Author: Nicholas Webb

Quick Overview

• Microsoft cancels more than 200 certificates related to counterfeit Teams installers.
• The cybercrime collective, Vanilla Tempest, aimed at Teams users with ransomware.
• Certificates from Trusted Signing, SSL.co, DigiCert, and GlobalSign were utilized.
• Microsoft’s measures seek to diminish the efficacy of these ransomware operations.
• Microsoft made the revocations public on LinkedIn and other social media outlets.

Vanilla Tempest’s Ransomware Initiative

Microsoft has implemented crucial measures to counter a ransomware threat entity, referred to as Vanilla Tempest, by revoking over 200 certificates utilized in their attack framework. This group, also recognized by cybersecurity experts as Vice Spider and Vice Society, initiated a campaign using counterfeit Microsoft Teams installers hosted on deceptively authentic malicious websites.

Consequences of Certificate Cancellation

By canceling these digital certificates, Microsoft has complicated the efforts of Vanilla Tempest to spread ransomware disguised as legitimate files. The certificates that were revoked originated from Trusted Signing, SSL.co, DigiCert, and GlobalSign, which were used to authenticate the counterfeit installers and related tools.

Technical Aspects of the Attack

Upon executing the counterfeit .exe installers, a downloader would trigger the Oyster backdoor, eventually resulting in the deployment of the Rhysida ransomware. Apart from Rhysida, Vanilla Tempest has previously utilized several other ransomware variants, showcasing the group’s flexibility and level of threat.

Microsoft’s Preventive Actions

Microsoft’s prompt decision to cancel these certificates is vital in alleviating the threat posed by these cybercriminals. Announcements concerning these security actions were made publicly through LinkedIn and additional social media platforms, highlighting Microsoft’s pledge to cybersecurity.

Conclusion

In reaction to a notable ransomware threat targeting Microsoft Teams users, Microsoft has canceled over 200 certificates linked to counterfeit installers. This tactical move hampers the ability of Vanilla Tempest to conduct their malicious operations, thereby protecting users and organizations from potential data breaches and financial damages. The announcement signifies Microsoft’s continuous commitment to bolstering global cybersecurity initiatives.

Q: What was the principal tactic employed by Vanilla Tempest in their operations?

A: Vanilla Tempest employed counterfeit Microsoft Teams installers hosted on seemingly authentic malicious domains to deploy ransomware.

Q: How did Microsoft address the threat posed by these counterfeit installers?

A: Microsoft canceled over 200 certificates associated with the counterfeit installers, making it challenging for the malware to mimic legitimate files.

Q: What are the names of a few certificate authorities referenced in the article?

A: The certificates were from Trusted Signing, SSL.co, DigiCert, and GlobalSign.

Q: Which specific ransomware was highlighted as part of the attack?

A: The Rhysida ransomware was specifically highlighted, alongside other ransomware variants utilized by Vanilla Tempest.

Q: How did Microsoft publicize their security measures?

A: Microsoft publicized the cancellation of certificates through LinkedIn and various social media updates.

Brief Overview

• State-affiliated espionage organization Flax Typhoon discreetly altered an ArcGIS plugin into a remote shell.
• The breach sustained access for more than a year, even affecting system backups.
• Flax Typhoon mainly targets government entities and vital infrastructure.
• The organization employs legitimate system utilities to avoid being detected.
• Esri acknowledged the first recorded instance of a harmful SOE being weaponized.
• Behavioral monitoring and cryptographic integrity validations are crucial for detection.

Overview of Flax Typhoon’s Espionage

Security analysts have revealed how the state-affiliated espionage organization Flax Typhoon has cleverly transformed a reliable ArcGIS plugin into a remote shell. This surreptitious initiative enabled them to retain access to targeted systems for over a year, even affecting system backups.

Altering ArcGIS for Espionage

Flax Typhoon initially compromised an ArcGIS portal administrator account, executing harmful code on an internal server. They altered a legitimate ArcGIS server object extension (SOE), modifying the Java code to create a concealed command interface. This interface accepted base64-encoded commands and executed them on the host machine, facilitating undetected activities.

Enduring Persistence and Network Exploration

Once the compromised SOE became active, Flax Typhoon mapped the network and set up long-term persistence. They barred competing intruders with a hard-coded access key and deployed a renamed SoftEther VPN binary into the Windows System32 directory. This configuration maintained control via an encrypted channel, blending seamlessly with regular traffic.

