Ryuk ransom note (Source: Coveware, Malwarebytes)

Ryuk Ransomware Updated With 'Worm-Like Capabilities'

Mathew J. Schwartz • March 1, 2021

Prolific Ryuk ransomware has a new trick up its sleeve. "A Ryuk sample with worm-like capabilities - allowing it to spread automatically within networks it infects" was recently discovered during an incident response effort, warns CERT-FR, the French government's computer emergency response team.

3rd Party Risk Management

SonicWall Was Hacked. Was It Also Extorted?

Latest

Business Continuity Management / Disaster Recovery

Ransomware Attack's Economic Impact: $67 Million

Marianne Kolbasuk McGee • March 2, 2021

In an eye-opening look at the cost burden of a ransomware attack, Universal Health Services reports that an incident last September had a $67 million economic impact - citing, for example, the need to divert patients to competing facilities for urgent care. But insurance may cover much of the cost.

Cybercrime

Hackers Use Search Engine Optimization to Deliver Malware

Akshaya Asokan • March 2, 2021

A new malware loader dubbed "Gootloader" is using search engine optimization techniques to spread ransomware, Trojans and other malware, the security firm Sophos reports.

Cybercrime

Cryptocurrency Firm Tether Refuses to Pay Ransom to Hackers

Akshaya Asokan • March 2, 2021

The cryptocurrency company Tether has refused to pay a ransom of 500 bitcoins ($24 million) after hackers threatened to leak sensitive data if the company failed to pay.

3rd Party Risk Management

Equifax CISO Jamil Farshchi on SolarWinds and Supply Chains

Tom Field • March 1, 2021

Jamil Farshchi has been there. As CISO of Equifax, he knows what it’s like to be a victim of a high-profile cyberattack. And he knows breached companies have a choice: "Are they going to be a force for good by helping the rest of the industry learn from their experience?"

COVID-19

Indian Vaccine Makers, Oxford Lab Reportedly Hacked

Marianne Kolbasuk McGee • March 1, 2021

Two Indian vaccine makers and an Oxford University lab are reportedly among the latest targets of hackers apparently seeking to steal COVID-19 research data.

Cryptocurrency Fraud

Cryptomining Botnet Uses Bitcoin Wallet to Avoid Detection

Prajeet Nair • March 1, 2021

A cryptomining botnet campaign is using bitcoin blockchain transactions to hide command-and-control server addresses and stay under the radar, defeating takedown attempts, according to security firm Akamai.

Endpoint Security

Rockwell Controllers Vulnerable

Prajeet Nair • March 1, 2021

A critical authentication bypass vulnerability could enable hackers to remotely compromise programmable logic controllers made by industrial automation giant Rockwell Automation, according to the cybersecurity company Claroty. Rockwell has issued mitigation recommendations.

Cyberwarfare / Nation-State Attacks

Microsoft Releases Queries for SolarWinds Attack Detection

Prajeet Nair • February 26, 2021

Microsoft is making available the CodeQL queries it used to detect malicious implants in the massive supply chain attack that affected SolarWinds, tech firms and government agencies.

Cybercrime

Chinese Attack Tool Gains Gmail Access

Prajeet Nair • February 26, 2021

Proofpoint reports that Chinese state-sponsored hackers are using a new customized malicious Mozilla Firefox browser extension that facilitates access and control of victims’ Gmail accounts. So far, the hackers are targeting Tibetan organizations.

Breach Notification

Analysis: Feds Crack Down on Cryptocurrency Scams

Anna Delaney • February 26, 2021

The latest edition of the ISMG Security Report features an analysis of a federal crackdown on ICO cryptocurrency scams. Also featured: An update on the SonicWall hack investigation and the use of digital IDs to verify COVID-19 testing.

Endpoint Security

Improving Connected Vehicle Cybersecurity

Jeremy Kirk • February 25, 2021

Connected vehicles are rife with cybersecurity risks. But Faye Francy of Auto-ISAC says automakers and suppliers are increasingly sharing critical information and strengthening supply chains.

Governance & Risk Management

6,000 VMware vCenter Devices Vulnerable to Remote Attacks

Prajeet Nair • February 25, 2021

Security firm Positive Technologies says more than 6,000 VMware vCenter devices worldwide that are accessible via the internet contain a critical remote code execution vulnerability. VMware has issued recommendations for patching the flaw.