(ISC)² Blog

Cybersecurity Industry News Review - June 6, 2023

$400 million fund for AI and robotics start-ups, OpenAI to fund cybersecurity efforts while research shows that cybercriminals are targeting the friends and families of high-value organization executives. IQ Capital Gears Up For ‘Deep Tech’ Investment London-based venture investor IQ Capital has successfully raised $400 million (£320 million) across two funds, which it plans to invest in an array of so-called ‘deep tech’ start-ups focused on tech areas including artificial intelligence (AI), robotics, quantum computing and others. The venture capital firm primarily invests in seed to Series A stage startups in the UK and Europe. Its previous investments including protein... Read more →

Latest Cyberthreats and Advisories - June 2, 2023

Cybercriminals hire humans to break CAPTCHAs, the meteoric rise of LockBit and a potential ransomware attack on the U.S. city of Augusta, Georgia. Here are the latest threats and advisories for the week of June 2, 2023. By John Weiler Threat Advisories and Alerts China State-Sponsored Actor Infiltrates U.S. Critical Infrastructure In a collaborative effort, cybersecurity authorities from the U.S., Canada, Australia, New Zealand and the U.K. have issued a joint advisory to highlight a series of events linked to a China state-sponsored threat actor known as Volt Typhoon. The cybercriminal’s activity impacts the networks of critical infrastructure sectors across... Read more →

Infosecurity Europe 2023 Preview – Our Pick of the Keynote Sessions

In the first of two previews of Infosecurity Europe 2023, we look at our top picks for unmissable keynote sessions across the three days of the conference, held at ExCel in London from June 20-22. By John E. Dunn As the pivotal cybersecurity conference in the region, every Infosecurity Europe conference is oriented to topical themes. This year is no exception, with the speaker lineup covering everything from the on-going anxiety of cyberwar, how zero trust can be made to work once it leaves the drawing board, and the never-ending puzzle of assessing supply chain risk. The following is our... Read more →

Latest Cyberthreats and Advisories - May 19, 2023

WordPress’s Elementor is vulnerable (again), the U.S. Department of Transportation is breached, 5.8 million medical records are posted online after PharMerica incident. Here are the latest threats and advisories for the week of May 19, 2023. By John Weiler Threat Advisories and Alerts Australian and U.S. Governments Release Advisory on BianLian Ransomware Group The Australian Cyber Security Centre (ACSC) has released a joint cybersecurity advisory with the U.S. outlining typical threat vectors and signs of ongoing attacks by the BianLian ransomware group. It is a relatively new group that uses trusted Remote Desktop Protocol (RDP) credentials to gain network access... Read more →

Cybersecurity Industry News Review - May 2, 2023

By Joe Fay U.S. cybersecurity officials point finger at “lying, cheating, stealing” China, while another cybersecurity leader speaks out about “boring” training. E.U. hits fast forward on new legislation. Trend Micro unveils Rapture ransomware while Microsoft unveils rusty Windows. NSA Cybersecurity Director Points Finger AI, Russia and China At RSA U.S. National Security Agency (NSA) cybersecurity director Rob Joyce highlighted the threat from AI, Russia and China in a presentation at RSA last week. Joyce said that Russian-based actors were actively attacking Ukraine, through disruption of both civil society and the war effort, as well as intelligence gathering. Attacks on... Read more →

Cybersecurity Industry News Review - April 25, 2023

Europe’s Air Traffic Control (ATC) agency under DDoS attack. Eavesdropping police in the U.K. spared massive fine. Numbers emerge after NCR ransomware attack. Hackers hit gold in secondhand routers. By Joe Fay “Pro-Russian” Hackers Dive Bomb European Air Traffic Control Agency Europe’s air traffic control agency, Eurocontrol, has been fighting off a cyberattack by pro-Russian hackers since April 19. The attack appears to have been a DDoS targeting the agency’s website. Pro-Russian group Killnet claimed to have launched a “100 hour” marathon against Eurocontrol. The agency declined to detail the nature of the attack but said its safety operations had... Read more →

