{"id":8464,"date":"2023-12-18T15:07:30","date_gmt":"2023-12-18T12:07:30","guid":{"rendered":"https:\/\/cyberone.bg\/?p=8464"},"modified":"2024-02-22T14:55:38","modified_gmt":"2024-02-22T11:55:38","slug":"weekly-cybersecurity-report-week-52","status":"publish","type":"post","link":"https:\/\/cyberone.bg\/en\/weekly-cybersecurity-report-week-52","title":{"rendered":"Weekly Cybersecurity Report | Week 52"},"content":{"rendered":"<p>As your dedicated cybersecurity services provider, Cyberone equips you with timely and in-depth information about current cyber attacks. Discover a comprehensive overview of the latest exploits and breaches shaping the ever-evolving cybersecurity landscape.<\/p>\n<h4><strong>Weekly Cybersecurity Report | Week 52, 2023<\/strong><\/h4>\n<h3><b><span data-contrast=\"auto\">1 &#8211; Kyivstar, the largest mobile and internet provider in Ukraine, provides mobile services to 26 million citizens and internet services to 1.1 million subscribers, in addition to businesses and government services.<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">An attack group called Solntsepyok, whose name has been linked to the government in Russia, claimed responsibility for the cyber attack, posting on Telegram photos from Kyivstar&#8217;s network and claiming to have destroyed 10,000 computers and 4,000 servers.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The CEO of the Kyivstar company claims that the attack was successful after accessing the identification data of one of the employees.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Following the attack, the company&#8217;s services were widely shut down, most Ukrainian citizens were cut off from cellular services, including making calls and sending messages. Internet services were shut down for hundreds of thousands of households and businesses. In parts of the country, the alarm systems against air attacks stopped working. Many stores did not accept credit card transactions. ATMs stopped working. Street lighting shutdown in parts of the country.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">2 &#8211; The attack group Rhysida Toent that broke into the game development company Insomniac Games and demands a ransom of 50 bitcoins (~2 million dollars)<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">It is about the person who is responsible for the development of the Spider-Man game and other games.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The Rhysida Group publishes examples of sensitive documents it stole from the company&#8217;s network and sets a deadline of another 5 days for the payment of the ransom.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">3 &#8211; Due to an anti-Israeli cyber attack, the water supply in Erris in Ireland was stopped for a day.<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">In this case too, like the water, the attack was carried out in code against the controllers of the Israeli Unitronics company. The local water company uses these controllers as the water pumps.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The attack on the water supply of about 180 families who remained without water during the day.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">4 &#8211; The GRTC company, which provides public transportation services in Virginia, reports that it suffered a cyber attack.<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">The company claims that the decision was made about two weeks ago and as a result some of the company&#8217;s systems were shut down.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The Play attack group took responsibility for the attack this week.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">5 &#8211; US nuclear research lab data breach affects 45,000 people<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Ido National Laboratory (INL) confirmed that attackers stole personal information of more than 45,000 people after hacking its cloud-based Oracle HCM human resources management platform last week.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">INL is one of 17 national laboratories of the Department of Energy (DOE), offering 6,100 research and support staff engaged in national security and nuclear research.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">On Nov. 20, it confirmed a &#8220;cybersecurity data breach&#8221; that affected its off-site Oracle HCM system a day earlier. CISA and the FBI are examining its impact as part of an ongoing joint investigation.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/us-nuclear-research-lab-data-breach-impacts-45-000-people\/#google_vignette\"><span data-contrast=\"none\">https:\/\/www.bleepingcomputer.com\/news\/security\/us-nuclear-research-lab-data-breach-impacts-45-000-people\/#google_vignette<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">6 &#8211; 10,000 people&#8217;s data was stolen in the leak of the genetic testing company Asper Biogene<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Personal and health data belonging to about 10,000 people were illegally downloaded from the Asper Biogene genetic testing database, the regulator&#8217;s office said Thursday.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">An investigation by the Southern District Criminal Bureau found no evidence at the time. The Safety Inspection (Andmekaitse Inspektsioon) also started an inspection procedure against a laboratory.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Asper Biogene, which specializes in the diagnosis of hereditary drugs, alerted the police, the State Systems Agency (Riigi Infos\u00fcsteimi Amet), and the data protection supervision on November 11.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/news.err.ee\/1609194952\/10-000-people-s-data-stolen-in-genetic-testing-company-asper-biogene-leak\"><span data-contrast=\"none\">https:\/\/news.err.ee\/1609194952\/10-000-people-s-data-stolen-in-genetic-testing-company-asper-biogene-leak<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">7 &#8211; The Swiss District Court &#8220;Victim of a Cyber Attack&#8221;<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">The Swiss District Court declared on Tuesday that he was a &#8220;victim of a cyber attack&#8221;.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The court, in the German-speaking district of March in central Switzerland, serves a population of about 45,000 people.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The nature of the gift was not revealed, although the limited description on the court&#8217;s website indicates that it may be a ransom attack.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">It is not clear when IT will be available again, but it could take a few days,&#8221; the website said.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Court phone lines are currently disconnected, however scheduled court hearings are expected to go ahead as scheduled.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/therecord.media\/district-court-switzerland-cyberattack?&amp;web_view=true\"><span data-contrast=\"none\">https:\/\/therecord.media\/district-court-switzerland-cyberattack?