IFTTT

Oligo Security strives to fill application-layer gaps in MITRE ATT&CK framework

~ Reporter ~ Leave a comment

Applications are a common intrusion point, but the way attackers gain access, maneuver and create mayhem within and across applications doesn’t always neatly fit into MITRE’s ATT&CK framework. 

The team at Oligo Security is releasing a new framework it calls Application Attack Matrix to complement areas of MITRE’s framework that it describes as too broad, filling gaps to help defenders and organizations better understand and define how attackers use applications and the actions they’re taking often under disguise.

“Most of the approaches that we know today are focused on the post-exploit technique, and on the infrastructure and endpoint,” Gal Elbaz, Oligo Security’s co-founder and CTO, told CyberScoop. This, he said, is akin to addressing the symptom of an attack without understanding the root cause of how attackers broke in.

The effort, which has grown and built on support from threat intelligence and enterprise security leaders — and from MITRE itself — addresses every tactic in the MITRE ATT&CK framework pertaining to the application attack lifecycle: pre-intrusion, intrusion, post-intrusion and impact. “Each and every layer of those tactics are being utilized by techniques that are happening on the app layer,” Elbaz said.

The Application Attack Matrix addresses what occurred at the app level, distinguishing between an exploited vulnerability, bypassed control, login without a credential, or a supply-chain compromise via software or software development tools.

It also distinguishes exactly how exploitation occurs, broadening the category of remote code execution to include specific tactics such as command injection of an arbitrary file, lightweight directory access protocol injection, XML injection or a SQL injection.

In the most equivalent MITRE technique, the containers matrix, “nothing talks about what’s happening inside the container, whether it was the application layer that was compromised by maybe a Python package, or Java, or Go, or node, or just the ability to understand the act of the intrusion,” Elbaz said. 

In MITRE, the exploit of a public-facing application — a common technique for initial access — is broad, encompassing about 65 different types of attacks, he said. 

Avi Lumelsky, AI security researcher at Oligo Security, said the Application Attack Matrix breaks down these dozens of attacks that are grouped under the exploitation of a public-facing application technique into real-world scenarios.

“MITRE also covers those, but we tried to break it down into more specific sub-techniques and techniques that are very, very specific to applications, no matter where they run,” Lumelsky said. “We are focusing on cloud applications, but we don’t care what is the cloud provider, whether it’s a container or not, whether it’s a regular machine or Kubernetes. To us, an application is an application.”

The knowledge base that Oligo Security plans to release as open source on GitHub includes a framework and taxonomy for categorizing and exchanging information about application-layer threats and steps for mitigation. Leaders of the Tel Aviv, Israel-based company, which was founded in 2022, assert this conjunctive framework is required to understand how attackers circumvent cybersecurity systems, exploit application vulnerabilities and security blind spots in web, mobile and microservice environments. 

“Our new matrix, this new approach, focuses on the application level, which is exactly the kind of attacks that have been spotted in the wild,” Elbaz said. Some of the most devastating attacks, such as Log4Shell, MOVEit and SolarWinds, were carried out inside application contexts, he added. 

“We cannot monitor what’s happening inside the application, and this became the biggest blind spot for attackers, and their ability to really stay invisible and undetected by other security tools,” Elbaz said. “The Application Attack Matrix is the first dedicated framework for real world application attacking techniques.”

The Application Attack Matrix is a community effort that Oligo Security envisions as an ongoing project with industrywide support. “It’s everybody’s problem,” Lumelsky said. “I think everybody understands it, and we welcome everybody to contribute.”

The post Oligo Security strives to fill application-layer gaps in MITRE ATT&CK framework appeared first on CyberScoop.

from CyberScoop https://ift.tt/ZAoC5nU
via IFTTT

Introducing Oracle Database@AWS for simplified Oracle Exadata migrations to the AWS Cloud

~ Reporter ~ Leave a comment

Today, we’re announcing the general availability of Oracle Database@AWS, a new offering for Oracle Exadata workloads, including Oracle Real Application Clusters (RAC) within AWS.

In the past 14 years, customers had the choice of self-managing Oracle database workloads in the cloud using Amazon Elastic Compute Cloud (Amazon EC2) or using fully managed Amazon Relational Database Service (Amazon RDS) for Oracle. Now, you have an additional option for your workloads that require Oracle RAC or Oracle Exadata for quicker and simpler migrations to the cloud. You also get a single invoice through AWS Marketplace, which counts towards AWS commitments and Oracle license benefits, including Bring Your Own License (BYOL) and discount programs such as Oracle Support Rewards.

