Deloitte, one the world’s “big four” accounting firms, was the week’s top trending new cybercrime target after it was reported that the firm experienced a breach that compromised some of its clients’ information.
The Guardian reported that Deloitte clients’ information was compromised after a malicious actor gained access to the firm’s global email server through an administrator account that did not have two-step verification enabled.
Six Deloitte clients have been informed of the breach, which was first discovered in March 2017 and may have dated back to October 2016. The Guardian was told that an estimated five million emails could have been accessed by the hackers since emails to and from Deloitte’s 244,000 staff were stored in the Azure cloud service; however, Deloitte said the number of emails that were at risk is “very small fraction of the amount that has been suggested.”
Shortly after The Guardian story broke, Brian Krebs reported that a source close to the Deloitte investigation said the company’s breach involves the compromise of all administrator accounts at the company, that it’s “unfortunate how we have handled this and swept it under the rug,” and that “it wasn’t a small amount of emails like reported.” The source also said that investigators identified several gigabytes of data being exfiltrated and that Deloitte is not sure exactly how much data was taken.
Additionally, The Register reported that what appeared to be a collection of Deloitte’s corporate VPN passwords, user names, and operational details were found within a public-facing GitHub-hosted repository; that a Deloitte employee uploaded company proxy login credentials to his public Google+ page; and that Deloitte has “loads” of internal and potentially critical systems unnecessarily facing the public internet with remote-desktop access enabled.
Other trending cybercrime events from the week include:
- Ransomware continues: Montgomery County, Alabama officials said the county paid 9 bitcoins ($37,000) in ransom to regain access to its files after a SamSam ransomware infection disrupted services at the Montgomery County District Attorney’s Office. Officials said they had backups in place, but that the off-site backup servers were nearing capacity, along with some other issues. San Ysidro School District said it was infected with ransomware that affected emails and some shared files and demanded $18,000 in ransom. However, the school did not pay the ransom as it had a backup in place. The Arkansas Oral & Facial Surgery Center is notifying patients of a July 26 ransomware infection that made inaccessible imaging files such as x-rays, document attachments, and all electronic patient data related to visits within three weeks prior to the infection.
- Other extortion attacks: Malicious actors are using compromised iCloud credentials along with Find My iPhone to lock users computers with a passcode and then demand a ransom to unlock the device. Mac Rumors reported that the attack can bypass two-factor authentication since Apple allows users to access Find My iPhone without requiring two-factor authentication in the event that the user’s only trusted device is missing. A group using the name Phantom Squad is believed to have sent extortion emails to thousands of companies threatening DDoS attacks on September 30 unless a 0.2 bitcoin ($720) ransom is paid. SMART (“Sports Medicine and Rehabilitation Therapy”) Physical Therapy in Massachusetts said that TheDarkOverlord accessed data stored in Patterson PTOS software, and TheDarkOverlord shared the stolen database of 16,428 patient records with databreaches.net, which confirmed the breach. TheDarkOverlord went public with the breach after a failed ransom attempt.
- New point-of-sale breaches: The fast-food chain Sonic said it is investigating a possible payment card breach at its stores, and security blogger Brian Krebs reported that the incident may be tied to a batch of five million fresh payment cards being offered for sale on the stolen credit card shop known as Joker’s Stash. Whole Foods said that some of the taprooms and full table-service restaurants in its grocery stores experienced a point-of-sale breach. The breach did not affect credit cards used at the store’s main checkout systems as those use a different point-of-sale system.
- Other notable incidents: The Toms River police department said that 3,7000 individuals had their information compromised due to a data breach. Fresno Unified School District said that the personal information of 53 employees, retirees, and their dependents was found in the possession of multiple individuals arrested by the Gilroy and Clovis police departments. Signator Investors is notifying customers that an unknown third party gained unauthorized access to some client records. The Brown Armstrong financial consultancy firm is warning that fraudulent tax returns were filed under some of its client’s names. A lawyer at the law firm Wilmer, Cutler, Pickering, Hale and Dorr inadvertently leaked PepsiCo privileged information by email to a Wall Street Journal reporter. The federal government notified 21 states that they were the target of hacking related to the 2016 presidential election.
SurfWatch Labs collected data on many different companies tied to cybercrime over the past week. Some of those “newly seen” targets, meaning they either appeared in SurfWatch Labs’ data for the first time or else reappeared after being absent for several weeks, are shown in the chart below.
Cyber Risk Trends From the Past Week
Last week we noted the malicious version of CCleaner that was downloaded approximately 2.27 million times appeared to have been an espionage campaign designed to gain access to the networks of at least 18 tech firms.
This week Morphisec, the firm that discovered the backdoored version of CCleaner, said that there may be other similar attacks leveraging common applications that have been compromised in an attempt to gain access to even more corporate networks.
The company’s chief technology officer Michael Gorelik said that it is currently investigating historical “false positive” reports in an attempt to discover evidence if other applications have been backdoored. Gorelik said that he believes there were other supply chain attacks like the CCleaner one, and that the initial findings of the investigation were “very interesting.”
As SurfWatch Labs has previously noted, supply chains have proven to be one of the more difficult aspects for organizations to defend against, and malicious actors have shifted their attacks towards weak points in the supply chain to exploit the interconnected nature of organizations. For example, the June spread of WannaCry, perhaps the year’s most widely reported cyber incident, was tied to infections from the updater process for tax accounting software created by the Ukrainian company MEDoc.
The issues around CCleaner and MEDoc have been widely reported, but there are numerous other example of smaller-scale incidents that regularly occur. For example, last month npm, which describes itself as “the world’s largest software registry,” said that it removed more than 40 malicious packages after discovering an actor going by the name “hacktask” had published them with similar names to popular npm packages in an attempt to trick users into downloading them. In addition, popular Android apps, WordPress plugins, and other widely used products are frequently compromised to deliver various types of malware.
The researchers looking into supply chain attacks similar to CCleaner have not yet announced any other potential compromises, but organizations should keep an eye on the story to see if any discoveries occur in the coming weeks regarding applications being compromised to gain access to corporate networks.
Share this:
SurfWatch Labs, Inc. 