&amp;web_view=true<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">8 &#8211; The largest taxi application in Dubai reveals more than 220 thousand users<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">The Dubai Taxi Company (DTC) app, which provides taxi, limousine and other transportation services, has left a database open to the public, exposing sensitive customer and driver data. Dubai Taxi Company, a subsidiary of the Dubai Roads and Transport Authority, leaked more than 197,000 app users and nearly 23,000 drivers were exposed.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The company claims to command 44% of Dubai&#8217;s market share by the size of its taxi fleet, making it the largest service provider in the UAE&#8217;s most populous city. DTC says it operates over 7,000 vehicles and has an active workforce of 14,000 driver associates.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The exposed data was stored in an open MongoDB database, which has since been closed. Businesses employ MongoDB to organize and store large chunks of information. The DTC app has more than 100,000 downloads on the Google Play Store.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/securityaffairs.com\/155695\/security\/dubai-taxi-company-data-leak.html\"><span data-contrast=\"none\">https:\/\/securityaffairs.com\/155695\/security\/dubai-taxi-company-data-leak.html<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">9 &#8211; Toyota warns customers against a data breach that exposes personal and financial information<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Toyota Financial Services (TFS) is warning customers that it has suffered a data breach, stating that sensitive personal and financial data was exposed in the attack.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Toyota Financial Services, a subsidiary of Toyota Motor Corporation, is a global entity with a presence in 90% of the markets where Toyota sells its cars, providing vehicle financing to its customers.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Last month, the company confirmed that it had detected unauthorized access to some of its systems in Europe and Africa, following a Medusa ransomware claim for successfully breaching a division of the Japanese automaker.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/toyota-warns-customers-of-data-breach-exposing-personal-financial-info\/\"><span data-contrast=\"none\">https:\/\/www.bleepingcomputer.com\/news\/security\/toyota-warns-customers-of-data-breach-exposing-personal-financial-info\/<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">10 &#8211; Cold storage giant Americold discloses a data breach after a malware attack in April<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Cold storage and logistics giant Americold confirmed that over 129,000 employees had their personal information stolen in an attack in April that was later claimed by Cactus ransomware.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Americold employs 17,000 people worldwide and operates more than 24 temperature-controlled warehouses throughout North America, Europe, Asia-Pacific and South America.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The April network breach led to an outage that affected the company&#8217;s operations after Americold forced it to shut down its IT network to contain the breach and &#8220;rebuild the affected systems.&#8221;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/cold-storage-giant-americold-discloses-data-breach-after-april-malware-attack\/\"><span data-contrast=\"none\">https:\/\/www.bleepingcomputer.com\/news\/security\/cold-storage-giant-americold-discloses-data-breach-after-april-malware-attack\/<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">11 &#8211; Virginia&#8217;s Central Transportation System is affected by a cyber incident<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">The organization that manages the transportation system for central Virginia faced computer network disruption due to a cyber attack around Thanksgiving.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The Greater Richmond Transit Company (GRTC) provides bus and specialty transit services to millions of people throughout Richmond, Chesterfield, and Henrico counties.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">According to the spokesperson, around Thanksgiving they experienced a network outage that &#8220;temporarily affected certain applications and portions of the GRTC network.&#8221;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">&#8220;In response, our IT team quickly discovered and restored our computer network. GRTC also engaged third-party computer experts to investigate the nature and scope of the incident,&#8221; the spokesperson said.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">&#8220;All services are now operating as planned and GRTC does not expect any further disruptions to riders at this time.&#8221;<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The spokesperson refused to answer further questions about whether this was a ransomware attack or whether data was stolen during the incident.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><strong>12 &#8211; The Play ransomware gang took credit for the attack, publicizing the organization on its leak site on Thursday.<\/strong><\/h3>\n<p><span data-contrast=\"auto\">The group gave GRTC until December 13 to pay the as-yet-unknown ransom.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/therecord.media\/central-va-transit-system-cyberattack?&amp;web_view=true\"><span data-contrast=\"none\">https:\/\/therecord.media\/central-va-transit-system-cyberattack?&amp;web_view=true<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><strong><em>The attacks highlighted in this report aren&#8217;t just incidents; they&#8217;re blueprints of the adversary&#8217;s arsenal. To protect your business you need the right protection. Cyberone is here to help! Check out our <a href=\"https:\/\/cyberone.bg\/en\/services\">services<\/a>.<\/em><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>As your dedicated cybersecurity services provider, Cyberone equips you with timely and in-depth information about current cyber attacks. Discover a comprehensive overview of the latest exploits and breaches shaping the ever-evolving cybersecurity landscape. Weekly Cybersecurity Report | Week 52, 2023 1 &#8211; Kyivstar, the largest mobile and internet provider in Ukraine, provides mobile services to [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":8597,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[57,56],"class_list":["post-8464","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-weekly-cyber-updates","tag-cybersecurity","tag-weekly-update"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/posts\/8464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/comments?post=8464"}],"version-history":[{"count":1,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/posts\/8464\/revisions"}],"predecessor-version":[{"id":8465,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/posts\/8464\/revisions\/8465"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/media\/8597"}],"wp:attachment":[{"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/media?parent=8464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/categories?post=8464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberone.bg\/en\/wp-json\/wp\/v2\/tags?post=8464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}