With Oracle Database@AWS, you can migrate your Oracle Exadata workloads to Oracle Exadata Database Service on Dedicated Infrastructure or Oracle Autonomous Database on Dedicated Exadata Infrastructure within AWS with minimal changes. You can purchase, provision, and manage your Oracle Database@AWS deployments through familiar AWS tools and interfaces such as AWS Management Console, AWS Command Line Interface (AWS CLI), or AWS APIs for applications running on AWS. The AWS APIs call the corresponding Oracle Cloud Infrastructure (OCI) APIs necessary to provision and manage the resources.

Since its preview last December, we’ve improved or added features to help run production workloads at general availability:

  • Regional expansion – You can now use Oracle Database@AWS in the U.S. East (N. Virginia) and U.S. West (Oregon) Regions today. We are also announcing plans to expand to 20 AWS Regions globally. This broader availability supports the diverse needs of our customers across various geographical areas so more enterprises can benefit from this option. You can choose from different Exadata system sizes to match your workload requirements in your AWS Region.
  • Zero-ETL and S3 backups – You can now benefit from zero-ETL integration with Amazon Redshift for analytics to remove the need to build and manage data pipelines for extract, transform, and load operations. With zero-ETL, you can unify your data on AWS without incurring cross network data transfer costs. We’re providing Amazon Simple Storage Service (Amazon S3) backups with up to eleven nines of data durability.
  • Autonomous VM cluster – You can now provision an Autonomous VM Cluster in addition to an Exadata VM cluster on the Exadata Dedicated Infrastructure. You can run Oracle Autonomous Database on Dedicated Exadata Infrastructure, a fully managed database environment using committed hardware and software resources.

Oracle Database@AWS also integrates with other AWS services such as Amazon Virtual Private Cloud (Amazon VPC) Lattice for configuring network paths to AWS services such as S3 and Redshift directly, AWS Identity and Access Management (IAM) for authentication and authorization, Amazon EventBridge for monitoring database lifecycle events, AWS CloudFormation for infrastructure automation, Amazon CloudWatch for collecting and monitoring metrics, and AWS CloudTrail for logging API operations.

Getting started with Oracle Database@AWS
Oracle Database@AWS supports two key services: Oracle Exadata Database Service on Dedicated Infrastructure and Oracle Autonomous Database on Dedicated Exadata Infrastructure within AWS data centers.

These services physically reside within an Availability Zone in an AWS Region and logically reside in an OCI region, enabling seamless integration with AWS services through high-speed, low-latency connections.

You create an ODB network, a private, isolated network that hosts Oracle Exadata VM Clusters within an Availability Zone. Then, you use ODB peering accessible to EC2 application servers running in a VPC. To learn more, visit How Oracle Database@AWS works in the AWS documentation.

Request a private offer in AWS Marketplace

To begin your journey with Oracle Database@AWS, visit the AWS console or request the AWS Marketplace private offer. Your AWS and Oracle sales team will receive your request, then contact you to find the best option for your workloads, and activate your account.

When you activate and get access to Oracle Database@AWS, you can use the Dashboard to create an ODB network, Exadata infrastructure, and Exadata VM cluster or Autonomous VM cluster, and ODB peering connection.

To learn more, visit the Onboarding to Oracle Database@AWS and AWS Marketplace buyer private offers in the AWS documentation.

Create an ODB network

An ODB network is a private isolated network that hosts OCI infrastructure on AWS. The ODB network maps directly to the network that exists within the OCI child site, thus serving as the means of communication between AWS and OCI.

In the Dashboard, choose Create ODB network, enter a network name, choose the Availability Zone, and specify a CIDR ranges for client connections established by applications and backup connections used for taking automated backups. You can also enter a name to use as a prefix to your domain fixed as oraclevcn.com. For example, if you enter myhost, the fully qualified domain name is myhost.oraclevcn.com.

Optionally, you can configure ODB network access to perform automated backups to Amazon S3 and zero-ETL for near real-time analytics and ML on your Oracle data using Amazon Redshift.

After you create your ODB network, update your VPC route tables of your EC2 application servers with the client connection CIDR in the ODB network. To learn more, visit ODB network, ODB peering, and Configuring VPC route tables for ODB peering in the AWS documentation.

Create Exadata infrastructure

The Oracle Exadata infrastructure is the underlying architecture of your database servers, storage servers, and networking that run your Oracle Exadata databases.

Choose Create Exadata infrastructure, enter a name, and use the default Availability Zone. In the next step, you can choose Exadata.X11M for the Exadata system model. You can also set a default of 2 or up to 32 database servers and 3 or up to 64 storage servers with 80 TB storage capacity per server.

