas it currently gets from Russia. The bloc has pledged to cut Russian gas use after the…

  • Pakistan: Opposition’s no-confidence motion against Khan delayed

    A motion of no-confidence in Prime Minister Imran Khan has been adjourned by Pakistan’s speaker of parliament. The adjournment created accusations by opposition that the speaker is buying time for the prime minister to gain support before the actual vote.  The motion will be tabled on Monday. Seven days of debate will take place before…

  • Taliban Abruptly Decide to Keep Secondary Schools Closed to Girls

    New reports say that the Taliban remain against the idea that women and girls should be able to receive an education or play active roles in public life. In addition, the Taliban leadership is likely aware that weakening their policies on women’s roles could push some hard-line members to defect to the Islamic State. The…

  • North Korea fires first suspected ICBM since 2017

    North Korea has fired its first intercontinental ballistic missile (ICBM) in more than four years amid Western leaders meeting in Brussels for a security summit to discuss pressing geo-political tensions. The ICBM reportedly flew to an altitude of 3,700 miles and a distance of 671 miles during 71 minutes of airtime. The missile landed in…

  • Okta Hack Exposes A Huge Hole In Tech Giant Security

    A recent attack against authentication firm Okta has exposed a huge issue in tech security due to the nature of the attack and how threat actors achieved initial access. Okta was working with customer-support service Skyes, a subsidiary of Sitel Group. Sitel Group is one of the world’s largest call-center providers, making it an attractive…

  • Microsoft Says Lapsus$ Used Employee Account to Steal Source Code

    Microsoft has confirmed that the data-extortion gang Lapsus$ was able to hack into its Azure DevOps server. In the same time frame, another victim, an authentication firm named Okta, came forward and confirmed that 2.5% of its customers were affected in its own Lapsus$ attack. Microsoft announced the attack publicly in a blog post published…

  • West Blocks Russia’s Access to Weather Data

    Western weather agencies are restricting Russia’s access to meteorological data due to fears that the country may use the information to its advantage when conducting attacks against Ukraine, especially in the event that biological or chemical weapons are used. Data that Russia may be blocked from accessing includes near-instantaneous measurements of wind speed and direction,…

  • Malicious npm packages target Azure developers to steal personal data

    Microsoft has confirmed that a large scale cyberattack is targeting its Azure developers through malicious npm packages. JFrog cybersecurity researchers released a report on Wednesday detailing how hundreds of malicious packages have been identified. The packages were designed to steal personally identifiable information from developers. According to researchers, the campaign was first detected on March…

  • Li Finance protocol loses $600,000 in latest DeFi exploit

    The Li Finance swap aggregator has experienced a smart contract exploit leading to the loss of around $600,000 from 29 users’ wallets. The exploit took place at 2:51 am UTC on Sunday. The attacker was able to extract varying amounts of 10 different tokens from wallets that had given “infinite approval” to the Li Finance protocol.…

  • $1.7M in NFTs Stolen From Crypto VC by Hackers

    On Monday night, Arthur Cheong—the founder of DeFinance Capital, a crypto-centric VC fund—had about $1.7 million worth of NFTs stolen from his wallet in what appears to have been a social engineering attack. “Well not sure what happened, need to take time to figure it out. Didn’t expect this to happen to me as well,” Cheong…

  • A Mysterious Satellite Hack Has Victims Far Beyond Ukraine

    More than 22,000 miles above Earth, the KA-SAT is locked in orbit. Traveling at 7,000 miles per hour, in sync with the planet’s rotation, the satellite beams high-speed internet down to people across Europe. Since 2011, it has helped homeowners, businesses, and militaries get online. However, as Russian troops moved into Ukraine during the early…

  • The three Russian cyber-attacks the West most fears

    US President Joe Biden has called on private companies and organisations in the US to “lock their digital doors”, claiming that intelligence suggests Russia is planning a cyber-attack on the US. The UK’s cyber-authorities are also supporting the White House’s calls for “increased cyber-security precautions”, though neither has given any evidence that Russia is planning a…

  • Christine Lagarde Claims Crypto Is Being Used to Evade Russian Sanctions

    European Central Bank President Christine Lagarde said today that cryptocurrency is “certainly being used” as a means of evading international sanctions on the Russian Federation. However, industry experts may not be persuaded of that. Speaking at the Bank for International Settlements’ Innovation Summit on Tuesday, Lagarde, the president of the European Central Bank, stated that cryptocurrencies…

  • Hacktivists, new and veteran, target Russia with one of cyber’s oldest tools

    M, a Ukrainian engineer in his early 20s, is not healthy enough to enlist in the military. So every day, he sits down at his computer to do what he can as part of Ukraine’s IT army, an informal group of volunteer hackers whose job it is to wreak as much havoc on Russian websites…

  • FBI ‘concerned’ about possible Russian cyberattacks on critical infrastructure

    FBI Director Christopher Wray on Tuesday warned the private sector to prepare for potential cyberattacks, saying U.S. agents were “particularly focused on the destructive cyber threat” from Russian agents. The FBI director spoke just a day after The White House warned companies to bolster defenses and prepare for potential cyberattacks with the Russian invasion of…

  • Over 6,000 displaced in Gambia, Senegal after Casamance mission

    Over 6,000 people have fled their homes in Gambia and Senegal due tot clashes between Senegalese soldiers and separatists close to the Gambian border. The numbers of displaced peoples came in from the National Disaster Management Agency in the Gambia on Tuesday.  An operation by the Senegalese military against rebels fighting for independence in the…

  • Nicaragua sentences ex-presidential candidate to 8 years in prison amid wider opposition crackdown

    Christiana Chamorro Barrios, a former Nicaraguan presidential candidate, was sentenced to eight years in prison for financial crimes on Monday. This is the latest crackdown on opposition members by President Daniel Ortega’s government. Ortega won his fifth term as president last November. In June 2021, a vague national security law was passed and has been…

  • Are Russia’s elite really using cryptocurrency to evade sanctions?

    Fearing Russia’s elite will evade economic sanctions by converting their wealth to cryptocurrency, high-profile US Democratic senator Elizabeth Warren has introduced a bill into US Congress to stymie Russian crypto transactions. Warren warned a Senate committee hearing: So no one can argue that Russia can evade all sanctions by moving all its assets into crypto. But…

  • Senator Warren’s Bill Will Hurt Crypto, Not Russia

    Democratic Senator Elizabeth Warren is seldom reserved with her distaste for the crypto industry. Name any common criticism of Bitcoin, and she’s probably shared it already: volatility issues, environmental damage, ‘shadowy super coders’, and what have you. I won’t claim that her criticisms are entirely invalid (though I’ll cover those later), but they’ve become predictable to the…