We Are Named Among Most Reviewed IT Services Companies in Estonia
In early August, The Manifest released a list of the most reviewed B2B service providers in Estonia for the year 2023. The companies included in this list have successfully completed the platform's rigorous evaluation process. Trilight Security OÜ was specifically recognized among the highly reviewed IT services firms from Estonia.
Despite the country facing certain economic challenges, there is a positive outlook for the upcoming years. Notably, key players in various high-tech industries like IT services, cybersecurity, software development, and others are actively contributing to bolster the nation's resilience.
The "Most Reviewed Company" award by The Manifest emphasises the importance of cultivating strong relationships between service providers and their clients. The entities featured in this list were chosen based on the quantity of testimonials and endorsements they garnered over the past twelve months.
Yan Shmyhol, CEO of Trilight Security, commented: "We are delighted to have received this award, which attests to our position as significant players in Estonia's IT services market. Furthermore, it motivates us to set new objectives for the upcoming assessment period."
Lazarus is Back. $35 million Stolen from Atomic Wallet
Hackers from North Korea are causing trouble again, and this time they targeted Atomic Wallet. They managed to steal a whopping $35 million in crypto.
The experts at Elliptic, who know their way around blockchain, have connected the dots and linked the theft to the Lazarus group. They've been busy tracking the stolen funds as they were moved around different wallets and mixers, in attempts to cover the tracks.
This attack on Atomic Wallet happened just last weekend, and it left a lot of innocent wallets compromised and their funds snatched away. The total haul reached over $35 million. According to Elliptic, this is the first big crypto heist of the year for Lazarus. Don’t forget, they've already blown through $100 million from the Harmony Horizon Bridge hack in June 2022, and a mind-boggling $620 million from Axie Infinity in March 2022. Who knows what they're spending it on? Maybe North Korean rockets or their nuclear program?
You might be wondering how Elliptic can be so confident in their attribution. Well, it turns out that the laundering strategy used in this attack was the same as in their previous heists. They also used the Sinbad mixer again, and a good chunk of the stolen funds ended up in the same wallets that were linked to Lazarus before.
Even though laundering stolen cryptocurrency has become trickier lately, there are still some less scrupulous exchanges out there where these things can happen. That's why wallet developers and operators need to step up their cybersecurity efforts and seriously audit and test their code. Unless they want to unknowingly contribute to funding some dictator's science projects, right?
But here's the big question that keeps bugging some experts: Who the heck is behind the Lazarus group? The world is a curious place, so maybe there are some folks pretending to be North Koreans, flaunting their top-notch computer skills. Who knows, right?
Emotet: Look, Who's Back
The #emotet malware operation re-started its activity this Tuesday morning. It resumed sending out spam emails after a three-month break.
Emotet malware is distributed through emails containing malicious Microsoft Word and Excel document attachments. The user needs to open the document and activate macroses, so the Emotet DLL will be downloaded and loaded into memory.
One of the peculiar features of Emotet is that, initially, it is not active and waits until instructions are received from a remote command and control server. Then several options are possible, for instance, the victims’ emails and contacts will be stolen to be included in subsequent Emotet campaigns, or an additional payload will be downloaded to run a ransomware attack against the infected computer.
Back then, Emotet was one of the most widely distributed malware. Now it is less active, but there are still some evolutions, as the latest developments have shown.
This time spam includes docs using Red Dawn templates, and they are huge indeed, with sizes over 500MB. Previously spam messages used to be reply chains, now they pretend to be invoices. These ZIP archives contain inflated Word documents containing the data mostly used to make the files harder for being scanned and detected by antiviruses as malicious.
After downloading, Emotet will be saved to a random-named folder under %LocalAppData% and launched using regsvr32.exe. This is an evasion technique that proved to be quite successful. VirusTotal scan showed that only one out of 64 security vendors would detect this malware.
However, with recent changes by Microsoft, when it finally disabled macros by default, the current campaign might not be a success. At least additional payloads are not yet observed in action. We might expect that Emotet will move to exploit other files than .doc and .xls, such as ISO, JS, etc.
For a reliable protection against malware, leverage reliable endpoint protection, vulnerability management, managed security, and data backup services, such as provided by #TrilightSecurity
Android 14 Offers Significant Security Enhancements
Google will soon release first developer preview for Android 14, which is going to be the next major version of the most popular mobile operating system. This one will offer significant security and privacy enhancements, among other things.
From now on apps will have to declare precisely the usage of certain phone features. The OS will also limit data exchange between them. Interestingly, all additional files downloaded by apps will be read-only. But the most important feature, maybe, is that Android 14 will block the installation of malicious apps that target older API levels. Let’s see how that will work.
With the "Runtime receivers," which enable apps to receive intents broadcast by the system or other applications, all apps targeting Android 14 will have to directly declare if they need information from other apps.
This feature continues the one called "Context.registerReceiver()" which was introduced in previous Android releases. It was created to prevent malicious apps on the device from intercepting or misusing broadcasts. This new security enhancement will prevent malware from intercepting intents sent from other apps.
