Toyota halted production at all 14 of its Japanese factories due to a cyberattack against Kojima Industries -- an auto parts supplier. The supplier Kojima, whose website remains down as of Tuesday, first identified the attack on Saturday & subsequently shut down its entire computer network to prevent the malware from spreading. Overall, one-third of Toyota’s annual production is represented by Japanese factories.

Lessons learned: you are only as secure as your least-secure vendor. Recommendations on managing supply chain risks:

• Incorporate a higher probability of third-party attacks into threat models & vendor risk management policies.
• Review third-party MSPs’, cloud providers’ & software vendors’ access levels -- minimize to the extent possible.
• When existing partners don’t measure up, require them to make improvements.
• Do not do business with third-parties whose security practices are inadequate.

https://www.nytimes.com/2022/02/28/business/toyota-stoppage-cyberattack.html?

US DoJ's Virtual Asset Exploitation Unit

 Deputy AG Lisa Monaco announced the creation of the Virtual Asset Exploitation Unit -- a team tasked with training FBI agents to trace the flow of illicit cryptocurrency transactions:

The team will work with the DoJ’s newly launched National Cryptocurrency Enforcement Team to investigate & prosecute criminal misuses of cryptocurrency:

“This unit will combine cryptocurrency experts into one nerve center,” Monaco stated. 

Monaco’s announcement follows the DoJ’s largest ever financial recovery last week -- $3.6b in bitcoin stolen during the 2016 hack of Bitfinex.

“My message to cybercriminals is clear: The long arm of the law can and now will stretch much farther into cyberspace than you think,” Monaco stated.

Criminal groups -- often protected by nation states -- use cryptocurrencies because of their anonymity, appreciation & transaction ease:

• Stealing from exchanges: Hackers stole $14 billion in cryptocurrency in 2021 via theft & fraud -- a 79% increase over 2020.
• Ransomware payments: Hackers obtained $602m in cryptocurrency via ransomware in 2021.

https://www.nytimes.com/2022/02/17/us/politics/justice-department-cybersecurity.html?

Recent hacking activities by APT-27 (China)

International Committee of the Red Cross (ICRC) put out the below press release in mid-Feb of 2022.  An APT group had been in their systems for a while.  The initial compromise appears to be cve-2021-40539 which is a flaw in a web authentication module.  APT27 is known to exploit this CVE and use the webshells in question.

https://www.icrc.org/en/document/cyber-attack-icrc-what-we-know

Earlier in 2022, the German government warned of APT-27 hackers backdooring business networks, using the HyperBro remote access trojans (RAT) to backdoor into their networks.

https://www.bleepingcomputer.com/news/security/german-govt-warns-of-apt27-hackers-backdooring-business-networks/

A case of Hacktivism

 With the recent Canadian truckers events, a group of angry anonymous hackers leaked details of 92,000 donations supporting the truckers through the crowdfunding website GiveSendGo.

The data leak included a video in which the hackers complained that the protests had “held a city hostage.

The leaked data contained a record for each donation that included the donor’s name, ZIP code, & email address.

https://www.nytimes.com/2022/02/14/world/canada/canada-trucker-protests-donations.html?

The Chinese govt is repurposing its COVID health and contact tracing app to elevate its surveillance effort on citizens, including against criminals and dissidents. The government can make a person's health app to turn red to prevent the person from travelling.

In a recent case, a human-rights lawyer’s health app was suddenly switched to “red” when he attempted to travel to Shanghai to meet a dissident. 

This authoritarian approach has been consistent ever since the Chinese Communist Party took control of the mainland in 1949, only becoming more powerful in the last twenty years or so with the installation of millions of cameras to watch every street corner, and now with these apps to watch and control every citizen's movement.

For people living in China, there is no escape in sight. Perhaps they can get some freedom in the metaverse space? It's not hard to imaging that even that may soon be under the surveillance by the CCP.

https://www.nytimes.com/2022/01/30/world/asia/covid-restrictions-china-lockdown.html?

Financial Times has just revealed that the UK military and security agencies launched a cyber offense against ISIS in 2016-17. The operation has included disruption ISIS communications, compromising ISIS servers and drones, etc.

In addition, the article also cited UK officials that the UK cyber force will grow from a few hundred personnel to 3000 in the next decade.

Linkto the article: https://www.ft.com/content/360a8e1c-b241-40f7-b944-45a4f8854ac5

The recent SolarWinds related attack is part of a larger Russian hacking campaign. While we deal with this aggressive behavior from Russia at all levels, the attack also reminds us CloudHopper, a 2016 Chinese-led espionage campaign that targets many US organizations through the cloud service providers that they use. The main attack vector was spear phishing. The cloud service providers that were attacked included Fujitsu, Tata Consultancy Services, NTT Data, Dimension Data, Computer Sciences Corporation and DXC Technology. More details can be found in this nice Reuters article: https://www.reuters.com/investigates/special-report/china-cyber-cloudhopper/