​Leading U.S. mortgage lender loanDepot has revealed that a cyber incident over the weekend was a ransomware attack that led to data encryption.  loanDepot is a major nonbank mortgage lender in the United States, with over $140 billion in serviced loans and roughly 6,000 employees.  After detecting the security breach, loanDepot started an investigation with the help of external cybersecurity experts and began notifying relevant regulators and law enforcement agencies.

Threat actors are targeting medical institutions through their patients, using a tactic called "swatting" in order to push hospitals to pay ransom demands. Swatting is a form of prank-calling in which police are repeatedly called about a specific individual (e.g., a patient) regarding bomb threats or other serious allegations, making authorities show up at the homes of these unknowing victims heavily armed.

The motivations and methods behind cyberattacks are varied. Cybercriminals exploit flaws in cybersecurity defenses as they try to compromise sensitive data, disrupt critical systems, or hold organizations hostage for the purpose of financial gain, political agendas, or pure malice. Therefore, it is essential to stay ahead of cyber adversaries by understanding current threats and using a proactive approach to anticipating and mitigating future risks. Help Net Security has provided excerpts from cyberattack surveys covered in 2023.

The LockBit ransomware operation has recently claimed responsibility for a November 2023 cyberattack on the Capital Health hospital network and threatens to leak stolen data and negotiation chats by tomorrow.  Capital Health is a primary healthcare service provider in New Jersey and parts of Pennsylvania, operating two major hospitals and several satellite and specialty clinics.  Last November, the organization experienced an IT systems outage following a cyberattack on its network, warning that the incident would impact its operations for at least a week.

According to researchers at Cryspen, multiple implementations of the Kyber Key Encapsulation Mechanism (KEM) for quantum-safe encryption are vulnerable to a set of flaws called KyberSlash that enable secret keys to be recovered. CRYSTALS-Kyber is the official implementation of the KEM and a part of the CRYSTALS (Cryptographic Suite for Algebraic Lattices) algorithm suite. It was designed for general encryption and is part of the algorithms selected by the National Institute of Standards and Technology (NIST) to withstand attacks from quantum computers.

The "Anonymous Arabic" threat group released Silver RAT, a Remote Access Trojan (RAT) capable of bypassing security software and silently launching hidden applications. According to the cybersecurity company Cyfirma, the developers maintain an active and sophisticated presence on multiple hacker forums and social media platforms. The actors, who are believed to be of Syrian origin and linked to the development of another RAT known as S500 RAT, also operate a Telegram channel that offers leaked databases, carding activities, and more.

A state-supported cyberespionage group likely affiliated to Turkey has recently been observed targeting numerous public and private entities in the Netherlands for intelligence gathering, Dutch incident response provider Hunt & Hackett reports.  The company noted that over the past year, the advanced persistent threat (APT) actor, tracked as Sea Turtle, Cosmic Wolf, Marbled Dust, Silicon, and Teal Kurma, targeted government, telecommunications, media, and NGO entities, along with ISPs and IT services providers in the country, as part of multiple espionage campaigns.

According to security researchers at blockchain intelligence firm TRM, North Korean hackers stole at least $600m in cryptocurrency in 2023.  The researchers noted that this figure represents a 30% reduction on cryptocurrency stolen by Democratic People's Republic of Korea (DPRK) linked hackers compared to 2022, at $850m.  The researchers did note that if additional crypto heists committed in the final days of 2023 are attributed to DPRK, the total amount stolen last year could rise to as much as $700m.

Orrick, Herrington & Sutcliffe, a law firm that specializes in cyberattacks, recently disclosed that they were affected by a data breach in early 2023 and that more than 600,000 individuals were impacted.  The law firm noted that between February 28 and March 13, 2023, attackers had unauthorized access to a portion of its network, including a file share storing files related to Orrick’s clients.  Orrick said its analysis of the exposed files determined that personal information pertaining to the customers of its clients was compromised in the attack.