Criminals are targeting T-Mobile and Verizon employees with text messages offering $300 for performing SIM swaps. The messages claim to have obtained contact information from an employee directory. Charter Communications employees have also reported similar texts. T-Mobile is investigating the messages but denies suffering a breach. SIM swap attacks can lead to unauthorized access, identity theft, and financial losses. The FBI has warned about the increasing prevalence of SIM swap attacks and introduced new rules to protect consumers.
The LockBit ransomware-as-a-service (RaaS) group has targeted an organization in West Africa using a new variant of the LockBit 3.0 builder. This variant can generate custom, self-propagating ransomware that is difficult to defend against. The attackers used stolen credentials to gain full control of the victim’s infrastructure. LockBit 3.0 has been actively used by attackers since it was leaked in 2022 and is responsible for a significant number of ransomware attacks.
Academics from the University of Illinois Urbana-Champaign have found that OpenAI’s GPT-4 large language model (LLM) can autonomously exploit real-world vulnerabilities in systems by reading security advisories. GPT-4 exploited 87% of vulnerabilities described in CVE advisories, compared to 0% for other models tested. The researchers believe future models will be even more capable, potentially surpassing script kiddies can currently access. Limiting the public availability of security information is not seen as a viable defense against LLM agents, and proactive security measures such as regular package updates are encouraged.
This story has been lingering in my head. The risk of a bribe is so pervasive and now so easy. On top of that, we have ransomware that can self-propagate and AI models that can soon leverage security research to exploit vulnerabilities quickly.
Basic security hygenies—patching, backups, and authentication—are going to become increasingly difficult, potentially to the exclusion of anything else for most organizations. Planning for when is the new black.