Online photography platform Shutterfly is the latest high-profile company to fall victim to a hacking attack. The company recently disclosed that in December of last year (2021) they were targeted by the Conti gang, who successfully breached their system and initiated a ransomware attack. The company’s breach notification statement was sent to impacted users and filed with the California Attorney General’s Office in the aftermath of the attack.

Their statement reads in part as follows:

“The attacker both locked up some of our systems and accessed some of the data on those systems. This included access to personal information of certain people, including you.

We believe the access occurred on or about December 3, 2021. We discovered the incident on December 13, 2021.”

Their statement goes on to say that a large amount of data was stolen, and that it included employee personal information. Some of the information taken were names, addresses, salaries, login credentials for an unspecified number of Corporate Services users, and a wide range of customer information including at least the last four digits of credit card numbers kept on file.

Unfortunately, we don’t yet have a good accounting of exactly how many users, employees, or customers may have been impacted by the breach. What is known is that so far, the company has decrypted more than 4,000 devices and more than 120VMware ESXi servers belonging to Shutterfly. Also, the investigation into the matter is ongoing at this time.

If you are a Shutterfly customer who was impacted by the attack, you’ve almost certainly received a copy of the official breach notification at this point. If you’re a customer and you haven’t received one, you may want to reach out to the corporate office to check the status of your account.

Finally, out of an abundance of caution, if you have an account with Shutterfly you should probably change your password right away. If you’re using that same password on other web properties, change those too.

This will certainly not be the last such incident we hear about in 2022, so stay vigilant out there.

It’s no secret that the pandemic changed the way much of the world works. Tens of millions of people are now working from home with millions more eyeing that as a very real possibility.

Unfortunately, the pandemic also changed what kinds of opportunities hackers and scammers are targeting. It shouldn’t come as a great shock that they’ve begun targeting work from home opportunities.

Here’s how a typical campaign plays out, according to researchers at Proofpoint:

On average, more than 4000 phishing emails a day are being sent to recipients worldwide. The bulk of recipients are in the United States, but people in Europe and Australia are being targeted too.

In more than 95 percent of cases, attackers are targeting email addresses that are linked to colleges and universities. So as a first necessary step, the attackers are either hacking into university databases to get the email addresses or they’re leveraging someone else’s prior breach and buying the data on the Dark Web.

In any case, the specific lure varies from one campaign to the next but it’s always some variation of “we’re hiring X number of remote workers to do this!” They then include a few details about the job with an attachment or an embedded link to follow for more information.

Naturally, if you open the file or follow the link you’ll ultimately be presented with capture boxes designed to collect your login information or other personal details. If you give the hackers/scammers any information, you can bet that it will be used against you. According to FBI statistics, the average loss for a victim of employment fraud is about $3,000.

It may not be life ruining bad, but it still stings. In any case, these kinds of attacks are on the rise in our post-pandemic world. Be aware and make sure that your friends and family know too.

People who are in the habit of pirating movies and software have something new to worry about. It seems hackers have begun targeting at least some of them with a ubiquitous form of malware.

On the Dark Web, anyone who is willing to shell out twenty bucks or so can get their hands on a copy of BitRAT, which is a surprisingly capable bit of malicious code for the price.

Recently, an individual or a group of hackers got their hands on BitRAT and devised a new way to spread it around the internet.

They disguised their malicious payload as a Windows 10 Pro License Activator. So a pirate downloads what he or she believes to be a “crack” for Windows 10 Pro. They install the software and not only do they not get the free copy of Windows 10 Pro that they were expecting, but they also wound up with an infected system. Ouch.

You may shrug your shoulders at this and conclude that the pirates got what they deserved. Looking at it from an ethical/moral perspective, there’s an argument to be found there.

On the other hand, the person with the hacked PC may wind up interacting with and sharing files with you or someone at your company, which could allow the hacker who infected the initial machine to get his hooks into your network. Ultimately, that’s why this deserves your attention.

Software pirates are not only bad because of what they do, they’re bad business in general. If you associate with anyone who pirates wares (knowingly or not), you may be setting yourself up for trouble down the road.

This is hardly a new phenomenon. Pirates are frequently seen as good targets for malware campaigns, and this is but the latest in a long line of campaigns that specifically set their sights on that group. At the end of the day it’s a numbers game. The more often you rely on pirated wares the greater your risk of infection. At the end of the day, it’s probably not worth it.