Finally, you can configure system maintenance preferences, such as scheduling, patching mode, and OCI maintenance notification contacts. You can’t modify an infrastructure after you create it from the AWS console. But, you can navigate to the OCI console and modify it.

To delete an Exadata infrastructure, visit Deleting an Oracle Exadata infrastructure in Oracle Database@AWS in the AWS documentation.

Create an Exadata VM cluster or Autonomous VM cluster

You can create VM clusters on Exadata infrastructure and deploy multiple VM clusters with different Oracle Exadata infrastructures in the same ODB network.

Here are two types of VM clusters:

  • An Exadata VM cluster is a set of virtual machines that has a complete Oracle database installation that includes all features of Oracle Enterprise Edition.
  • An Autonomous VM cluster is a set of fully managed databases that automate key management tasks using AI/ML with no human intervention required.

Choose Create Exadata VM cluster, enter a VM cluster name and a time zone, choose Bring Your Own License (BYOL) or license included for license options. In the next step, you can choose your Exadata infrastructure, grid infrastructure version, and Exadata image version. For database servers, you can choose the CPU core count, memory, and local storage for each VM or accept the defaults.

In the next step, you can configure the connectivity setting by choosing your ODB network and entering a prefix for the VM cluster. You can enter a port number for TCP access to the single client access name (SCAN) listener. The default port is 1521 or you can enter a custom SCAN port in the range 1024–8999. For SSH key pairs, enter the public key portion of one or more key pairs used for SSH access to the VM cluster.

Then, you can choose diagnostics and tags, review your settings, and create a VM cluster. The creation process can take up to 6 hours, depending on the size of the VM cluster.

Create and manage an Oracle database

When the VM cluster is ready, you can create and manage your Oracle Exadata databases in the OCI console. Choose Manage in OCI in the details page of the Exadata VM cluster. You will be redirected to the OCI console.

When you create an Oracle Database in the OCI console, you can select Oracle Database 19c or 23ai. When enabling automatic backups for your provisioned databases, you can use an S3 bucket or OCI Object Storage in the OCI region. To learn more, visit Provision Oracle Exadata Database Service in Oracle Database@AWS in the OCI documentation.

Things to know
Here are a couple of things to know about Oracle Database@AWS:

  • Monitoring – You can monitor Oracle Database@AWS using Amazon CloudWatch metrics in the AWS/ODB namespaces for VM clusters, container databases, and pluggable databases. AWS CloudTrail captures all AWS API calls for Oracle Database@AWS as events. Using CloudTrail logs, you can determine the request that was made to Oracle Database@AWS, the IP address from which the request was made, when it was made, and additional details. To learn more, visit Monitoring Oracle Database@AWS.
  • Security – You can use IAM to assign permissions that determine who is allowed to manage Oracle Database@AWS resources and SSL/TLS encrypted connections to secure data. You can also use Amazon EventBridge for seamless event-driven database operations—all working together to maintain security standards while enabling efficient cloud operations. To learn more, visit Security in Oracle Database@AWS.
  • Compliance – Your compliance responsibility when using Oracle Database@AWS is determined by the sensitivity of your data, your company’s compliance objectives, and applicable laws and regulations. We provides the following compliances with Oracle Database@AWS: SOC 1, SOC 2, SOC 3, HIPAA, C5, CSA STAR Attest, CSA STAR Cert, HDS (France), ISO Series (ISO/IEC 9001, 20000-1, 27001, 27017, 27018, 27701, 22301), PCI DSS, and HITRUST. To learn more, visit Compliance validation for Oracle Database@AWS.
  • Support – Your AWS or Oracle sales account team can help you evaluate your current database infrastructure, determine how Oracle Database@AWS can best serve your organization’s requirements, and develop a tailored migration strategy and timeline. You can also get help from AWS Oracle Competency Partners specialized to architect, deploy, and manage Oracle-based workloads running in the AWS Cloud.

Now available and coming soon
Oracle Database@AWS is now available in the U.S. East (N. Virginia) and U.S. West (Oregon) Regions through the AWS Marketplace. Oracle Database@AWS pricing and any AWS Marketplace private offers are set by Oracle. You can see specific details around pricing on Oracle’s pricing page for the offering.

Oracle Database@AWS will expand to 20 more AWS Regions across the Americas, Europe, and Asia-Pacific including: US East (Ohio), US West (N. California), Asia Pacific (Hyderabad), Asia Pacific (Melbourne), Asia Pacific (Mumbai), Asia Pacific (Osaka), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Milan), Europe (Paris), Europe (Spain), Europe (Stockholm), Europe (Zurich), and South America (São Paulo).

