REGULATORY REVIEW

Every Thursday I summarize the most important regulatory actions related to security and privacy. In today's issue, former President Trump signed an executive order designed to prevent foreign actors from launching cyberattacks using U.S. cloud platforms.

To read the rest of the Regulatory Review and receive this feature weekly, start your FREE 14-day trial of premium!

Researchers have discovered an automated exploit of a critical bug in the SAP Solution Manager (SolMan) software in the wild a week after a proof-of-concept exploit code was published. The missing authentication check bug is located in SolMan's end-user experience monitoring function. Attackers could exploit the flaw to put an organization’s mission-critical SAP applications, business processes, and data at risk.

More:

• SAP SolMan manages the application lifecycle of IT solutions running on-premise, hybrid, and in the cloud. 
• Security researcher Dimitry Chastuhin released a proof of concept exploit as an educational project.
• SAP patched the vulnerability last March (Security Note #2890213).

SECURITY TRENDS: 2020 breaches drop 48%

Despite the explosion of remote working and targeted ransomware attacks last year, the number of publicly reported breaches totaled only 3,932 in 2020, a 48% decline compared with 2019, according to stats from security firm Risk Based Security.

However, the number of compromised records reached 37 billion in 2020, a 141% jump from 2019, indicating more mega-breaches last year...

Microsoft said that the SolarWinds attackers used a number of sophisticated methods to remain undetected in victims' networks. They employed operations security best practices to stay under the radar and avoid detection, the company said.

More from Microsoft:

• In its analysis, Microsoft focused on the second-stage activation of the Solorigate (Sunburst) backdoor.
• The backdoor was compiled at the end of February 2020 and distributed to compromised systems in late March.
• Microsoft determined that the attackers spent around a month selecting victims and preparing Cobalt Strike implants and command-and-control infrastructure.

Attackers used a phishing campaign that spoofed Xerox scan notifications to trick victims into clicking on malicious HTML attachments, according to Check Point and Otorio researchers. But the hackers unintentionally left more than 1,000 corporate credentials available online that were stolen by bypassing Microsoft Office 365 Advanced Threat Protection filtering.

More from Check Point:

• The attackers exposed the stolen credentials on compromised WordPress websites used as drop-zone servers that are searchable by Google.
• Once the victim clicked on the malicious HTML attachment in the phishing email, a JavaScript code ran in the background of the document, leading to the theft of credentials.
• The researchers found that construction was the most targeted industry, making up 16.7% of attacks, followed by energy at 10.7% and IT at 6%.

PSafe's dfndr lab has discovered a database that may have exposed taxpayer ID numbers (CPF numbers) and other personal data on 220 million Brazilians. The exposed data also included confidential data on 40 million companies and 104 million vehicles in Brazil.

More:

• Corporate information that was exposed includes tax ID number, corporate name, trade name, and date of incorporation.
• Last year, the Brazilian Ministry of Health exposed 243 million patient records in an unsecured COVID-19 database.
• Brazil's new data protection security law, which took effect last year, provides for a fine of up to R50M ($13M) for failure to report a data breach within 72 hours of discovery. 

QUICK HITS:

• How are companies deciding on privacy management solutions in 2021? This eGuide breaks it down.*
• The retail and hospitality sectors fix security flaws in their software at a faster rate than other sectors, according to a new report by security firm Veracode. 
• QNAP warned network-attached storage users about Dovecat malware attacks.
• The MrbMiner cryptocurrency miner group has been linked to an Iranian software firm.
• DDoS-Guard, which provided space on its platform to Parler after Amazon blocked it, must now forfeit the internet space occupied by Parler.
• Nexo manages $4B in assets and has over 1M users. See why fintech consumers are banking on crypto.*

* This is sponsored content.