The Register: Blue Yonder ransomware termites claim credit

Dec 9, 2024

—

Source URL: https://www.theregister.com/2024/12/09/security_in_brief/
Source: The Register
Title: Blue Yonder ransomware termites claim credit

Feedly Summary: Also: Mystery US firm compromised by Chinese hackers for months; Safe links that aren’t; Polish spy boss arrested, and more
Infosec in brief Still smarting over that grocery disruption caused by a ransomware attack on supply chain SaaS vendor Blue Yonder? Well, now you have someone to point a finger at: the Termite ransomware gang.…

AI Summary and Description: Yes

**Summary:** The text discusses recent cybersecurity incidents, including a ransomware attack by the Termite group on the SaaS vendor Blue Yonder, critical vulnerabilities in software systems, exposure of user data from Safelinking, legal implications surrounding the use of Pegasus spyware in Poland, and sentencing related to a business email compromise scheme. It reveals ongoing security threats and the need for vigilance across various sectors, particularly for professionals in cybersecurity.

**Detailed Description:**

The text highlights several significant issues in the information security landscape, emphasizing the persistent and evolving threats that security professionals must address:

– **Ransomware Attack on Blue Yonder:**
– The Termite ransomware gang claimed responsibility for a major attack on Blue Yonder, a supply chain SaaS vendor.
– The group reportedly stole 680GB of data, including sensitive emails and documents, leading to operational disruptions for high-profile clients like Starbucks and UK grocery chains.
– Blue Yonder is currently working with external cybersecurity experts to recover from this incident.

– **Critical Vulnerabilities:**
– Two critical vulnerabilities have been reported, both with a CVSS score of 9.8, affecting Zyxel firewalls and the ProjectSend web app.
– These vulnerabilities are currently under active exploitation, highlighting the pressing need for organizations to patch their systems promptly.

– **Data Exposure from Safelinking:**
– Safelinking suffered a breach where a bot discovered unsecured MongoDB databases, exposing user information for over 156,000 accounts.
– Following ransom demands, the malicious bot destroyed the database, indicating significant risks associated with poor cybersecurity hygiene.

– **Legal Controversies Involving Pegasus:**
– The former chief of Poland’s internal security agency was arrested for refusing to testify about the alleged use of Pegasus spyware against political opponents, raising concerns about governmental oversight and privacy implications.

– **Business Email Compromise (BEC) Sentencing:**
– A Nigerian national, part of a BEC ring, was sentenced to eight years in prison for scamming businesses and individuals out of millions, emphasizing the real-world impacts of cybercrime.

– **Chinese Hacking Incident:**
– A significant unnamed US organization was reportedly targeted by a Chinese threat actor, who maintained network access for several months and potentially stole sensitive data, prompting concerns about geopolitical cybersecurity risks.

These incidents serve as crucial reminders for security professionals to:
– Enhance cybersecurity awareness and practices within their organizations.
– Regularly assess and patch vulnerabilities in infrastructure and software applications.
– Monitor for insider threats and external attacks, especially in sensitive sectors.
– Maintain compliance with evolving regulations surrounding data protection and privacy.

Overall, the text underscores the dynamic nature of the cybersecurity landscape and the need for robust defenses and proactive risk management strategies.

1 2 2024 4 a access Act active exploitation AI Application applications art as Asus attack awareness Blue Yonder breach business business email compromise Business Email Compromise (BEC) by C chain Chinese hackers Chinese hacking Chinese threat actor clients compliance concerns core critical cross Current cyber cybercrime Cybersecurity cybersecurity awareness cybersecurity expert cybersecurity experts cybersecurity hygiene cybersecurity incident cybersecurity incidents cybersecurity landscape Cybersecurity Risks D data data exposure Data Protection database databases defense document dual e email end evolving threats exp exploit Exploitation External firewall for g Gen geo geopolitical GIS Go government governmental oversight Group hack hacker hackers hacking high Highlight http HTTPS implications in incident information information security infosec infrastructure Insider Threat insider threats inter intern ite k l led Legal legal implications Link low management management strategies Mongo MongoDB my network network access no o of on one operation operational disruption organization organizations over oversight Patch Pegasus political cybersecurity pre privacy privacy implications proactive proactive risk management professionals projects prompt Py raising ransom ransom demand ransom demands ransomware ransomware attack ransomware gang RCE real Regulation regulations responsibility Risk risk management risk management strategies risks s SaaS sec secure security security awareness security hygiene security incident security incidents security landscape security professionals security risk security risks security threat security threats sensitive data side Sig SoC software source spy Spyware SSE supply supply chain system systems T Termite text the threat actor threats to Tor two up user user data user information vendor vigilance vulnerabilities web Well Wi x