You can get started with Oracle Database@AWS with using AWS console. To learn more, visit the Oracle Database@AWS User Guide and OCI documentation and send feedback through your usual AWS Support contacts or OCI support.

— Channy

from AWS News Blog https://ift.tt/HRk6YxA
via IFTTT

AWS Weekly Roundup: Amazon Bedrock API Keys, Amazon Nova Canvas virtual try-on, and more (July 7, 2025)

~ Reporter ~ Leave a comment

Every Monday we tell you about the best releases and blogs that caught our attention last week.

Before continuing with this AWS Weekly Roundup, I’d like to share that last month I moved with my family to San Francisco, California, to start a new role as Developer Advocate/SDE, GenAI.

This excites me because I’ll have the opportunity to connect with new communities in the Bay Area while tackling exciting new challenges. If you’re part of a community focused on building generative AI and agentics applications, or know of one, I’d love to connect. Let’s connect!

Last week’s launches
Here are the launches from last week:

  • New Amazon EC2 C8gn instances powered by AWS Graviton4 offering up to 600Gbps network bandwidth – Amazon Elastic Compute Cloud (Amazon EC2) C8gn instances are now generally available, powered by AWS Graviton4 processors and 6th generation AWS Nitro Cards. These network-optimized instances deliver up to 600 Gbps network bandwidth. This represents the highest bandwidth among EC2 network-optimized instances, with up to 192 vCPUs and 384 GiB memory. They provide 30% higher compute performance than C7gn instances and are ideal for network-intensive workloads like virtual appliances, data analytics, and cluster computing jobs.
  • Build the highest resilience apps with multi-Region strong consistency in Amazon DynamoDB global tables – Amazon DynamoDB global tables now supports multi-Region strong consistency (MRSC) for applications requiring zero Recovery Point Objective (RPO). This capability ensures applications can read the latest data from any Region during outages, addressing critical needs in payment processing and financial services. MRSC requires three AWS Regions configured as either three full replicas or two replicas plus a witness, providing the highest level of application resilience for mission-critical workloads.
  • Amazon Nova Canvas update: Virtual try-on and style options now available – Amazon Nova Canvas introduces virtual try-on capabilities that help you visualize how clothing looks on a person by combining two images, plus eight new pre-trained style options (3D animation, design sketch, vector illustration, graphic novel, etc.) for generating images with improved artistic consistency. Available in three AWS Regions, these features enhance AI-powered image generation capabilities for retailers and content creators seeking realistic product visualizations.
  • Amazon Q in Connect now supports 7 languages for proactive recommendations – Amazon Q in Connect, a generative AI-powered assistant for customer service, now provides proactive recommendations in seven languages: English, Spanish, French, Portuguese, Mandarin, Japanese, and Korean. The AI-powered customer service assistant detects customer intent during voice and chat interactions to help agents resolve issues quickly and accurately.
  • Amazon Aurora MySQL and Amazon RDS for MySQL integration with Amazon SageMaker is now available – This integration provides near real-time data availability for analytics. It automatically extracts MySQL data into lakehouses with Apache Iceberg compatibility. You can then access this data seamlessly through various analytics engines and machine learning tools.
  • Amazon Aurora DSQL is now available in additional AWS Regions – Amazon Aurora DSQL expands to Asia Pacific (Seoul) and now supports multi-Region clusters across Asia Pacific and European regions. This serverless, distributed SQL database offers unlimited scalability, highest availability, and zero infrastructure management with AWS Free Tier access.

Other AWS blog posts

  • Optimize RAG in production environments using Amazon SageMaker JumpStart and Amazon OpenSearch Service – Learn how to optimize Retrieval Augmented Generation (RAG) in production environments using Amazon SageMaker JumpStart and Amazon OpenSearch Service. This comprehensive guide demonstrates implementing RAG workflows with LangChain, covers OpenSearch optimization strategies, provides setup instructions, and explains benefits of combining these AWS services for scalable, cost-effective generative AI applications.v
  • Agentic GenAI App Using Bedrock, MCP servers on EKS – This post shows how to build a scalable AI chat application using Amazon Bedrock, Strands Agent, and Model Context Protocol (MCP) servers deployed on Amazon Elastic Kubernetes Service (Amazon EKS). The architecture combines agentic workflows with containerized microservices for intelligent, auto-scaling conversations with multiple foundation models.
  • Enforce table level access control on data lake tables using AWS Glue 5.0 with AWS Lake Formation – AWS Glue 5.0 introduces Full-Table Access (FTA) control for Apache Spark with AWS Lake Formation, providing table-level security without fine-grained access overhead. This feature supports native Spark SQL/DataFrames for Lake Formation tables. It enables read/write operations on Iceberg and Hive tables with improved performance and lower costs.