LATEST CYBERTHREATS AND ADVISORIES - APRIL 21, 2023

By John Weiler Australia’s deepening cybercrime crisis, an alarming surge in ransomware attacks and a multi-agency warning to organizations about their network infrastructure. Here are the stories that rocked the cybersecurity world the week of April 21, 2023. Threat Advisories and Alerts Russian State-Sponsored Actors Exploit Cisco Routers The U.K. National Cyber Security Centre (NCSC), the U.S. National Security Agency (NSA), U.S. Federal Bureau of Investigation (FBI) and U.S. Cybersecurity and Infrastructure Security Agency (CISA) have released a joint advisory warning for the malware "Jaguar Tooth." The custom malware is reportedly being used by Russian state-sponsored APT28 actors to compromise... Read more →

#IdentityManagementDay - Best Practices to Help Keep Your Organization Secure

By Chinatu Uzuegbu, CISSP, CEO/Managing Cyber Security Consultant at RoseTech CyberCrime Solutions Ltd. We kicked off the Identity and Access Management Processes from the Top-Level Management approach. The Identity and Access Management Security Steering Committee is a group of C-Suites leaders, also referred to as the respective Data and Asset Owners from the various Business Units of my organization. The group met and established the governing policy around the Identity and Access Management Processes. The governance covers the Mandatory Access Control Policy and Trust Policy of the organization which are automatically enforced as the baselines on default. The governance of... Read more →

CISA Moving Further Towards Pre-Emptive Stance with Ransomware Attack Alert System

In the latest of several recent announcements, the U.S. body responsible for cybersecurity is making a clear shift towards pre-emptive over reactionary reporting, alerting and advice for organizations. By John E. Dunn A defining characteristic of ransomware attacks is the element of surprise. By the time the victim receives the ransom note, it is usually already too late to contain an incident. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced a new pilot project, the Pre-Ransomware Notification Initiative, which it hopes will be able to notify more victims before this happens. The premise is that attackers often linger... Read more →

Cybersecurity Industry News Review – March 21, 2023

KillNet is bad for your health, TikTok facing further bans, ransomware impacts cancer test results, Russia allegedly increasing its cyberwarfare efforts. By Joe Fay Microsoft Demonstrates How KillNet Is Bad for Our Healthcare Sector Microsoft has highlighted a rise in DDoS attacks on healthcare organizations, mapping a three-fold increase in attacks over three months. It said it tracked 10 to 20 attacks per day on healthcare organizations on Azure in November but was seeing 40 to 60 per day in February. The attack mix changed over this time, it added, with over half of attacks now being UDP floods, with... Read more →

Latest Cyberthreats and Advisories - March 17, 2023

Cybercriminals pounce on SVB collapse, privacy concerns around ChatGPT and the FBI warns of a rise in crypto scams. Here are the latest threats and advisories for the week of March 17, 2023. By John Weiler Threat Advisories and Alerts FBI Warning: Cryptocurrency Investment Schemes on the Rise The U.S. Federal Bureau of Investigation (FBI) is warning internet users of an increase in cryptocurrency investment scam schemes, which defrauded victims of over $2 billion in 2022. Cybercriminals (usually located overseas) use social media platforms, dating apps, professional networking apps and other online means to connect with targets. The criminals then... Read more →

Analysis: Where Next As Europol Hails Rare DoppelPaymer Ransomware Success

By John E. Dunn Two arrests for alleged ransomware crimes and some useful intel. But will the latest Europol action make any difference? Following an international operation encompassing law enforcement agencies in Germany, Ukraine, the Netherlands and the U.S., Europol announced the arrests in Germany and Ukraine of what it believes are two of the five core “masterminds” of the DoppelPaymer ransomware group. The first suspect was described as a German national, the second as a Ukrainian, in raids that also involved searching properties in Kiev and Kharkiv. Beyond that, details are scarce although Europol said the German suspect was... Read more →

Cybersecurity Industry News Review – March 14, 2023

The U.K. Online Safety Bill triggers a security rebuke from WhatsApp, the Czech Republic concerned about TikTok, an international law enforcement effort shuts down the NetWire RAT infrastructure, while a study suggests workforce malaise towards reporting security incidents. By Joe Fay WhatsApp Would Leave U.K. Rather Than Break Encryption WhatsApp would pull its end-to-end encrypted messaging service in the U.K., rather than submit to any requirement to weaken its privacy stance to comply with the U.K. government’s Online Safety Bill. WhatsApp chief Will Cathcart said that 98 per cent of its users were outside the U.K., and ALL users wanted... Read more →

