Pictured: Fabian Wosar, CTO of Emsisoft, who says that due to threats he receives thanks to his ransomware-disruption efforts, he tries to keep photographs of himself from circulating.

Alert for Ransomware Attack Victims: Here's How to Respond

Mathew J. Schwartz • July 23, 2021

As ransomware continues to pummel organizations, if they do get hit, then from an incident response standpoint, what are the essential steps they should take to smooth their recovery? Veteran ransomware-battler Fabian Wosar, CTO of Emsisoft, shares essential steps and guidance for recovery.

Business Continuity Management / Disaster Recovery

US: Chinese Government Waged Microsoft Exchange Attacks

Latest

Cyberwarfare / Nation-State Attacks

ISMG Editors’ Panel: Examining the Pegasus Project

Anna Delaney • July 23, 2021

In the latest weekly update, four editors at Information Security Media Group discuss important cybersecurity issues, including the use of commercially available spyware and security risk management in the telecom sector.

Business Continuity Management / Disaster Recovery

Resiliency Is Key to Surviving a CDN Outage

Doug Olenick • July 23, 2021

A short-lived outage at the content delivery network supplier Akamai on Thursday which briefly knocked offline many corporate websites, is another indicator that companies need resiliency built into their systems. That means they should avoid relying on just one CDN provider, security experts say.

Application Security

Analysis: Implications of the Pegasus Spyware Investigation

Anna Delaney • July 23, 2021

This edition of the ISMG Security Report features an analysis of ongoing investigations into the use of NSO Group's Pegasus spyware to spy on dissidents, journalists, political rivals, business leaders and even heads of state - and discussion of whether the commercial spyware business model should be banned.

Fraud Management & Cybercrime

Saudi Aramco Traces Data Leak to Attack on Supplier

Scott Ferguson • July 22, 2021

Saudi Aramco, one of the world's largest oil and natural gas firms, has confirmed that company data was leaked after one of its suppliers was breached. Extortionists are reportedly demanding a $50 million ransom - payable in monero cryptocurrency - for a promise to delete the stolen data.

Governance & Risk Management

Patch Roundup: Windows, Linux, Oracle, Juniper

Prajeet Nair • July 22, 2021

A patch is forthcoming for a privilege escalation vulnerability in the Windows operating system that can allow hackers to gain a foothold. Meanwhile, Linux OS users also need to adopt system upgrades to fix a flaw, and Oracle and Juniper have announced product patches.

Cyberwarfare / Nation-State Attacks

Chinese APT Group Attacks French Organizations

Prajeet Nair • July 22, 2021

APT 31, a China-linked hacking group, is targeting French organizations by exploiting home and office routers in an espionage campaign, warns CERT-FR, the French government's computer emergency readiness team that's part of the National Cybersecurity Agency of France, or ANSSI.

Cybercrime as-a-service

Dutch Police Arrest 2 Tied to Phishing Operation

Dan Gunderman • July 22, 2021

Dutch police made two arrests this week in an effort to break up the alleged fraud-as-a-service syndicate known as "Fraud Family," which they say developed, sold and rented phishing frameworks to fraudsters who stole financial information.

Fraud Management & Cybercrime

Has REvil Disbanded? White House Says It Doesn't Know

Mathew J. Schwartz • July 22, 2021

What's up with REvil? Questions have been mounting since the notorious ransomware operation went quiet on July 13, not long after unleashing a mega-attack via remote management software vendor Kaseya's software. The Biden administration has welcomed REvil's online shutdown but says it doesn't know the cause.

Business Email Compromise (BEC)

Microsoft Disrupts Business Email Compromise Domains

Doug Olenick • July 21, 2021

Microsoft has announced the takedown of 17 domains that an unnamed threat group operating out of West Africa used to host fake Microsoft websites when conducting business email compromise attacks.

Network Detection & Response

Cybereason, Rapid7 and Microsoft Announce Acquisitions

Doug Olenick • July 21, 2021

Cybereason, Rapid7 and Microsoft announced acquisitions this week designed to boost their security capabilities. Meanwhile, DevOps security firm Sysdig made a move to add infrastructure-as-code security to its portfolio.

Application Security

Report Identifies Vulnerabilities Popular on Criminal Forums

Rashmi Ramesh • July 21, 2021

Researchers at Cognyte have identified the six common vulnerabilities and exposures - or CVEs - that were most frequently discussed by apparent cyberattackers on dark web forums between Jan. 1, 2020 and March 1, 2021. Five of these CVEs were for Microsoft products.

Business Continuity Management / Disaster Recovery

Law Firm Serving Fortune 500 Firms Hit by Ransomware

Prajeet Nair • July 20, 2021

Campbell Conroy & O’Neil, a Boston-based law firm that serves Fortune 500 firms, including Apple and Pfizer, is continuing its investigation of a ransomware attack in February that resulted in unauthorized access to certain data about its clients.