Latest

Cybercrime

Massive Surge in Use of Linux XorDDos Malware Reported

Prajeet Nair  •  May 21, 2022

Microsoft has observed a 254% increase in activity over the past six months from a Linux Trojan called XorDDos. First discovered in 2014, XorDDos was named after its denial-of-service-related activities on Linux endpoints and servers and its usage of XOR-based encryption for its communications.

Application Security

Pathlock-Appsian Deal Combines App Governance, ERP Security

Michael Novinson  •  May 20, 2022

Pathlock has merged with Appsian to form a 500-person vendor that secures users and data across SAP and Oracle's ERP apps. Bringing Pathlock, Appsian and Security Weaver together will allow the firm to take a larger bite out of the $110 billion market focused on compliance testing for business apps.

►

Anti-Money Laundering (AML)

What Is Behind the Increase in Crypto Fraud?

Suparna Goswami  •  May 20, 2022

There has been a rise in crypto fraud, and a substantial portion of it can be attributed to stimulus funding and paycheck protection programs, says David Britton, vice president of strategy, global ID and fraud at Experian. He discusses new authentication methods and stricter regulations.

►

3rd Party Risk Management

Ransomware: What's Changed Since Colonial Pipeline Got Hit?

Mathew J. Schwartz  •  May 20, 2022

When Colonial Pipeline suffered an outage in May 2021 as a result of an attack by the DarkSide crime syndicate, numerous governments changed their approach to ransomware and began treating it as a national security threat, says Rapid7's Jen Ellis. She details what needs to happen next.

Critical Infrastructure Security

Feds Warn Health Sector of Top Russia-Backed APT Groups

Marianne Kolbasuk McGee  •  May 20, 2022

Federal authorities are alerting healthcare sector entities of threats posed by Russian state-sponsored cyber groups, including some linked to attacks on pharmaceutical and related firms. Meanwhile, other ransomware gangs continue their assaults on a variety of U.S. medical facilities.

Fraud Management & Cybercrime

DOJ Revises Policy for Good-Faith Security Researchers

Mihir Bagwe  •  May 20, 2022

The U.S. Department of Justice has revised its policy on who it charges with violations under the Computer Fraud and Abuse Act. The DOJ now specifies that good-faith security research and researchers cannot be charged under the CFAA because they help improve cybersecurity standards.

Business Continuity Management / Disaster Recovery

Conti Ransomware Group Retires Name After Creating Spinoffs

Mathew J. Schwartz  •  May 20, 2022

The Russian-language criminal syndicate behind the notorious Conti ransomware has retired that brand name, after having already launched multiple spinoffs to make future operations more difficult to track or disrupt, threat intelligence firm Advanced Intelligence reports.

Fraud Management & Cybercrime

2 Health Plans Report Major Breaches Following Attacks

Marianne Kolbasuk McGee  •  May 19, 2022

Two recent apparent ransomware attacks on health plans have potentially affected hundreds of thousands of individuals. One of the incidents allegedly involved the Conti ransomware group, and the other allegedly involved Hive. One of the health plans is already facing legal fallout.

Critical Infrastructure Security

Ransomware Ecosystem: Big Changes Since Colonial Pipeline

Anna Delaney  •  May 19, 2022

The latest edition of the ISMG Security Report analyzes the changes in the ransomware landscape one year after the attack on Colonial Pipeline. It also revisits the Ryuk ransomware attack on a school district in Illinois and examines common culprits hindering effective Zero Trust adoption.

3rd Party Risk Management

Victim List in EHR Vendor Hack Grows as New Details Emerge

Marianne Kolbasuk McGee  •  May 18, 2022

The list of ophthalmology practices and the number of individuals affected by a December hacking incident at a cloud-based electronic health records vendor, which resulted in deleted databases, are growing as more details about the attack slowly emerge.

Cybercrime

North Korean IT Workers Using US Salaries to Fund Nukes

Prajeet Nair  •  May 18, 2022

North Korean information technology workers have been attempting to obtain employment in public and private sectors in the United States to fund their home country's weapons of mass destruction and ballistic missiles programs, according to an advisory from U.S. federal agencies.

Blockchain & Cryptocurrency

Cryptocurrency-Stealing 'Cryware' Malware Attacks Surge

Mathew J. Schwartz  •  May 18, 2022

Criminals are doubling down on their use of information-stealing malware, such as Cryptobot, RedLine Stealer and QuilClipper, to steal private keys and siphon off cryptocurrency being stored in internet-connected hot wallets or to raid cryptocurrency holders' online exchange accounts.