Upcoming AWS events
Check your calendars and sign up for these upcoming AWS events:

  • AWS re:Invent – Register now to get a head start on choosing your best learning path, booking travel and accommodations, and bringing your team to learn, connect, and have fun. Early-career professionals can apply for the All Builders Welcome Grant program, designed to remove financial barriers and create diverse pathways into cloud technology. Applications are now open and close on July 15, 2025.
  • AWS NY Summit – You can gain insights from Swami’s keynote featuring the latest cutting-edge AWS technologies in compute, storage, and generative AI. My News Blog team is also preparing some exciting news for you. If you’re unable to attend in person, you can still participate by registering for the global live stream. Also, save the date for these upcoming Summits in July and August near your city.
  • AWS Builders Online Series – If you’re based in one of the Asia Pacific time zones, join and learn fundamental AWS concepts, architectural best practices, and hands-on demonstrations to help you build, migrate, and deploy your workloads on AWS.
  • Join AWS Gen AI Lofts – Experience AWS Gen AI Lofts across San Francisco, Berlin, Dubai, Dublin, Bengaluru, Manchester, Paris, Tel Aviv, and additional locations – hands-on workshops, expert guidance, investor networking, and collaborative spaces designed to accelerate your generative AI startup journey.

You can browse all upcoming in-person and virtual events.

That’s all for this week. Check back next Monday for another Weekly Roundup!

— Eli

from AWS News Blog https://ift.tt/5NACBxI
via IFTTT

Scattered Spider weaves web of social-engineered destruction

~ Reporter ~ Leave a comment

In an underworld fueled by infamy and money that leaves a trail of human misery in its wake, the unbound collective colloquially known as Scattered Spider deviates from many norms in cybercrime.

The cunning threat group composed of young, native English-speaking people lacks cohesion, is rife with infighting and doesn’t have a data leak site, which many financially motivated cybercriminals use to claim responsibility for alleged victims and ramp up pressure to pay extortion demands. 

Scattered Spider’s preferred methods of intrusion — social engineering and phishing — makes it difficult for most threat hunters to attribute attacks to the collective with confidence. The cybercrime outfit doesn’t leave the types of fingerprints behind that researchers typically track, and as a result there’s considerable discrepancies and uncertainty across the industry with respect to what Scattered Spider is, how it determines targets and which companies it has attacked.

As Scattered Spider has risen the ranks of cybercrime — most recently suspected of attacking Marks & Spencer in the United Kingdom, United Natural Foods, WestJet and Hawaiian Airlines — researchers have been mapping clues about the organization and how it operates.

Following a brief hiatus starting last summer, Scattered Spider regrouped earlier this year and has hit dozens of companies in the retail, insurance and aviation industries. The group first gained notoriety for attacks on MGM Resorts and Caesars Entertainment in 2023.

Scattered Spider has infiltrated more than 100 businesses since 2022, hitting organizations in hospitality and gaming, manufacturing, technology and cloud services, telecommunications, retail, manufacturing, food production, insurance and financial services, media, apparel, business process outsourcing, health care, transportation and aviation, according to researchers.

The group’s total take on extortion demands exceeds $66 million, the cybersecurity firm Halcyon told CyberScoop, but it’s likely collected much more. “I’ve had clients pay them eight figures,” said Charles Carmakal, chief technology officer at Mandiant Consulting, which tracks the group as UNC3944.

Scattered Spider doesn’t always encrypt data or systems, but when it does the group has used multiple ransomware variants, including Akira, AlphV, Play, Qilin, RansomHub and most recently DragonForce, researchers said.

Cynthia Kaiser, senior vice president of Halcyon’s ransomware research center, describes Scattered Spider as a “decentralized but tightly aligned group” with a clear division of roles and responsibilities. This includes a small band of two to four senior operators and leaders who function as project managers, coordinating with initial access brokers, ransomware affiliates and negotiators.

“Meanwhile, you have newcomers and junior affiliates, and they’re conducting all those lower-tier operations to prove themselves, trying to test detection thresholds,” said Kaiser, former deputy assistant director of the FBI’s cyber policy, intelligence and engagement branch. 

Researchers wobble on the number of people involved with Scattered Spider because of this tiered structure. The inner circle is tight, followed by dozens of others and then a larger pool of people who filter in and out of the group to facilitate operations, incident response specialists told CyberScoop.

Scattered Spider is an offshoot of The Com, a much larger grassroots network of more than 1,000 people responsible for a vast catalog of crimes, including social engineering, crypto theft, phishing, SIM swapping, extortion, sextortion, swatting, kidnapping and murder. 

