Connect with us

Cyber Security

ChatGPT is Being Used for Cyber Attacks

Published

on

Check Point Research (CPR) is seeing the first instances of cybercriminals using ChatGPT to develop malicious tools. In underground hacking forums, threat actors are creating infostealers, encryption tools and facilitating fraud activity. CPR warns of the fast-growing interest in ChatGPT by cybercriminals and shares three recent cases, with screenshots, of the development and sharing of malicious tools using ChatGPT.

Case 1: Threat actor recreates malware strains for an infostealer
Case 2: Threat actor creates multi-layer encryption tool
Case 3: Threat actor shows how to create a Dark Web marketplace script for trading illegal goods using ChatGPT

CPR is sharing three cases of recent observations to warn the public of the growing interest by cybercriminals in ChatGPT to scale and teach the malicious activity.

Case 1: Creating Infostealer

Figure 1. Cybercriminal showing how he created infostealer using ChatGPT

On December 29, 2022, a thread named “ChatGPT – Benefits of Malware” appeared on a popular underground hacking forum. The publisher of the thread disclosed that he was experimenting with ChatGPT to recreate malware strains and techniques described in research publications and write-ups about common malware.

In actuality, whilst this individual could be a tech-oriented threat actor, these posts seemed to be demonstrating less technically capable cybercriminals how to utilise ChatGPT for malicious purposes, with real examples they can immediately use.

Case 2: Creating a Multi-Layered Encryption Tool

Figure 2. Cybercriminal dubbed USDoD posts multi-layer encryption tool

On December 21, 2022, a threat actor dubbed USDoD posted a Python script, which he emphasized was the ‘first script he ever created’. When another cybercriminal commented that the style of the code resembles openAI code, USDoD confirmed that the OpenAI gave him a “nice [helping] hand to finish the script with a nice scope.”

Figure 3. Confirmation that the multi-layer encryption tool was created using Open AI

This could mean that potential cybercriminals who have little to no development skills at all, could leverage ChatGPT to develop malicious tools and become a fully-fledged cybercriminals with technical capabilities.

All of the aforementioned code can of course be used in a benign fashion. However, this script can easily be modified to encrypt someone’s machine completely without any user interaction. For example, it can potentially turn the code into ransomware if the script and syntax problems are fixed.

Case 3: Facilitating ChatGPT for Fraud Activity

Figure 4. Threat actor using ChatGPT to create DarkWeb Market scripts

A cybercriminal shows how to create a Dark Web marketplace scripts using ChatGPT. The marketplace’s main role in the underground illicit economy is to provide a platform for the automated trade of illegal or stolen goods like stolen accounts or payment cards, malware, or even drugs and ammunition, with all payments in cryptocurrencies.

Figure 5. Multiple threads in the underground forums on how to use ChatGPT for fraud activity

Sergey Shykevich, Threat Intelligence Group Manager at Check Point Software, says, “Cybercriminals are finding ChatGPT attractive. In recent weeks, we’re seeing evidence of hackers starting to use it to write malicious code. ChatGPT has the potential to speed up the process for hackers by giving them a good starting point. Just as ChatGPT can be used for good to assist developers in writing code, it can also be used for malicious purposes. Although the tools that we analyze in this report are pretty basic, it’s only a matter of time until more sophisticated threat actors enhance the way they use AI-based tools. CPR will continue to investigate ChatGPT-related cybercrime in the weeks ahead.”

Cyber Security

CrowdStrike to Acquire Adaptive Shield

Published

on

CrowdStrike has announced it has agreed to acquire Adaptive Shield, a leading provider of SaaS security solutions. With this acquisition, CrowdStrike will be able to provide unified, end-to-end protection against identity-based attacks across the entire modern cloud ecosystem – from on-premises Active Directory to cloud-based identity providers and SaaS applications – delivered from a single, unified platform. Announced at Fal.Con Europe, CrowdStrike’s inaugural premier user conference in the region, this acquisition will position CrowdStrike as the leading provider of comprehensive protection across complex hybrid environments.

“CrowdStrike was built to tackle the toughest cybersecurity challenges, and we drive relentless innovation based on what our customers need to stay ahead of modern threats,” said George Kurtz, CEO and founder, CrowdStrike. “As SaaS and AI adoption grows, every new application brings additional complexity and the risk of misconfigurations across human and non-human accounts that create openings for sophisticated attacks. With the acquisition of Adaptive Shield, CrowdStrike will continue to set the standard for identity-based protection in the cloud, delivering best-in-class SaaS protection from the Falcon platform.”

Cloud exploitation cases grew by 110% last year, while identity-based attacks continue to rise – 75% of attacks to gain initial access are now malware-free. ‘Cross-domain’ adversaries, targeting identity and cloud, have numerous attack paths, from on-premises Active Directory to cloud-based identity providers and the growing landscape of SaaS applications. The complexity of modern hybrid cloud environments and disconnected security tools create protection gaps, making it difficult to prevent identity-based threats.

