Tag Archive for: Ransomware

Phishing, ransomware continue to hinder email security through 2022

/in


More than a third of a CRA Business Intelligence survey reported their organization will likely increase spending on email security in the next 12 months. (Photo by Justin Sullivan/Getty Images)

In 2022, security practitioners struggled to address the growing attack surface created by their rapid push to remote work and cloud-based operations during the previous two years. Cyber criminals exploited new vulnerabilities — including those introduced by the growing use of third-party software — to launch ransomware and other attacks.

But with tools like zero trust, XDR and more automated threat intelligence tech to bolster vulnerability management, cloud, email and endpoint security, organizations fought back – and established plans to invest more to secure networks and data in the next two years.

The following is the third of a seven-part series about where security practitioners struggled and, in many cases, made headway throughout 2022. Here, we focus on their email security challenges.

Click here to download the full 2022 Cybersecurity Year in Review Report from SC Media.

Consequences of email insecurity

Security teams devoted much attention to email security in 2022, but attackers continued to have the edge, exploiting the vulnerabilities that come with remote work and it’s the explosion of business and personal devices.

Consider the compromise reported by American Airlines in September 2022. The company informed customers that a bad actor breached the email accounts of some employees in July, which led to the personal information of customers and employees potentially being exposed and accessed.

Also in September, a credential phishing attack targeted 16,000 emails at a nonprofit agency. The fraudster in that incident claimed to be the prominent charge card brand American Express and demanded that cardholders open an attachment and contact the card company immediately regarding the cardholder’s account.

Such incidents demonstrate that email security is at its core a people problem, requiring security teams to address risks that can often linger beyond the realm of their control.

The uphill struggle with email security was also captured in a CyberRisk Alliance (CRA) Business…

Source…

Ransomware attacks hit Iowa schools, including Davenport, although public often left in dark

/in


In the summer of 2019, school Superintendent Devin Embray learned the Glenwood District in Mills County, Iowa, was being held hostage by foreign ransomware attackers.

The hackers encrypted student data that included schedules, contact information and demographic information, making it inaccessible to the school’s administrators, Embray said. They demanded $130,000 worth of cryptocurrency from the school district to unlock the data.

Glenwood paid $10,000 in ransom.

“There was really nothing we could do on our end,” Embray said.

The 2019 Glenwood attack was one of the first known examples of a surge in ransomware attacks on Iowa schools. While Glenwood chose to publicly acknowledge it, many schools targeted by cybercriminals do not.

Most ransomware attacks go unreported and communities are left in the dark about what may have happened to their private information and their taxpayer dollars.

People are also reading…

When the Davenport School District was targeted in September, school officials said they thought they were dealing with computer-server glitches as the district’s internet, phone and email systems experienced disruptions.

Later in the month, signs of a cyber invasion became more evident, but the district declared it had “thwarted” an attack.

A data-extortion group known as “Karakurt” has since claimed to have stolen huge amounts of personal data from the Davenport district. Though the attack first was detected in early September, state officials were not notified of the breach until the end of October.

In early November, a district spokesman first acknowledged the hackers had demanded a ransom, but the district did not pay.

Schools advised how to handle attacks

Increased ransomware attacks bring steep insurance costs, rigorous requirements to qualify for insurance and, in some cases, disruptions in students’ education.

Aaron Warner, CEO of ProCircular, a…

Source…

Week in review: LastPass breach disaster, online tracking via UID smuggling, ransomware in 2023

/in


Cybersecurity week in review

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

LastPass says attackers got users’ info and password vault data
The information couldn’t come at a worst time, as businesses are winding down their activities and employees and users are thick in the midst of last-minute preparations for end-of-year holidays.

New Microsoft Exchange exploit chain lets ransomware attackers in (CVE-2022-41080)
Ransomware-wielding attackers are using a new exploit chain that includes one of the ProxyNotShell vulnerabilities (CVE-2022-41082) to achieve remote code execution on Microsoft Exchange servers.

Make sure your company is prepared for the holiday hacking season
We’re coming to that time of the year when employees are excited about the holidays and taking time off to be with their loved ones. But while employees are preparing for some rest and relaxation, hackers are gearing up for their busy season.

5 cybersecurity trends accelerating in 2023
Netwrix has released key cybersecurity trends that will affect organizations of all sizes in 2023.

What happens once scammers receive funds from their victims
In this Help Net Security video, Ronnie Tokazowski, Principal Threat Advisor at Cofense, offers insight into the world’s most lucrative cybercrime – business email compromise (BEC).

APIs are placing your enterprise at risk
The recent push to focus on API security comes at a critical time where more enterprises are relying on enterprise mobility, meaning increasing a reliance on mobile app connectivity.

UID smuggling: A new technique for tracking users online
Advertisers and web trackers have been able to aggregate users’ information across all of the websites they visit for decades, primarily by placing third-party cookies in users’ browsers.

Ransomware predictions for 2023
In this Help Net Security video, Dave Trader, Field CISO at Presidio, talks about the evolution of ransomware attacks and outlines what we can expect in 2023.

Amplified security trends to watch out for in 2023
In 2023 and beyond, organizations can expect to continue dealing with many of the same threats they face today but with one key difference: expect criminals…

Source…

Under cyber attack: The AIIMS ransomware attack is just a reminder how vulnerable organisations can be

/in


Cybercrimes are rising both in numbers and sophistication. The latest to find itself on the receiving end was the All India Institute of Medical Sciences (AIIMS) in Delhi, which was hit by a ransomware attack on November 23, rendering its servers non-functional for about two weeks.

As the name might suggest, a ransomware attack is malware in which cybercriminals encrypt data and demand ransom for unlocking the same. In this case, they asked for Rs 200 crore in cryptocurrencies. Although the investigation is on, the minister of state for IT called it “a deliberate and targeted effort”.

Also Read: After AIIMS, Safdarjung Hospital reports cyberattack but impact may not be as severe; here’s why

Not just AIIMS but the Indian Council of Medical Research (ICMR) also faced several unsuccessful hacking attempts on November 30. Delhi’s Safdarjung Hospital, too, came under similar attacks, but the impact was limited.

Although the cyberattack at AIIMS brought the focus to cybersecurity, this is not the only ransomware attack to have been perpetrated in the recent past.

Spicejet attack

In May this year, low-fare airline Spicejet reported a ransomware attack that delayed several flights by up to six hours. “Certain SpiceJet systems faced an attempted ransomware attack last night that impacted and slowed down morning flight departures today,” it said in a statement then. Several passengers vented their anger on social media claiming many had to sit on the plane for hours. Although the attack was thwarted by the airline within hours, it was not revealed what the hackers demanded or what kind of malware affected its systems.

WannaCry

In May 2017, multiple companies the world over were attacked by the WannaCry malware. The malware was so fast-spreading that within two days, it affected over 200,000 in about 150 countries. The hackers demanded ransom in bitcoin.

Also Read: How to ensure cyber security, identity verification, fraud prevention in 2023

The companies impacted included Honda, Renault, Nissan Motors, FedEx, China National Petroleum, Petrobras, Taiwan Semiconductor Manufacturing Company, along with the United Kingdom’s National Health Service (NHS). In…

Source…