While the volume and intensity of attacks linked to Scattered Spider following its resurgence might appear extraordinary, the group’s tempo of activity was much higher in previous years, according to Carmakal. 

Many Scattered Spider victims have disclosed attacks over the years, but they were never formally attributed to the cybercrime collective. 

“It is notable again because we are paying more attention to this group,” Carmakal said. “Now we talk about them and people care about them because they’ve seen the kinetic outcomes of their cyberattacks. That’s the difference.”

Social engineering the help desk

Another change involves the group’s tactics. While Scattered Spider’s early hits in 2022 and 2023 were the result of social-engineering attacks, the group transitioned to domain-based phishing through much of 2024 before activity went dormant last summer. The group’s revival this year marks a throwback in tactics, as it has relied exclusively once again on social engineering as an initial access vector.

“Come March, when they basically abandoned all their phishing pages, they threw out all of the playbooks they’ve been using and they went back to their very original playbooks,” said Zach Edwards, threat researcher at Silent Push.

Scattered Spider has mostly intruded companies’ networks over the past few months by socially engineering help-desk employees. This includes requests for password resets, removing phone numbers from multifactor authentication solutions to enroll new devices, or adding a phone number to an account to issue a self-service password reset. 

“Once Scattered Spider calls the help desk and gets on the phone with them, there’s a clock ticking, and the help desk has only so much time to close that ticket in order to hit their metrics,” said Adam Meyers, senior video president of counter adversary operations at CrowdStrike. 

“They’re taking advantage of the fact that these help desks validate the authenticity of the person simply by checking whatever the criteria is that they’ve been given,” he said.

These callers have been very successful without much effort, according to Chris Yule, director of threat research at Sophos Counter Threat Unit. “In some cases, if not many cases, they are not getting very much pushback at all or any resistance they’re having to overcome.”

There’s a debate among threat researchers about the extent to which Scattered Spider is purposely targeting single industries before pivoting to new sectors, or merely going after help-desk outsourcing firms, which happen to have a lot of customers in a specific vertical.

Researchers at Halcyon said recent attacks against U.K. retailers and U.S.-based insurance companies likely originated, at least in part, from Scattered Spider’s compromise of business process outsourcing providers. 

Carmakal doesn’t think Scattered Spider is methodically targeting outsourced IT help desks in particular and cautioned people against concluding that any particular help-desk provider is the source of a compromise.

Mandiant defines patterns of attribution

Mandiant, which has provided incident response services to many Scattered Spider victims, has repeatedly offered early warnings of patterns of attacks in a given industry, including a shift to U.S.-based retailers, and more recently the insurance industry and North American airlines. Each of those ominous warnings were proven out days or weeks later as attack sprees came to light across those sectors.

When Mandiant says Scattered Spider is targeting a specific sector, from an investigative perspective, the attacks follow the same attacker playbook. “It’s how they’re getting access to credentials. It’s what they’re doing immediately when they have credentials. It’s how they’re using credentials on domain controllers in a very unique way. It’s the tooling that they’re using. It’s the re-use of the infrastructure,” Carmakal said. 

“There’s a lot of patterns that allow us to predict what they’re going to do over the next few days and weeks, and those patterns and predictability could change at any point in time. They’re a very capable group,” he continued. “I see patterns in the totality of the incident. It can’t just be a pattern in the social engineering and the telephone call.”

Scattered Spider isn’t the only cybercrime ring using social engineering or attacking organizations in sectors known to be targeted by the group. Yet, Scattered Spider often gets unsubstantiated credit for activities beyond its purview.

Other threat groups such as UNC6040, which is also affiliated with the Com, have attacked companies in the same sectors via social engineering. Google Threat Intelligence Group attributed at least 20 intrusions to UNC6040 as of last month. 

“Activity involving a social engineering of the help desk might look and feel like Scattered Spider,” but some industry observers are prematurely drawing attribution conclusions, Carmakal said.

Web of destruction drifts in the wind

Scattered Spider’s web of destruction persists and continues to catch more victims because its techniques and specialization in targeting the cloud and identity works across all sectors. 

“They’re targeting the weakest link in the security chain, which is the human,” Meyers said. “They’re very fast and, once they gain access, you have oftentimes well under 48, even 24, hours to find them and eradicate them from your infrastructure before they’re able to run an encryption. So, speed is a killer.

“Unless somebody takes them off the field, they’re gonna keep doing what they’re doing,” he added. “There’s no reason not to.”

Edwards noted that social engineering attacks have been successful since the dawn of the telephone. “Voice as confirmation is a fabulous way to get around security, where if you know the little keyphrases to use — the slang, the lingo — it’s voice of trust,” he said.