A security researcher who goes by the name “Dr. Web” has been tracking a suspicious increase in Trojan infiltration emanating from the Google Play Store.

It is not currently known whether a single organized and determined group of hackers is responsible for the surge or if several groups just happen to be focused on the Play Store at around the same time.

Although a variety of malware strains have been spotted embedded in poisoned versions of apps on the Play Store the focus has been on highly popular apps with 500,000 installs or more. In addition to that, there’s a new Android Trojan disguised as a WhatsApp mod.

Other than ‘apps with lots of installs,’ there doesn’t seem to be a clear pattern. Several poisoned apps were cryptocurrency management tools, Gasprom investment clones, photo editors, and the like.

Broadly speaking at least where investment-oriented apps are concerned, the gimmick was to get an unsuspecting user to create a new account and then deposit money into it which would be siphoned off later. In cases of other types of apps, invariably there would be a request made to sign up for expensive subscription services.

The good news is that at this time this piece was written, most of the poisoned apps have been removed from the Play Store. Unfortunately, there are still a few holdouts. For example, the app called “Top Navigation” is known to be poisoned but at the time of this writing is still available on the Play Store. Even Worse is it boasts more than half a million installations.

Since Google has been busily chasing down and removing the poisoned apps, the group behind this latest campaign has been setting their sights a bit lower. They now seem to be poisoning apps like Advice Photo Power with around 100,000 installations.

The bottom line is that while the Play Store is still mostly safe it’s not a completely safe source for malware-free apps so stay on your guard.

The automotive parts giant named DENSO is the latest corporation to fall victim to a hacking attack. The company has offices all over the world and supplies parts to brands including General Motors, Fiat, Volvo, Toyota, and others.

Collectively the company and its subsidiaries employ more than 160,000 people and boasts revenues of more than $44 billion USD (in 2021).

The company had this to say about the incident:

“DENSO has confirmed that its group company in Germany network was illegally accessed by a third party on March 10, 2022.

After the detecting the unauthorized access, DENSO promptly cut off the network connection of devices that received unauthorized access and confirmed that there is no impact on other DENSO facilities.”

Given DENSO’s size, it is fortunate that the attack didn’t shut down any of the company’s production facilities. We’re only just getting the supply chain issues caused by the pandemic sorted out and this could have thrown much of the automotive industry into a tailspin.

The Pandora Ransomware gang is new and the operation apparently launched in March 2022. Their stated goal is to target large corporate networks, and steal data before encrypting their files to profit in two ways.

Although the gang itself is new, some security researchers believe that the malware itself is not new but simply rebranded as it bears striking similarities to another ransomware strain called Rook.

Rebranding is not at all uncommon in the hacking world. Many groups periodically do that in a bid to continue to evade law enforcement. At this point, the jury is still out. We don’t have definitive proof either way that Pandora is a new gang or a rebranded older one.

Whatever the case, they’ve seen fantastic initial success having apparently made off with more than 1.4 TB of data. That data includes purchase orders, technical schematics, NDAs, and the like. It is just a matter of time before the group strikes again.

Do you rely on Microsoft SQL and MySQL databases? If so, be advised that the cybersecurity firm AhnLab recently published a report about a newly emerging threat.

It seems that hackers are now targeting poorly secured Microsoft SQL and MySQLdatabases with a malware strain known as GhostCringe.

If you’re not familiar with it, GhostCringe is also known as CirenegRAT. It is a variant of the GhostRAT malware made famous by the Chinese government in a series of attacks in 2020, but dating back to 2018.

Of interest, it seems that the threat actors behind the GhostCringe attack aren’t alone. A forensic analysis of compromised servers indicates that several other malware strains were present. That suggests that competing gangs of hackers were all competing to break into the same databases as part of their own campaigns.

As malware strains go, GhostCringe isn’t the worst or most destructive we’ve seen, but it does make rather aggressive use of its keylogging function. So once any passwords you enter on the system have been compromised, they will be fed directly to the hackers who control the code and that could expose you to a whole world of pain.

This is a genuine threat that should be taken seriously. The first step in terms of taking it seriously is to make sure your server software is up to date with the latest security patches applied. In addition to that, please do not make the mistake of either not setting an administrator password or setting one that is weak and easily guessed.

Those are rookie mistakes that are easy to avoid, and you don’t want to be the business owner who lost tens of thousands of dollars to a mistake like that.

