Multiple North Korean state-sponsored hacking groups have been attacking South Korean defense companies for more than a year, stealing login credentials and sensitive data.
A Reuters report, citing South Korea’s law enforcement, claims three major threat actors – Lazarus, Kimsuky, and Andariel, have been going after defense organizations and third-party contractors, planting malicious code in data systems, pulling out passwords and technical information.
The police managed to identify the attackers by tracking their source IP addresses, re-routing architecture of the signals, and the malware signatures.
Lazarus attacks again
The report did not state which organizations were targeted, or what the nature of the data was, but Reuters did hint that South Korea grew into a “major global defense exporter”, with fresh contracts to sell mechanized howitzers, tanks, and fighter jets. The deals were reportedly valued at billions of dollars.
While all three of these threat actors have made headlines before, Lazarus Group is probably the most infamous one. This group was observed targeting cryptocurrency businesses in the west, stealing millions of dollars in crypto tokens, with which the North Korean government apparently finances its nuclear weapons programs.
The biggest crypto heist to happen to this day is the April 2022 breach at the Ronin network, which resulted in the theft of $625 million in various cryptocurrencies. Ronin network is a cryptocurrency bridge developed by the same company behind the hugely popular blockchain-based game, Axie Infinity.
A bridge is a service that allows users to transfer crypto tokens from one network to another.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Besides Ronin, Lazarus Group was also confirmed to be behind the Harmony bridge attack, which happened in June 2022, and resulted in the theft of $100 million.
Most businesses, regardless of size, now understand the potential value of the cloud. We’re beyond that stage of early skepticism in which technology decision-makers questioned whether cloud services would factor significantly into corporate operations. Wholesale adoption is now underway and has been for years.
And why not? The benefits of the cloud are obvious. The ability to access cloud-hosted applications and services from anywhere, store and recall data and content without regard to physical data center limitations such as capacity and aging hardware, and grow or shrink infrastructure elastically to meet the changing needs of your business is invaluable. As a complementary part of your overall IT strategy, the cloud can definitely accelerate your corporate growth and help achieve your goals and desired business outcomes.
Danger, unfortunately, still lurks within the cloud for the unwary. All the attributes that make the cloud so convenient and efficient—such as ease of access and decentralization of IT services and data—create the very conditions for risk in the form of security breaches. As more companies embrace public cloud resources and hybrid cloud infrastructures (as opposed to traditional on-premises IT infrastructure) and begin to push more of their workloads and data (especially sensitive data) into these environments, we are witnessing a steady increase in companies experiencing cloud security breaches. The reality for every company embracing cloud is that a cybersecurity incident will eventually occur—it’s just a matter of when.
Trevor Morgan
VP of Product, OpenDrives.
Inevitable security breaches
The inevitability that your business will encounter a security breach, whether through inadvertent carelessness or perhaps through a threat actor’s concentrated efforts, is sobering. The host of problems stemming from such a situation includes legal ramifications, potential governmental sanctions, and most certainly brand reputational damage. Most sources agree that a single security breach can cost your organization millions of wasted dollars, not to mention the fact that it will defocus your organization and alarm your customer base (many of whom might have sensitive personally identifiable information (PII) somewhere in your data ecosystem).
You might have the impression that all your cloud data is highly secure no matter what, especially when you’re leveraging public cloud services that tout rock-solid security measures. Go ahead and rethink any self-assurances or complacency about your cloud security posture. The potential problems are manifold: most security measures in cloud environments must be consciously deployed and configured properly; well-trained (and expensive) professionals must remain alert and monitor cloud environments regularly; and your entire organization must participate in a culture of safe cyber-activity in order to thwart the efforts of hackers employing not only technical acumen but social engineering trickery to find cracks in the armor.
Don’t get me wrong—this is not a scare tactic convincing you to lose faith in your push to the cloud. Quite the contrary! With proper planning and some deliberate and persistent vigilance within your organization, you can confidently rely on your cloud-based IT infrastructure and cloud data services. And, just know that you’re not in the fight alone!
The major web service providers understand the problems and threats just as intimately as any organization can, and they’re trying to stay one step ahead of bad actors. With the mainstream adoption of automation in the form of machine learning (ML) and artificial intelligence (AI), these companies are merging next-generation machine intelligence with standard cloud-based operations and workloads to detect anomalies and potential threats to their customers like you, without your direct intervention.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Taking cybersecurity problems seriously
One way to see how major cloud providers are taking the cybersecurity problem seriously is to view the types of intellectual property patents they file. For example, a patent filed by a subsidiary of Microsoft details the method by which machine intelligence can automatically monitor API transactions and detect anomalous requests in the form of mismatched cloud providers. This might indicate a mounting and intentional threat. On top of using automated machine intelligence to monitor and detect these kinds of situations on a massive scale, the patent details mitigation and remediation efforts in the form of data sharing between cooperative cloud providers. All good measures!
Evolving tech like this helps cloud services providers—and their customers—move closer to a Zero Trust posture in which no request or transaction is assumed legitimate, and instead enforces multiple or many challenges before allowing access to data or services to avoid the dangers of implicit trust. Obviously, maneuvers such as these would be done at the service provider level and wouldn’t necessarily involve intervention from customers or their employees. That doesn’t mean, though, that you should rely solely on the methods that your cloud services provider implements in order to keep your IT infrastructure (and all that potentially sensitive data) safe.
With a deliberate effort to build your organization’s cybersecurity consciousness, you can improve your chances of delaying that event I claimed earlier in this piece was inevitable. While these tactics may seem simple, they go a long way toward closing potential security holes and certainly complement the tech that your cloud services provider no doubt is in the process of deploying to keep you and all those other customers secure:
Don’t be fooled into complacency by relying solely on traditional perimeter security such as firewalls, perimeter monitoring, and intrusion detection. Cloud environments are incredibly distributed so even knowing the extent of your perimeter becomes challenging.
