March 10, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
BlackTech’s New Malware Targets Technology, Research, and Government Sectors in Asia-Pacific Region – Active IOCs
April 22, 2024RedLine Stealer – Active IOCs
April 22, 2024BlackTech’s New Malware Targets Technology, Research, and Government Sectors in Asia-Pacific Region – Active IOCs
April 22, 2024RedLine Stealer – Active IOCs
April 22, 2024
Severity
High
Analysis Summary
After threat actors gained access to the UNDP's IT systems and stole data related to human resources, the organization launched an investigation into a cyberattack.
The United Nations Development Program (UNDP), the agency that strives to end poverty and combat inequality and marginalization, is dependent on donations from UN member states, the private sector, and multilateral organizations. UNDP operates in more than 170 countries and territories. The organization disclosed in a statement released recently that the attackers gained access to UN City, Copenhagen's local IT infrastructure in late March.
UNDP was notified on March 27th by threat intelligence that some procurement and human resources information had been pilfered by a data extortion actor. Quick action was taken to find the possible source, contain the compromised server, ascertain the nature of the exposed data, and ascertain the affected parties.
The UNDP is currently examining the extent and character of the event as well as the effects of the attack on the people whose data was compromised. Additionally, it notified those impacted by the breach and is currently assisting them in safeguarding their personal data from unauthorized usage.
The UN organization has not yet connected the attack to a particular threat group, however, on March 27, the 8Base ransomware group uploaded a new entry about the UNDP to its dark web data breach website. The attackers claim that a significant quantity of sensitive data is contained in the documents that their operators were able to obtain during the breach.
A vast amount of sensitive data, including personal and accounting information, certificates, employment contracts, confidentiality agreements, invoices, receipts, and more are purportedly included in the files they momentarily disclosed via a URL that has since expired.
8Base first appeared in March 2022. After they began targeting businesses in a wider variety of sector verticals and adopted double extortion, their activity peaked in June 2023. The extortion group, posing as sincere and straightforward pen testers, began its data leak website in May 2023 and targeted businesses that had disregarded employee and customer privacy.
This ransomware gang has so far disclosed over 350 victims on its website, often declaring as many as six victims at once. 8Base employs a modified strain of Phobos ransomware, which initially appeared in 2019 and has a lot of code in common with Dharma ransomware.
In January 2021, the United Nations Environment Programme (UNEP) also revealed a data breach following the Internet disclosure of over 100,000 employee records containing personally identifiable information (PII). In July 2019, a Sharepoint vulnerability also allowed access to UN networks in Geneva and Vienna, exposing personnel information, health insurance, and commercial contract data in what a UN official called a massive collapse.
Impact
- Data Exfiltration
- Sensitive Information Theft
- Identity Theft
Remediation
- Use strong, unique passwords for sensitive accounts. Regularly change passwords for all accounts.
- Implement multi-factor authentication (MFA) on all accounts to add an extra layer of security to login processes.
- Organizations need to stay vigilant and follow best practices for cybersecurity to protect their systems and data from potential threats. This includes regularly updating software and implementing strong access controls and monitoring tools.
- Develop a comprehensive incident response plan to respond effectively in case of a security breach or data leakage.
- Maintain regular backups of critical data and systems to ensure data recovery in case of a security incident.
- Adhere to security best practices, including the principle of least privilege, and ensure that users and applications have only the necessary permissions.
- Establish a robust patch management process to ensure that security patches are evaluated, tested, and applied promptly.
- Conduct security audits and assessments to evaluate the overall security posture of your systems and networks.
- Implement network segmentation to contain and isolate potential threats to limit their impact on critical systems.
- Never trust or open links and attachments received from unknown sources/senders
- Improve communication with customers by providing timely and transparent updates about data breaches, including what information was compromised and the steps being taken to mitigate the impact.
- Ensure that all vendors and third-party partners adhere to stringent security protocols and regularly assess their cybersecurity practices to minimize the risk of data breaches originating from external sources.
- Provide affected customers with comprehensive support, including credit monitoring services, identity theft detection, and resolution assistance, to help mitigate the potential consequences of the breach.