Consequences for Critical Infrastructure

ArcGIS, developed by Environmental Systems Research Institute (Esri), is instrumental in managing spatial data vital for disaster recovery and urban planning. A single compromise can unveil sensitive infrastructure information, rendering the platform advantageous for espionage initiatives aimed at infrastructure weaknesses. Esri confirmed this innovative method as the first documented case of a malicious SOE being weaponized in such a fashion.

Identifying and Preventing Future Breaches

ReliaQuest recommends that behavioral monitoring could have potentially identified the attack earlier. Monitoring unusual network activity from server components and confirming the cryptographic integrity of trusted components is essential for protection. Solely depending on file names or digital signatures is inadequate.

A Quiet, Patient Threat Actor

Active since at least mid-2021, Flax Typhoon predominantly targets government offices, educational institutions, and essential manufacturing companies. The group also focuses on organizations in Southeast Asia, North America, and Africa. They utilize living-off-the-land strategies, applying legitimate system utilities to maintain a low profile and taking advantage of known vulnerabilities in public-facing servers.

Conclusion

The discovery of Flax Typhoon’s covert backdoor within an ArcGIS plugin underscores the advanced tactics of state-affiliated espionage operations. By modifying authentic software, the group successfully evaded detection while undermining critical infrastructure. Enhanced behavioral monitoring and cryptographic integrity checks are vital in safeguarding against such threats.

Q: What is Flax Typhoon?

A: Flax Typhoon is a state-affiliated espionage organization recognized for altering legitimate software to carry out covert activities and escape detection.

Q: How did Flax Typhoon compromise ArcGIS?

A: They modified a legitimate ArcGIS server object extension, creating a hidden command interface to run instructions on the host machine.

Q: Why is ArcGIS a target for espionage?

A: ArcGIS is utilized for managing spatial data essential for infrastructure, making it significant for state-sponsored espionage aimed at vulnerabilities.

Q: What measures can detect similar attacks?

A: Behavioral monitoring, observing unusual network activity, and confirming the cryptographic integrity of trusted components can assist in identifying such breaches.

Q: What are living-off-the-land techniques?

A: These strategies involve utilizing legitimate system utilities to execute malicious actions, complicating detection efforts.

Q: How does Flax Typhoon maintain access?

A: They employ long-term persistence strategies like installing VPN binaries and modifying Windows Registry entries to retain control over compromised systems.

Quick Overview

• Queensland removes 12-year ban on IBM regarding government contracts.
• IBM remains ineligible for payroll projects for an additional three years.
• If chosen for key projects, IBM will be required to finance independent program assurance for two years.
• This decision seeks to revive competitive dynamics in procurement.
• This action aligns Queensland with other states across Australia.
• Queensland commits $1 billion towards a digital transformation initiative.

Queensland Reintroduces IBM for Government Contracts

Parliament House in Brisbane

iStock

New Opportunities for Contracting with IBM

The Queensland government has officially annulled its 12-year prohibition on IBM, granting the tech firm the ability to bid for government contracts once more. This choice follows a long-standing restriction enacted due to a costly payroll system failure.

Ongoing Limitations

Even though IBM can now engage in a majority of governmental contracts, the firm is still barred from anything related to payroll projects for another three years. Additionally, if IBM is selected as the leading contractor for significant government ventures, it must fund independent program assurance over the subsequent two years.

Harmonizing with Other States

The choice to lift the ban is part of efforts to align Queensland’s contracting regulations with those of other Australian states. According to Queensland’s Minister for Customer Services and Open Data, Steve Minnikin, the objective is to restore “competitive tension” within procurement processes.

Investment in Digital Innovation

Beyond lifting the IBM restriction, Queensland has declared a $1 billion investment in a digital transformation program. This initiative aims to consolidate IT expenditures and systems across 19 departments, enhancing options and effectiveness for government entities in need of technology solutions.

IBM’s Challenging History with Queensland

IBM’s past with the Queensland government is tainted by the notorious 2007 payroll system project for Queensland Health. Originally projected to cost $6.2 million, the expenses ballooned to $1.25 billion due to failures in governance and oversight.

Legal Disputes and Resolutions

Following a 2013 Commission of Inquiry that deemed the project “catastrophic,” the government pursued legal action against IBM. However, the Queensland Supreme Court dismissed the lawsuit, referencing a 2010 settlement that absolved IBM of further liabilities.

Conclusion

The lifting of IBM’s ban signifies a major change in Queensland’s strategy regarding government contracting. While restrictions on payroll projects persist, this decision is anticipated to boost competition and align policies with other states. IBM’s re-entry into the market coincides with a substantial digital transformation initiative, promising wider options in technology solutions for government organizations.

