Netskope Threat Labs is tracking phishing campaigns that are abusing several free cloud services to host their websites and collect user information. These campaigns host their phishing sites in AWS Amplify which is available to free-tier users. Some phishing campaigns also abuse Telegram and Static Forms to collect users’ credentials. These phishing attacks aim to steal banking, webmail, and Microsoft 365 credentials, as well as victims’ card payment details.
Identity theft is common in the US and can happen to anybody. The FTC received 1.1 million reports of identity theft in 2022, which made it the most prevalent type of fraud complaint they received that year. The internet has made identity theft easy, with the FTC reporting that most fraud happened via text, phone, email, websites and social media. Some cases even involved online ads, including pop-up ads.
Shell is one of the largest oil and gas companies in the world today. The organization is based in London, England, and has branches in many countries throughout the world, including the United States. Shell has an estimated annual revenue of $381.3 billion USD and employs approximately 86,000 people. The company was recently added to the list of victims of the large-scale MOVEit data breach. Details are still fuzzy, but it appears that many individuals could be compromised.
Healthcare companies and insurance providers were hard hit this week in a slew of data breaches. Some of the breaches happened long ago, while others are fresh, but either way, it's clear that medical companies are being targeted heavily by hackers. The list of companies includes the Charles George VA Medical Center, ARx Patient Solutions, Advanced Medical Management, and Imagine360 LLC. We also can't skip over the fact that oil giant Shell was hit by a breach as well.
CVE-2023-2868, a vulnerability in the Barracuda ESG was announced on May 23. On June 15th, a report surfaced, attributing the exploitation of this vulnerability to a threat actor group tracked as UNC4841, which analysts believe is conducting espionage on behalf of the Chinese government. SecurityScorecard’s STRIKE Team consulted its datasets to identify possibly affected organizations.
Infrastructure as code (IaC) has changed how we deploy and manage our cloud infrastructure. Instead of having to manually configure servers and networks with a large operations team, we can now define our service architecture through code. IaC allows us to automate infrastructure deployment, scale our entire fleet of servers, document a history of changes to our architecture, and test incremental changes to the network.