SaaS is projected to be the largest category of cloud computing in 2024, capturing more than 40% of all public cloud spending. Under the SaaS shared responsibility model, SaaS vendors provide security controls, while organizations manage configurations. In today’s complex environments, where hundreds of SaaS applications each come with unique access controls and identity configurations, security teams face significant challenges in maintaining visibility into who has access, what sensitive data is exposed, and active threats – even with purpose-built SaaS protection.

Adaptive Shield delivers the industry’s most complete security posture management and threat protection across SaaS identities, misconfigurations and data, stopping SaaS breaches. As an integrated component of the CrowdStrike Falcon cybersecurity platform, Adaptive Shield will equip CrowdStrike with the most advanced capabilities to stop identity-based attacks across all aspects of modern hybrid cloud environments. Customer benefits will include:

  1. Comprehensive SaaS Security Posture Management (SSPM): Organizations gain full visibility and governance over misconfigurations, the entitlements and activity levels of both human and non-human identities, and exposed data across 150+ SaaS applications. This new end-to-end visibility of identities across hybrid cloud environments gives operators a unique context for rapid cloud detection and response (CDR).
  2. GenAI Application Security Control: By continuously monitoring GenAI SaaS applications, Adaptive Shield empowers organizations to enforce consistent security standards by detecting configuration shifts, controlling AI settings to prevent data leakage, and identifying shadow AI applications to revoke access based on their risk profile. This approach ensures that AI-integrated applications remain aligned with security policies to protect sensitive data.
  3. Unified Hybrid Identity and Cloud Security: The powerful combination of Adaptive Shield and CrowdStrike Falcon Identity Protection will provide customers with comprehensive identity protection across SaaS, on-premises Active Directory and cloud-based environments (Okta and Microsoft Entra ID). CrowdStrike Falcon Cloud Security customers will also gain unified visibility and protection across the entire modern cloud estate – infrastructure, custom applications, data, AI models and SaaS applications – all from the same unified console and workflow.
  4. Existing Integration Accelerates Detection and Response: Adaptive Shield’s existing integration with CrowdStrike Falcon Next-Gen SIEM provides rapid first-party detection and response across multiple security domains – endpoints, identities, workloads and applications – automatically correlating detections inline with the latest threat intelligence and Falcon Fusion SOAR delivering near real-time response.

“Widespread adoption of SaaS applications has rapidly expanded the enterprise attack surface, as shared responsibility models and fragmented security controls make SaaS environments a prime target,” said Maor Bin, CEO and co-founder, Adaptive Shield. “Our mission perfectly complements CrowdStrike, stopping SaaS breaches while further accelerating consolidation on cybersecurity’s most comprehensive platform. I’m incredibly proud of our team for building the most advanced SaaS security solution, defining the market.”

Continue Reading

Cyber Security

Email Security Breach Rampant with 80% of Organisations Affected

Published

on

OPSWAT has released the 2024 Report: Email Security Threats Against Critical Infrastructure Organizations. This research was conducted with Osterman Research, known for its in-depth analysis and insights into emerging trends and technologies in IT security and data management. The study surveyed IT and security leaders working within critical infrastructure industries and revealed that 80% of organizations experienced an email-related security breach over the past year and 63.3% of respondents acknowledge that their email security approach needs to be improved.

Email is a necessary tool for communication and productivity across all sectors, but it is also the primary attack vector for cyber threats with attackers exploiting vulnerabilities through phishing attempts, malicious links, and harmful attachments. Once infiltrated, these threats can cascade through networks, jeopardizing both IT and operational technology (OT) environments. Alarmingly, more than half of respondents believed email messages and attachments to be benign by default, failing to realize inherent email risks.

Key takeaways from the research include:

  1. Up to 80% of organizations in critical infrastructure sectors have been the victim of an email security breach in the past 12 months: Per 1,000 employees, the organizations in this research experienced 5.7 successful phishing incidents per year, 5.6 account compromises, and 4.4 incidents of data leakage, among other types of email security breaches. Organizations in critical infrastructure sectors are highly attractive to cyber threat actors and are under constant attack.
  2. Email is the primary cybersecurity attack vector in critical infrastructure sectors: A median of 75% of cybersecurity threats against organizations in critical infrastructure sectors arrive via email. For two out of three organizations, the share of cybersecurity threats arriving by email ranges from 61% to 100%.
  3. Success metrics for email security are low: 48% of the critical infrastructure organizations in this research are not confident that their current email security protections are sufficient against email-borne attacks. Only 34.4% are fully compliant with the email-related regulations that apply to them, e.g., GDPR and other privacy regulations. And 63.6% are not confident that their approach to email security is best in class.
  4. Threat levels for all types of cybersecurity attacks are expected to increase, with phishing, data exfiltration, and zero-day malware attacks leading the way: Over 80% of organizations expect threat levels of all email attack types to increase or stay the same over the next 12 months.
  5. Most organisations do not approach email as malicious by default: More than half of the critical infrastructure organizations in this research operate from the assumption that messages and files are benign by default or attempt to operate from the flawed assumption that they are both benign by default and malicious by default. Many more firms need to embrace zero-trust approaches for email security.
  6. Organisations aspire to be dramatically better—and rapidly, too: While current email security efficacy metrics are low, aspirations run high for a dramatic and rapid shift. While only 52.0% of organizations are confident in their current email security protections, 74.8% aspire to reach this level within 12 months. In a similar vein, 84.8% of the organizations aspire to be at a place where their approach to email security protects them from emerging and as-yet-unknown email threats over the next 12 months.

