Blue Yonder continues to grapple with ransomware attack.

Summary

By the CyberWire staff

At a glance.

Blue Yonder continues to grapple with ransomware attack.
Gaming engine exploited to deliver malware.
Fake shopping sites surge ahead of Black Friday.

Blue Yonder continues to grapple with ransomware attack.

Starbucks is among the companies disrupted by a ransomware attack on supply chain management software provider Blue Yonder, the Wall Street Journal reports. The coffee chain is using manual processes for employee payments.

Security researcher Kevin Beaumont said in a post on Mastodon that the attackers "got into [Blue Yonder's] Private Cloud environment at hypervisor level, deleted the DR and backup storage, then encrypted all 5 datacenters." The company hasn't confirmed these details.

Blue Yonder says it's "continuing to work around the clock, together with our external cybersecurity firms, to safely restore systems, resulting in steady progress," but the company does "not have a timeline for restoration."

Are You Confident in the Security of Your Remote and Hybrid Employees?

A remote or hybrid workforce expands your company's surface area of attack beyond corporate firewall boundaries. Employees’ personal computers introduce shadow IT, and home networks with default settings are easy targets, compounded by public Wi-Fi vulnerabilities. You need to develop a strategy to stay secure while remote employees work across untrusted networks. To learn how you can secure your company's workforce, get a free copy of the latest ThreatLocker® whitepaper on how to secure remote workforces.

Gaming engine exploited to deliver malware.

Researchers at Check Point have published a report on a new malware delivery technique exploiting the open-source game engine Godot Engine. The researchers explain, "Godot Engine provides an execution environment for GDScript, enabling game developers to create game-play logic, control scenes, and interact with game objects. GDScript includes most modern language features, including object support and multi-threading. Threat actors take advantage of Godot engine and GDScript, which use this new technique to execute malicious code, download malware, and deploy it while remaining undetected. As GDScript is a fully functional language, it offers threat actors many functionalities, from Anti-Sandbox and Anti-VM to executing remote payloads. Threat actors maliciously craft GDScript code and then load it with a loader utilizing the Godot Engine."

The threat actor behind the GodLoader malware loader has used this technique to infect more than 17,000 machines since June 29th, 2024. The technique is currently undetected by almost all antivirus engines in VirusTotal, and can be used to target Windows, macOS, Linux, Android, and iOS.

Survey Your Security Perimeter with a Free Security Assessment

By getting started with a free identity security assessment, Cisco can help you find and secure the gaps in your identity infrastructure and provide insights for improving your identity posture. Outcomes of the assessment include:

A complete view of your identity security posture
A detailed view of all identities and devices logging into your network
An analysis of your multi-factor authentication usage and adoption
A snapshot of your total number of inactive accounts

Request Your Free Identity Security Assessment Today

Fake shopping sites surge ahead of Black Friday.

Netcraft observed a 110% increase in fake online stores between August and October 2024, tens of thousands of which were created with the legitimate e-commerce platform SHOPYY. The company detected 9,000 new and unique fake store domains hosted on SHOPYY between November 18th-21st targeting Black Friday shoppers in the US.

The researchers note that criminals have been using generative AI tools to assist in these scams: "We first observed LLM-generated retail product descriptions in July 2024, and similar behaviors continue into the holiday shopping season. This includes examples of fake stores appropriating product listings directly from Amazon and using LLMs to rewrite the copy for enhanced search engine performance."

Dropzone AI Named a Gartner Cool Vendor for the Modern SOC.

Dropzone AI has been recognized as a Gartner Cool Vendor, validating its role in transforming SOCs. With an AI SOC Analyst that autonomously investigates alerts 24/7, Dropzone AI helps security teams stay ahead by reducing alert fatigue and providing decision-ready insights. Discover how we're leading SOC innovation.

Notes.

Today's issue includes events affecting Canada, China, and the United States.

Tomorrow is the Thanksgiving holiday in the US, and the CyberWire will be taking a break for the long weekend. We'll be back as usual on Monday. Best holiday wishes to you all.

Attacks, Threats, and Vulnerabilities

Credit Card Skimmer Malware Targeting Magento Checkout Pages (Sucuri Blog) Discover how a new credit card skimmer targets Magento checkout pages, stealing customer data with advanced obfuscation techniques.

Black Friday Gets a Fakeover: Fake Stores Spike 110% by Using LLMs this Holiday Shopping Season (Netcraft) Key Data This article explores Netcraft’s research into the global growth of fake stores, including activity that makes use of the e-commerce platform SHOPY ...

Advanced Cyberthreats Targeting Holiday Shoppers | FortiGuard Labs (Fortinet Blog) Black Friday and Holiday Shopping Threats Targeting Shoppers on the Darknet. Learn more.…

Marketplace

CrowdStrike still doesn’t know cost of Falcon flame-out (The Register) Thinks customers may have forgiven it after revenue hits a record

Products, Services, and Solutions

CISA debuts new cybersecurity training platform (Federal News Network) The new "CISA Learning" system will offer the same training to both internal staff and tens of thousands of external users.

Litigation, Investigation, and Law Enforcement

Medical testing company LifeLabs failed to protect customer data, report finds (Malwarebytes) LifeLabs managed to hold up a report about a ransomware incident in court for four years. It's now been published.

Hacker in Snowflake Extortions May Be a U.S. Soldier (KrebsOnSecurity) Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake, but a third suspect -- a prolific hacker known as Kiberphant0m -- remains at large and continues…

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

GovSummit (Washington, DC, USA, Dec 11, 2024) In a world of escalating digital threats and disruptions, Splunk stands at the core of government agencies, equipping them with the solutions they need to stay resilient and ensure mission success, even in the face of the unexpected. Today, the power is in digital resilience.

Events

SANS Holiday Hack Cybersecurity Challenge 2024: Snow-maggedon (Vienna, Nov 7 - Dec 2, 2024) Whether you're a first-time player or a seasoned participant, this year’s Holiday Hack brings exciting new features you won’t want to miss! We’ve introduced a new dynamic for this year: challenges will be gradually released in sync with the story, keeping the experience fresh and immersive. See challenges release dates and new features included.

AWS re:Invent (Las Vegas, Nevada, USA, Dec 2 - 6, 2024) AWS re:Invent offers learning sessions on many topics in a variety of formats and at various levels so you can expand your knowledge and grow your skills at a pace that is right for you. Select a topic from the list to learn more about these opportunities at re:Invent.

ISC2 SECURE Washington, DC (Virtual, Dec 4 - 5, 2024) You’re invited to participate in powerful collaboration and discover the latest topics impacting the cybersecurity profession. Join us for ISC2 SECURE Washington, DC, Live online on December 4-5, 2024! Over two days of interactive sessions, cybersecurity experts will address common challenges shared by government entities and the private sector/industry - not just in DC but around the globe. After a number of major national and global cybersecurity incidents in 2024, its clear we're all part of one ecosystem that must remain a united front to ensure resilience in the face of threats. Make an impact on the security of your organization’s assets and data with actionable ideas and strategies from this important event.  Members earn up to 7.5 CPE credits.

SecureWorld Pacific Virtual Conference (Virtual, Dec 11, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 11.27.24

At a glance.

Blue Yonder continues to grapple with ransomware attack.

Gaming engine exploited to deliver malware.

Fake shopping sites surge ahead of Black Friday.

Notes.

Attacks, Threats, and Vulnerabilities

Marketplace

Products, Services, and Solutions

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events