“If you call, you know the right things to say, you know what they’re going to ask, and you have answers ready,” Edwards added. “It’s an incredibly effective way to basically gain trust from someone and then get them to do something they normally wouldn’t do.”

The post Scattered Spider weaves web of social-engineered destruction appeared first on CyberScoop.

from CyberScoop https://ift.tt/knAsQuD
via IFTTT

Taiwan NSB Alerts Public on Data Risks from TikTok, Weibo, and RedNote Over China Ties

~ Reporter ~ Leave a comment

Taiwan’s National Security Bureau (NSB) has warned that China-developed applications like RedNote (aka Xiaohongshu), Weibo, TikTok, WeChat, and Baidu Cloud pose security risks due to excessive data collection and data transfer to China.
The alert comes following an inspection of these apps carried out in coordination with the Ministry of Justice Investigation Bureau (MJIB) and the Criminal

from The Hacker News https://ift.tt/20RQo3n
via IFTTT

Big Tech’s Mixed Response to U.S. Treasury Sanctions

~ Reporter ~ Leave a comment

In May 2025, the U.S. government sanctioned a Chinese national for operating a cloud provider linked to the majority of virtual currency investment scam websites reported to the FBI. But a new report finds the accused continues to operate a slew of established accounts at American tech companies — including Facebook, Github, PayPal and Twitter/X.

On May 29, the U.S. Department of the Treasury announced economic sanctions against Funnull Technology Inc., a Philippines-based company alleged to provide infrastructure for hundreds of thousands of websites involved in virtual currency investment scams known as “pig butchering.” In January 2025, KrebsOnSecurity detailed how Funnull was designed as a content delivery network that catered to foreign cybercriminals seeking to route their traffic through U.S.-based cloud providers.

The Treasury also sanctioned Funnull’s alleged operator, a 40-year-old Chinese national named Liu “Steve” Lizhi. The government says Funnull directly facilitated financial schemes resulting in more than $200 million in financial losses by Americans, and that the company’s operations were linked to the majority of pig butchering scams reported to the FBI.

It is generally illegal for U.S. companies or individuals to transact with people sanctioned by the Treasury. However, as Mr. Lizhi’s case makes clear, just because someone is sanctioned doesn’t necessarily mean big tech companies are going to suspend their online accounts.

The government says Lizhi was born November 13, 1984, and used the nicknames “XXL4” and “Nice Lizhi.” Nevertheless, Steve Liu’s 17-year-old account on LinkedIn (in the name “Liulizhi”) had hundreds of followers (Lizhi’s LinkedIn profile helpfully confirms his birthday) until quite recently: The account was deleted this morning, just hours after KrebsOnSecurity sought comment from LinkedIn.

Mr. Lizhi’s LinkedIn account was suspended sometime in the last 24 hours, after KrebsOnSecurity sought comment from LinkedIn.

In an emailed response, a LinkedIn spokesperson said the company’s “Prohibited countries policy” states that LinkedIn “does not sell, license, support or otherwise make available its Premium accounts or other paid products and services to individuals and companies sanctioned by the U.S. government.” LinkedIn declined to say whether the profile in question was a premium or free account.

Mr. Lizhi also maintains a working PayPal account under the name Liu Lizhi and username “@nicelizhi,” another nickname listed in the Treasury sanctions. PayPal did not respond to a request for comment. A 15-year-old Twitter/X account named “Lizhi” that links to Mr. Lizhi’s personal domain remains active, although it has few followers and hasn’t posted in years.

These accounts and many others were flagged by the security firm Silent Push, which has been tracking Funnull’s operations for the past year and calling out U.S. cloud providers like Amazon and Microsoft for failing to more quickly sever ties with the company.

Liu Lizhi’s PayPal account.

In a report released today, Silent Push found Lizhi still operates numerous Facebook accounts and groups, including a private Facebook account under the name Liu Lizhi. Another active Facebook account clearly connected to Lizhi is a tourism page for Ganzhou, China called “EnjoyGanzhou” that was named in the Treasury Department sanctions.

“This guy is the technical administrator for the infrastructure that is hosting a majority of scams targeting people in the United States, and hundreds of millions have been lost based on the websites he’s been hosting,” said Zach Edwards, senior threat researcher at Silent Push. “It’s crazy that the vast majority of big tech companies haven’t done anything to cut ties with this guy.”

The FBI says it received nearly 150,000 complaints last year involving digital assets and $9.3 billion in losses — a 66 percent increase from the previous year. Investment scams were the top crypto-related crimes reported, with $5.8 billion in losses.