“This survey findings emphasize the need to adopt a zero-trust mindset. The prevalence of email-related breaches poses a significant threat to critical infrastructure organizations, necessitating a shift to a stronger, prevention-based perimeter defence strategy against established communication and data exchange channels,” commented Yiyi Miao, Chief Product Officer at OPSWAT.

The survey responses also unveiled a major gap in advanced email security capabilities that preclude and prevent threats from reaching users’ inboxes. Essential measures such as Content Disarm and Reconstruction (CDR), URL scanning for malicious signals, and anomaly detection within email messages are notably absent in many organisations’ defences. In response to these critical challenges, OPSWAT reaffirms its commitment to equipping critical infrastructure organisations with cutting-edge, prevention-based cybersecurity solutions.

Continue Reading

Cyber Security

Positive Technologies Expands into ME and South Asia

Published

on

At GITEX GLOBAL 2024 Positive Technologies forged partnerships with cybersecurity service and solution providers from Saudi Arabia, the UAE, Egypt, and India. The primary goal of the cooperation is to share expertise in result-driven cybersecurity and promote cutting-edge cybersecurity products.

According to recent studies by Positive Technologies, more than half of all attacks on organizations in the Middle East target the public sector, industry, telecommunications, and IT companies. In the first half of 2024, the number of DDoS attacks in Gulf countries increased by 70% compared to the same period in 2023. Credentials for accessing the IT infrastructure of local companies are sold on dark web platforms, and two-thirds of all available credentials are offered for less than $1,000. Under such circumstances, Positive Technologies recommends building continuous, automated protection against organization-specific non-tolerable events.

“Companies in the region are very enthusiastic about our idea to automate cybersecurity processes with the help of MaxPatrol O2—a solution that automatically identifies cyberattack chains and responds to them,” said Evgeniya Popova, Director of International Business Development at Positive Technologies. “In addition, we receive a lot of interest from partners who specialize in specific areas, such as OT infrastructure security. They appreciate the scale and depth of our offer which includes PT ICS, a comprehensive solution for protecting the industrial IT and OT infrastructure. Our expertise in application security and secure development, incorporated in our product PT Application Inspector, is also in high demand.”

Evgeniya Popova also noted the geographical expansion of the company’s partner network: Positive Technologies is in the process of signing agreements with companies operating in and beyond the Middle East. Salem Baras, CEO of Innovative Solutions (Saudi Arabia), commented, “Positive Technologies has made a long-term commitment to further develop the overall cybersecurity capabilities in the region and enhance the quality of cybersecurity services and solutions. This is a significant advantage for us. As a leading cybersecurity provider in the GCC, we are partnering with Positive Technologies to build our capabilities and help our customers in the region to be protected. The cybersecurity market is evolving and facing numerous challenges, and it needs companies like Positive Technologies to grow and protect our future.”

“For the past two years, Positive Technologies has been our key partner in the UAE. As a leader in the country’s cybersecurity domain, we are keen to continue our partnership, promoting advanced technologies. Our main priorities are SOC operations and vulnerability management,” said Nishad Sukumaran, COO of NX Digital Technology (UAE).

Experts at Positive Technologies also report that the number of cyberattacks in India increased by 15% in 2023 and surged by 46% in Q2 2024. Over two-thirds of all attacks resulted in leakage of confidential information. So it’s no coincidence that it was in India that Positive Technologies launched a series of international meetups for cybersecurity experts on October 11, 2024.

“We are a value-added cybersecurity distribution company, and our mission is to provide the best technologies and services to our partners and clients. Positive Technologies is our like-minded partner on this path, and we are excited to expand our collaboration in the Middle East, Africa, and India,” said Jibu John, Founder and CEO of CyberDisti (India). Last year at GITEX GLOBAL 2023, Positive Technologies signed partnership agreements with several cybersecurity solution providers, including organizations from Bahrain and Singapore.

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.