Questions & Answers

Q: What was the reason behind IBM’s initial ban by Queensland?

A: IBM was banned due to a payroll system project failure for Queensland Health that led to significant budget overruns and governance problems.

Q: What are the stipulations for IBM’s return to Queensland contracts?

A: IBM can pursue government contracts but is still barred from payroll projects for an additional three years and must fund independent program assurances if selected for significant initiatives.

Q: How does this decision influence Queensland’s procurement practices?

A: The decision aligns Queensland’s procurement practices with other Australian states and aims to reestablish competitive dynamics in the bidding process.

Q: What encompasses Queensland’s digital transformation program?

A: Queensland is committing $1 billion to unify IT spending and systems across 19 departments, improving technology solutions for government agencies.

Overview of ROG Xbox Ally and Ally X

The gaming community is excited by the news that Asus Republic of Gamers and Xbox have collaborated to introduce the ROG Xbox Ally and ROG Xbox Ally X in Australia. These portable gaming devices merge the console gaming experience with the versatility of Windows 11, aiming to satisfy both casual and dedicated gamers. With worldwide availability set for October 16, enthusiastic gamers can now place their pre-orders.

Superior Performance with Upgraded Processors

The ROG Xbox Ally X stands out with its AMD Ryzen AI Z2 Extreme processor, delivering a 30% performance enhancement for popular games like Indiana Jones and the Great Circle and Doom: The Dark Ages. Meanwhile, the standard ROG Xbox Ally is powered by the efficient AMD Ryzen Z2 A processor, boosting frame rates by 20% in titles such as Forza Horizon 5 and Gears of War: Reloaded. Both models leverage AMD’s state-of-the-art technology, including FidelityFX Super Resolution and Fluid Motion Frames, ensuring a smoother gaming experience.

Enhanced Battery Performance

Battery longevity is a key highlight of the latest ROG Xbox Ally devices. The Ally X provides up to double the gaming duration in titles like Hollow Knight: Silksong compared to its earlier generation, while the basic model allows for 110% more active playtime during rigorous gaming sessions. These advancements result from carefully engineered software optimizations from Xbox and Windows, aimed at prolonging playtime and minimizing reliance on power sources.

Comfortable Design and Game Library

Both models showcase an ergonomic layout with a full-screen design and controls inspired by Xbox, helping to minimize hand fatigue during extended gaming durations. The lightweight construction and textured grip enhance comfort, whether at home or on the go. Furthermore, the unified gaming library consolidates games from leading PC stores, blending the benefits of the Xbox ecosystem with Windows capabilities for seamless enjoyment of favorite titles.

Cutting-Edge AMD Innovations

The ROG Xbox Ally handhelds utilize Radeon Super Resolution and frame generation technology, achieving frame rates up to 60% higher. This ensures that even the most demanding AAA games run effortlessly on these compact devices, delivering an unparalleled gaming experience.

Release and Pricing

Pre-orders for the ROG Xbox Ally and Ally X have commenced, providing Australian gamers the opportunity to be among the first to possess these groundbreaking devices. The standard ROG Xbox Ally retails for A$999, offering reliable performance for casual players. For those looking for the premium experience, the Ally X is priced at A$1,599, boasting enhanced battery life and superior processing capabilities. Both versions are available at prominent retailers such as Asus e-Shop, JB Hi-Fi, and more.

Conclusion

The ROG Xbox Ally and Ally X signify a major advancement in handheld gaming, combining the finest aspects of console and PC gaming into a portable format. With upgrades in performance, battery life, and access to a diverse gaming library, these devices are poised to transform mobile gaming for Australian players.

Q&A

Q: What are the primary distinctions between the ROG Xbox Ally and Ally X?

A: Key differences are found in the processors and battery life. The Ally X incorporates the AMD Ryzen AI Z2 Extreme processor and provides extended battery life, while the standard Ally features the AMD Ryzen Z2 A processor.

Q: When will the ROG Xbox Ally and Ally X be released in Australia?

A: Both models will be available globally, including Australia, beginning October 16.

Q: Where can I place a pre-order for the ROG Xbox Ally devices?

A: Pre-orders are accessible through the Microsoft Store, Asus e-Shop, and various local retailers like JB Hi-Fi and Harvey Norman.

Q: What prices should Australian gamers anticipate for these devices?

A: The ROG Xbox Ally is priced at A$999, while the Ally X is set at A$1,599.