Another feature of Android 14 is "safer dynamic code loading," which, as we mentioned above, will make all files downloaded by an application read-only, thus providing protection against code-injection scenarios.
Perhaps, the most important enhancement would be blocking the installation of apps that target SDK versions lower than 23 which belongs to Android 6.0. It’s usually utilized to achieve easier permissions abuse and bypass security and privacy protections such as permitting access to sensitive operations including the device's camera, microphone, GPS sensors, phone calls, and SMS.
Finally, users will not be able to install apps that haven't been updated for some time. However, those installed before the upgrade to Android 14 will continue to work.
Android 14’s second developer preview will be available in March 2023.
Researchers Disclose 56 Vulnerabilities Impacting OT Devices from 10 Vendors
The Hacker News reported on the findings as to vulnerabilities found in IoT devices offered by different global vendors.
Collectively dubbed OT:ICEFALL by Forescout, the 56 issues span as many as 26 device models from Bently Nevada, Emerson, Honeywell, JTEKT, Motorola, Omron, Phoenix Contact, Siemens, and Yokogawa.
"Exploiting these vulnerabilities, attackers with network access to a target device could remotely execute code, change the logic, files or firmware of OT devices, bypass authentication, compromise credentials, cause denials of service or have a variety of operational impacts," the company said in a technical report.
Webinar 16.06.22: Sophos Adaptive Cybersecurity Ecosystem
Trilight Security and Hermitage Solutions invite you to take part in an online event, devoted to Adaptive Cybersecurity Ecosystem (ACE) of Sophos, in particular, its endpoint protection component, Sophos Intercept X.
Agenda:
- Sophos company introduction.
- Adaptive Cybersecurity Ecosystem (ACE), a quick Sophos portfolio overview, "Cyber Kill Chain".
- Sophos Intercept X (CIXA endpoint protection). Different protection levels explained.
Speaker:
Mindaugas Kadunas, Sophos Presales Engineer at Hermitage Solutions.
Date:
16.06.2022, 12:00 CET, duration 45 minutes.
Registration:
To register for the event respond to this message with your contact details in signature, of follow this link to learn more about the event and fill a small registration form.
About Trilight Security
Trilight Security OÜ is a cybersecurity services provider offering reliable and affordable managed security services, managed detection & response, and SOCaas services to customers across Europe. More information can be found on our website.
About Hermitage Solutions
Hermitage Solutions is a leading value-added distributor of cybersecurity and innovative infrastructure solutions in the Baltic states that provide IT security products and services for enterprises and SMB in various industries. More information can be found at our website.
We Become Sophos Authorized Partner
Trilight Security OÜ has recently been designated as Sophos Reseller. This is a title which opens to us the new opportunities to bring intelligent and reliable cybersecurity solutions to the market. These premium security solutions allow our customers to enjoy various benefits which the next-gen security tools and endpoint protections Sophos offers.
In the first place, these are small and mid-sized business that will benefit from simplified cybersecurity management offered by Sophos solutions and Trilight Security team taking advantage of the in-depth training and support by partner vendor.
Through this partnership we will be able to provide our customers with comprehensive range of Sophos solutions, securing systems and data against modern cyber threats, minimizing the risks and inspiring confidence based on earned reputation of the vendor: Sophos is well known for going above and beyond to provide partners with best industry cybersecurity solutions and superior support.
Trilight Security offers a long range of Sophos products and can assist customers with consulting, selection, installation and management of its facilities.
About Trilight Security
Trilight Security is a Managed Security Service Provider based in Estonia, European Union. We work with customers from small and medium to enterprises, with focus on providing reliable and affordable cybersecurity services to SMB from EU and Associated Countries. Our qualified cybersecurity and IT experts detect, investigate, respond to threats before they disrupt business or take necessary steps to minimize their potential or real impact. More information is available at www.trilightsecurity.com
About Sophos
As a worldwide leader in next-generation cybersecurity, Sophos protects more than 400,000 organizations of all sizes in more than 150 countries from today's most advanced cyber threats. Powered by SophosLabs's global threat intelligence and data science team, Sophos' cloud-native and AI-powered solutions secure endpoints (laptops, servers and mobile devices) and networks against evolving cyberattack techniques, including ransomware, malware, exploits, data exfiltration, active-adversary breaches, phishing, and more. Sophos Central, a cloud-native management platform, integrates Sophos' entire portfolio of next-generation products, including the Intercept X endpoint solution and the XG next-generation firewall, into a single "synchronized security" system accessible through a set of APIs. Sophos has been driving a transition to next- generation cybersecurity, leveraging advanced capabilities in cloud, machine learning, APIs, automation, managed threat response, and more, to deliver enterprise-grade protection to any size organization. Sophos sells its products and services exclusively through a global channel of more than 53,000 partners and managed service providers (MSPs). Sophos also makes its innovative commercial technologies available to consumers via Sophos Home. More information is available at www.sophos.com.