In a statement, a Meta spokesperson said the company continuously takes steps to meet its legal obligations, but that sanctions laws are complex and varied.

“Sanctions are often targeted in nature and don’t always prohibit people from having a presence on our platform,” the statement reads. “Whether specific activity is restricted by sanctions or Meta’s Terms and Policies depends on the specific facts.”

Attempts to reach Mr. Lizhi via his primary email addresses at Hotmail and Gmail bounced as undeliverable. Likewise, his 14-year-old YouTube channel appears to have been taken down recently.

However, anyone interested in viewing or using Mr. Lizhi’s 146 computer code repositories will have no problem finding active GitHub accounts for him, including one registered under the NiceLizhi and XXL4 nicknames mentioned in the Treasury sanctions.

One of multiple active GitHub profiles used by Liu “Steve” Lizhi, who uses the nickname XXL4 (a moniker listed in the Treasury sanctions for Mr. Lizhi).

Mr. Lizhi also operates a GitHub page for an open source e-commerce platform called NexaMerchant, which advertises itself as a payment gateway working with numerous American financial institutions. Interestingly, this profile’s “followers” page shows several other accounts that appear to be Mr. Lizhi’s. All of the account’s followers are tagged as “suspended,” even though that suspended message does not display when one visits those individual profiles.

In response to questions, GitHub said it has a process in place to identify when users and customers are Specially Designated Nationals or other denied or blocked parties, but that it locks those accounts instead of removing them. According to its policy, GitHub takes care that users and customers aren’t impacted beyond what is required by law.

All of the follower accounts for the XXL4 GitHub account appear to be Mr. Lizhi’s, and have been suspended by GitHub, but their code is still accessible.

“This includes keeping public repositories, including those for open source projects, available and accessible to support personal communications involving developers in sanctioned regions,” the policy states. “This also means GitHub will advocate for developers in sanctioned regions to enjoy greater access to the platform and full access to the global open source community.”

Edwards said it’s great that GitHub has a process for handling sanctioned accounts, but that the process doesn’t seem to communicate risk in a transparent way, noting that the only indicator on the locked accounts is the message, “This repository has been archived by the owner. It is not read-only.”

“It’s an odd message that doesn’t communicate, ‘This is a sanctioned entity, don’t fork this code or use it in a production environment’,” Edwards said.

Mark Rasch is a former federal cybercrime prosecutor who now serves as counsel for the New York City based security consulting firm Unit 221B. Rasch said when Treasury’s Office of Foreign Assets Control (OFAC) sanctions a person or entity, it then becomes illegal for businesses or organizations to transact with the sanctioned party.

Rasch said financial institutions have very mature systems for severing accounts tied to people who become subject to OFAC sanctions, but that tech companies may be far less proactive — particularly with free accounts.

“Banks have established ways of checking [U.S. government sanctions lists] for sanctioned entities, but tech companies don’t necessarily do a good job with that, especially for services that you can just click and sign up for,” Rasch said. “It’s potentially a risk and liability for the tech companies involved, but only to the extent OFAC is willing to enforce it.”

Liu Lizhi operates numerous active Facebook accounts and groups, including this one for an entity specified in the OFAC sanctions: The “Enjoy Ganzhou” tourism page for Ganzhou, China. Image: Silent Push.

In July 2024, Funnull purchased the domain polyfill[.]io, the longtime home of a legitimate open source project that allowed websites to ensure that devices using legacy browsers could still render content in newer formats. After the Polyfill domain changed hands, at least 384,000 websites were caught in a supply-chain attack that redirected visitors to malicious sites. According to the Treasury, Funnull used the code to redirect people to scam websites and online gambling sites, some of which were linked to Chinese criminal money laundering operations.

The U.S. government says Funnull provides domain names for websites on its purchased IP addresses, using domain generation algorithms (DGAs) — programs that generate large numbers of similar but unique names for websites — and that it sells web design templates to cybercriminals.

“These services not only make it easier for cybercriminals to impersonate trusted brands when creating scam websites, but also allow them to quickly change to different domain names and IP addresses when legitimate providers attempt to take the websites down,” reads a Treasury statement.

Meanwhile, Funnull appears to be morphing nearly all aspects of its business in the wake of the sanctions, Edwards said.

“Whereas before they might have used 60 DGA domains to hide and bounce their traffic, we’re seeing far more now,” he said. “They’re trying to make their infrastructure harder to track and more complicated, so for now they’re not going away but more just changing what they’re doing. And a lot more organizations should be holding their feet to the fire.”

from Krebs on Security https://ift.tt/ncaEFMg
via IFTTT