US offers $10m bounty for Russian ransomware suspect outed in indictment

Frontier Communications Ransomware Attack: 750,000 Users’ Data Exposed

Frontier Communications Parent, Inc. (the “Company”) detected unauthorized access to portions of its information technology environment.

The breach, attributed to a likely cybercrime group, exposed the personal data of approximately 750,000 users.

The Company promptly initiated its cyber incident response protocols to contain the breach, which included shutting down specific systems, resulting in operational disruptions.

Immediate Response and Containment

Upon detection of the breach by the United States Securities And Exchange Commission, Frontier Communications took swift action to mitigate the impact.

The Company’s containment measures, which involved shutting down affected systems, were part of a broader strategy to prevent further unauthorized access.

These measures, while necessary, led to significant operational disruptions that could be considered material.

“We acted quickly to contain the incident and protect our users’ data,” said a spokesperson for Frontier Communications. 

“Our primary focus was to secure our systems and minimize any potential harm to our customers.”

Frontier Communications has engaged cybersecurity experts to investigate the breach thoroughly.

The Company has also notified law enforcement authorities and is working closely with them to identify the perpetrators and understand the full scope of the incident.

As of the date of this report, the Company believes it has successfully contained the breach and has restored its core information technology environment.

Efforts are ongoing to restore normal business operations fully.

“We are committed to understanding how this breach occurred and taking all necessary steps to prevent future incidents,” the spokesperson added. 

Analyze any MaliciousURL, Files & Emails & Configuration With ANY RUN : Start your Analysis

“Our team is working around the clock to ensure our systems are secure and our operations are back to normal.”

Impact on Users and Company

The breach has exposed personally identifiable information (PII) of approximately 750,000 users.

This data may include names, addresses, social security numbers, and other sensitive information.

Frontier Communications has begun notifying affected users and providing resources to help them protect their information.

“We understand the concern this incident may cause our customers,” said the spokesperson. 

“We offer support and guidance to help them safeguard their personal information.

“Despite the severity of the breach, Frontier Communications does not believe the incident will materially impact its financial condition or results of operations.

The Company has emphasized that it remains committed to transparency and will continue to update stakeholders as more information becomes available.

Forward-Looking Statements and Risks

In its official statement, Frontier Communications included a cautionary note regarding forward-looking statements.

These statements, which address the Company’s expectations and beliefs concerning future events, are inherently uncertain and subject to change.

“Our investigation is ongoing, and we are taking all necessary steps to ensure the security of our systems,” the spokesperson said. 

“However, we acknowledge uncertainties and risks associated with this process.

“The Company has advised stakeholders to refer to its filings with the Securities and Exchange Commission, including the most recent Annual Report on Form 10-K, for a comprehensive understanding of the risks and factors that could affect future developments and performance.

The ransomware attack on Frontier Communications has highlighted the growing threat of cybercrime and the importance of robust cybersecurity measures.

As the Company works to restore normal operations and support affected users, it remains vigilant to prevent future breaches.

Looking for Full Data Breach Protection? Try Cynet’s All-in-One Cybersecurity Platform for MSPs: Try Free Demo 

The post Frontier Communications Ransomware Attack: 750,000 Users’ Data Exposed appeared first on Cyber Security News.

 Read More 

 

Commando Cat Attacking Docker remote API servers to Deploy Crypto Miners

A campaign dubbed “Commando Cat” has been observed exploiting exposed Docker remote API servers to deploy cryptocurrency miners.

This campaign, active since the beginning of 2024, initiates its attacks using the publicly available Commando project.

The attackers use the cmd.cat/chattr Docker image container to retrieve payloads from their command-and-control (C&C) infrastructure, posing a significant threat to Docker environments.

Initial Access

According to the Trendmicro report, the attack begins with deploying a seemingly benign Docker image named cmd.cat/chattr.

Once deployed, the malicious actor creates a Docker container based on this image and uses chroot to break out of the container, gaining access to the host operating system. Tools like curl and wget are then used to download the malicious binary onto the host.

Attack Sequence

1. Probing the Docker Remote API Server

The attack sequence starts with a ping to the Docker Remote API server, which is the pivotal starting point for the ensuing chain of actions.

Ping request to the Docker Remote API Server

2. Creating the Container Using cmd.cat/chattr Image

Upon confirming the server’s status as “OK,” the attacker instantiates a container using the cmd.cat/chattr image.

Analyze any MaliciousURL, Files & Emails & Configuration With ANY RUN : Start your Analysis

In this step, the attacker employs chroot and volume binding to escape the container.

The binding /:/hs mounts the host’s root directory into the container’s /hs directory, granting the attacker unrestricted access to the host file system.

Additionally, binding the Docker socket (/var/run/docker.sock:/var/run/docker.sock) allows the container direct access to the Docker daemon on the host.

Container Creation Request

3. Image Creation in Absence

If the above request returns a “No such image” response, the attacker will pull the chattr Docker image from the cmd.cat repository.

Chattr Docker image pull request

4. Container Deployment

With the image in place, the attacker creates a Docker container, effectively executing a replica of the previous step.

The malicious actor executes a base64-encoded string during this process, translating to a shell script.

The script checks for a file named “z” in the directory /usr/sbin/. If the file does not exist, the script downloads and executes the malicious binary from its file server, potentially ZiggyStarTux, an open-source IRC bot based on the Kaiten malware.

Base64-Encoded Payload String

The deployed malware attempts to connect to its C&C server at 45[.]9[.]148[.]193 on port 1219.

The initial network traffic shows the initial IRC communication, which can be used to monitor the presence of this malware in the network.

Initial IRC Communication

To protect development environments from attacks targeting containers and hosts, the following best practices are recommended:

Proper Configuration: Containers and APIs should always be properly configured to minimize the chance of exploitative attacks. Docker provides specific guidelines to strengthen security.

Use Official Images: Organizations should use only official or certified images to ensure that only trusted content is run within the environment.

Avoid Root Privileges: Running containers should not be done with root privileges but rather as application users.

Restrict Access: Containers should be configured so that access is granted only to trusted sources, such as the internal network.

Adhere to Best Practices: Docker provides a comprehensive list of best practices and built-in security features to improve the security of cloud environments.

Regular Security Audits: Security audits should be performed regularly to check for suspicious containers and images.

The Commando Cat attack campaign highlights the threat posed by abusing exposed Docker remote API servers.

By exploiting Docker configurations and leveraging open-source tools like cmd.cat, attackers can gain initial access and deploy malicious binaries while evading conventional security measures.

The campaign’s use of Docker images to propagate cryptojacking scripts underscores the importance of implementing robust container security practices.

Organizations must remain vigilant and adopt stringent security measures to protect their Docker environments from sophisticated attacks.

Looking for Full Data Breach Protection? Try Cynet’s All-in-One Cybersecurity Platform for MSPs: Try Free Demo 

The post Commando Cat Attacking Docker remote API servers to Deploy Crypto Miners appeared first on Cyber Security News.

 Read More