Data-centric security
Consider more data-centric security such as format-preserving encryption or tokenization, especially when you house PII or other highly sensitive information. Data nowadays is rarely at rest, and you want data security that can travel with it.
If your organization has embraced DevOps, make sure you include the Sec in there to form DevSecOps. Data security shouldn’t be an overlay once most of the development is complete—move security up front to the planning phase to ensure it’s built right in.
Encourage a culture of security among all your employees. Never let them forget that all it takes is one oversight for threat actors to pounce. Talk openly about times when you almost feel for that social engineering trick, and keep those lessons learned alive for all to see.
Prioritizing data security, integrating DevSecOps practices, and fostering a security-conscious culture among employees are crucial steps toward safeguarding sensitive information in today’s dynamic digital landscape. By proactively addressing security at every stage, organizations can mitigate risks and uphold the integrity of their data assets–and reputation–in the face of evolving cyber threats. So when it comes to data security, remember: prevention is always better than a cure.
This article was produced as part of TechRadarPro’s Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
The US Department of Defense (DoD) passed the significant milestone of logging more than 50,000 vulnerabilities through its vulnerability disclosure program (VDP).
The VDP was launched in November 2016 by the DoD Cyber Crime Center (DC3), and logged the 50,000th bug bounty on the March 15 2024.
The DC3 VDP program incentivises white-hat hackers to find bugs and vulnerabilities in DoD websites and applications by rewarding them depending on the severity of the vulnerabilities they discover.
50,000 potential avenues of attack patched
DC3 has gradually enhanced the efficiency of bug reporting and tracking over the program’s lifetime, with the Vulnerability Report Management Network being launched in 2018, introducing automation to the reporting process.
In a public statement to mark the occasion, DC3 said, “The program’s advancement has enabled VDP to expand their mitigative scope to not only process findings on DoD websites and applications, but to include all publicly accessible and/or available information technology assets owned and operated by the Joint Force Headquarters DoD Information Network.”
The reward offered to ethical hackers who successfully identify vulnerabilities is expected to be significantly lower than the financial impact a potential breach could have on the DoD. In fact, 2021 saw DC3 launch a 12 month program with the Defense, Counterintelligence & Security Agency to boost the security of SMEs in the Defense Industrial Base (DIB).
According to the DC3, the initiative “saved taxpayers an estimated $61m by discovering and remediating more than 400 active vulnerabilities and Controlled Unclassified Information exfiltration threats by adversaries on DIB participants’ public-facing assets.”
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The DoD also holds a hackathon known as ‘Hack the Pentagon’ that offers ethical hackers the opportunity to seek out bugs in other critical areas of national defense such as the Army, Marine Corps, and Air Force.
Unfortunately, not everyone who lives in a home they’ve bought or inherited can expect to live in that home for their entire lives. Sometimes there are circumstances that force you to sell your home, even against your will.
But if you do want to keep living in your home, you can always reach out to a foreclosure defense lawyer. A foreclosure defense lawyer is a lawyer who helps you wage an extra-legal battle against the bank to save your home from foreclosure, a court-mandated sale, or other horrible circumstances. Ready to learn more? Read on!
In-depth Knowledge of Foreclosure Law
A foreclosure defense lawyer is an invaluable asset when facing the threat of losing your home. These specialized attorneys possess a wealth of knowledge in foreclosure law, allowing them to assess your situation and provide expert guidance accurately.
With their in-depth understanding of the complex legal system, they can carefully evaluate any potential defenses that may apply to your case. This can include challenging the legality of the foreclosure process, negotiating with the lender on your behalf, or finding alternative options to help you keep your home.
Advise You on Foreclosure Alternatives to Keep Your Home
A foreclosure defense lawyer knows how difficult it can be to face the possibility of losing your home. However, they are equipped with the knowledge and experience to help you navigate through this challenging situation.
They can advise you on foreclosure alternatives that can potentially save your home, such as loan modifications, short sales, or a deed in lieu of foreclosure.
Additionally, they can negotiate with your bank or lender on your behalf to find a solution that works best for you and your family. With their guidance and expertise, a foreclosure defense lawyer can give you hope and provide the support you need to keep your home.
Protect Your Rights
A foreclosure defense lawyer can be a lifesaver when you are facing the possibility of losing your home. These legal professionals are trained to navigate the complex laws and procedures surrounding foreclosure and can use their expertise to help save your home.
They can negotiate with your lender to try and come to an agreement or modify your loan terms to make them more manageable. Additionally, these foreclosure defense lawyers linked here can ensure that your rights are protected throughout the entire process.
How to Find a Foreclosure Defense Lawyer
Finding a foreclosure attorney can be a daunting task, as it requires thorough research and careful consideration. The first step is to determine your specific needs and what you seek in a lawyer.
Make sure to look for a reputable attorney with experience in handling foreclosure cases. You can ask for recommendations from friends or family or consult with your local bar association for a list of qualified attorneys.
It is essential to meet with multiple attorneys and ask about their expertise, success rate, and fees before making a decision. Don’t hesitate to ask for references and conduct a background check to ensure you choose the right attorney for your case.
Learn All About Your Options to Save Your Home
Hiring a foreclosure defense lawyer can provide invaluable assistance in saving your home. Their knowledge, experience, and dedication to protecting your rights can make a significant difference in your foreclosure case.
Don’t face this daunting challenge alone. Take action now and secure the best possible outcome for your family.
If you want to explore the best topics, we’ve got you covered. Check out some of our other blogs today!