Latest Cyberthreats and Advisories - March 10, 2023

By John Weiler Mexico timeshare scams, the DoppelPaymer ransomware gang gets busted and a major data leak rocks Oakland, California. Here are the latest threats and advisories for the week of March 10, 2023. Threat Advisories and Alerts FBI Issues Warning About Mexico Timeshare Scam The U.S. Federal Bureau of Investigation (FBI) has issued an advisory about timeshare scams in Mexico, which affected over 600 people and resulted in roughly $39.6 million in victim losses last year. How does the scam work? Owners of timeshares in Mexico receive an unexpected email or phone call from fraudsters requesting to sell or... Read more →

What We Learned from The Royal Mail Ransomware Chat

By Dave Cartwright, CISSP In February 2023, something very unusual happened. Following a ransomware attack on Royal Mail International, a division of the U.K.’s (formerly state-owned) mail and parcel delivery service, the negotiation between the firm’s representatives and the LockBit ransomware attackers made it into the public domain. As reported in January 2023, Royal Mail engaged with the U.K. National Crime Agency (NCA) and National Cyber Security Centre (NCSC), and part of the resulting activity was to negotiate with representatives of LockBit – without much success. The first thing of note is that the chat covers a time period of... Read more →

Cybersecurity Industry News Review: March 7, 2023

Cybercrime may have less of a gender issue than cybersecurity, LastPass gives attack update, CISA warns on Royal ransomware gang while WHSmith and DISH Network count the cost after both suffer cyber attacks. Study: Gender No Barrier To Participating In “Meritocratic” Cybercriminal Community If the cybersecurity industry is struggling to achieve gender parity, it could learn some lessons from its criminal flipside. A study from Trend Micro suggests that the cyber underground “provides an open environment for individuals of any gender to find employment or a side business”. Its analysis suggested gender was not a barrier to finding work as... Read more →

Latest Cyberthreats and Advisories - March 3, 2023

Major U.S. government and corporate breaches, the White House enforces TikTok ban and the NCSC issues zero trust guidance. Here are the latest threats and advisories for the week of March 3, 2023. Threat Advisories and Alerts NCSC Publishes Guidance on Zero Trust Security The U.K. National Cyber Security Centre has published guidance on how companies can leverage zero trust security. The article explains why some systems can’t integrate into a zero trust network. Organizations can get around this issue by building a mixed estate using a zero trust proxy or a managed virtual private network (VPN). ZK Java Web... Read more →

Cybersecurity Industry News Review: February 28, 2023

By Joe Fay Australia to scrap cybersecurity rules as part of a new regime, ransoms bankroll further ransomware attacks, Dole and PyPi attacked, while the European Commission calls time on TikTok. Australia to Overhaul Cybersecurity Rules The Australian government is overhauling its approach to cybersecurity and will create a new agency to coordinate responses to cyberattacks and manage investment. The plans follow publication of a discussion paper on cybersecurity following recent high-profile attacks, including one that affected telco Optus. The minister for home affairs, Clare O’Neil, described the current regime as “bloody useless.” AT&T Selling a Cybersecurity Business, Trend Micro... Read more →

Cybersecurity Industry News Review: February 15, 2023

By Joe Fay NHS still recovering from ransomware incidents. Network firm employee confesses to data extortion, as U.S. cyber ambassador admits their Twitter account was hacked as the President turns to industry leaders to advise him. NHS Still Reconnecting After 2022 Lockbit Attack on Supplier Just how disruptive ransomware can be was illustrated this past week, six months after an attack on UK health software supplier Advanced. The attack on Advanced first emerged in August 2022, causing disruption across a range of NHS services. Health and secondary care minister Will Quince said that while most affected NHS organizations were up... Read more →

Latest Cyberthreats and Advisories - February 10, 2023

Cyberattacks wreak havoc on the U.K., LockBit brings big business to its knees and a massive VMware ransomware campaign. Here are the latest threats and advisories for the week of February 10, 2023. Threat Advisories and Alerts Massive Ransomware Campaign Targets VMware ESXi Servers The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a script for retrieving VMware ESXi servers encrypted by the massive ESXiArgs ransomware campaign. The attack began last week when cybercriminals launched their attack. At the time of writing, 2,800 servers are know to have been encrypted. As for the script, the U.S. cybersecurity organization has... Read more →