Finally, be relentless in terms of monitoring all activity on your server including suspicious “reconnaissance” activity which could be a harbinger of things to come.

Emotet is in the news again according to the latest information from email security firm Cofense. Emotet is notorious for spreading via phishing campaigns and this latest phishing campaign sees them impersonating the IRS.

By all outward appearances, the emails look legitimate. The Emotet gang knows that with so many people feeling harried during tax season, potential victims are much less likely to look closely at incoming emails that claim to have tax documents since they’re expecting tax documents anyway.

While the particulars vary from one email to the next, the general gist of emails associated with this campaign goes as follows. “Hi, we’re the IRS, and we’re contacting your business with some completed tax forms,” or, in some variants, “We’re contacting you with some tax forms you need to fill out and send back to us.”

Again, given the timing of tax season, this is not at all out of the ordinary. A surprising percentage of email recipients are opening the included attachments.

Simply opening the emails won’t doom you, but if you enter the password required to unlock the file attached to the email, you will doom yourself. Emotet will be installed in the background along with whatever additional malicious payload the hackers want to inflict on you.

In addition to that the malware will rifle through your address book, absconding with the email addresses belonging to your contacts. It does this so it can use those addresses in future reply-chain attacks, thus extending the longevity of the campaign.

There’s no good defense against this kind of attack except for vigilance. The standard email defenses apply here. Never open an attachment from someone you don’t know. In cases where the recipient seems to be a government agency, call to verify that they have, sent you something that needs your attention, and examine the email closely.

Be careful out there.

Are you a Windows Insider? If so, be aware that the company is testing a “hidden” new feature you’re probably going to love.

It’s a small change but its impact is enormous. The feature is the Tabbed File Explorer!

The experimental feature must be explicitly enabled but once it is it works a lot like tabbed browsing does.

If you right click on a drive, you’ll see a new menu option “open in a new tab.” Left clicking that option will open the drive in a new tab adjacent to the current File Explorer tab. That part of the new feature is working smoothly, but the company hasn’t yet worked out the particulars of reordering tabs.

It’s worth mentioning that not all hidden features wind up being officially released features. The company has said exactly nothing about it so this may or may not wind up being an integral part of the Windows 11 user experience.

We certainly hope so because it’s a spectacularly useful addition.

If you’re interested in playing around with it, here’s what you need to do:

First, join the Dev channel of the Windows Insider program and install the latest build. Then download the Vive Tool which enables hidden developer features in both Windows 10 and Windows 11.

Open an “Elevated Command Prompt” and make your way to the folder where the Vive tool has been extracted.

Finally, type the following command:

vivetool addconfig 34370472 2
After you enter this commend, you’ll get a confirmation response from the Vive tool. At that point, you’ll need to restart your computer to start experimenting with the tabbed File Explorer.

When you’ve finished testing the feature or if you decide it’s not to your liking, simply enter the following command (same process as described above):

vivetool addconfig 34370472 0
Restart your computer and the tabbed browsing feature will no longer be enabled.

It’s a fun, cool feature and you’ll almost certainly enjoy playing around with it.

Microsoft may have inadvertently signaled that they are soon going to reincorporate ads into Microsoft 11, which is going to please exactly no one.

In the most recent Windows Insiders build, third party ads were displayed but only briefly. They vanished as of the next update.

The company responded to the angry inquires that the sudden appearance of ads caused with the following statement: “This was an experimental banner that was not intended to be published externally and was turned off.”

That’s all well and good, but the simple truth is that if the company is even considering turning the banner back on legions of Windows users are going to break out the torches and pitchforks.

This isn’t something that Microsoft should even be considering experimenting with because Windows isn’t the only OS in town. Google, Apple, and maybe even Linux would happily soak up Microsoft’s market share if the company were to decide to go that route.

Unfortunately, it wouldn’t be unprecedented. Microsoft has run ads across other previous iterations of Windows in various places including the Taskbar, the start menu, and the lock screen.

Every time they’ve done it, it has generated considerable backlash.

The key difference between then and now is that there are other gigantic tech companies who are well-positioned to take market share from Microsoft and they would absolutely not hesitate to take advantage of any mistakes the company might make.

Windows 11 has the potential to be a game-changing OS. If Microsoft gets the launch right, it will secure the company’s future for years to come. Unfortunately, as this recent gaffe demonstrated they are balanced on the edge of a knife. It is highly doubtful that their user base would tolerate ad displays in the new OS so the company needs to tread very carefully here.