China Is Outpacing US in Critical Tech Research Investments

Chris Riotta • December 2, 2024

China has surged past the United States in critical technology research, according to a recent report published by the Australian Strategic Policy Institute. Experts warn the shift could have profound global implications, including risks to U.S. cybersecurity, innovation and global leadership.

Fraud Management & Cybercrime

Russian Hackers Exploit Wi-Fi in Sophisticated New Attack

Latest

Artificial Intelligence & Machine Learning

Upwind Raises $100M to Thwart Cloud Security Vulnerabilities

Michael Novinson • December 2, 2024

With $100 million in Series A funding, Upwind plans to enhance its runtime and AI-powered cloud security platform. CEO Amiram Shachar outlines the company's investments in engineering, customer engagement and scaling solutions to address vulnerabilities such as misconfigurations and insecure APIs.

Artificial Intelligence & Machine Learning

Feds Propose AI 'Guardrails' for Medicare Advantage Plans

Marianne Kolbasuk McGee • December 2, 2024

The Centers for Medicare and Medicaid Services has issued proposed "guardrails" to help ensure that the use of artificial intelligence for Medicare Advantage insurance plans does not result in inequitable access to healthcare-related services. The proposed rule will go into effect in 2026.

Cybercrime

SmokeLoader Campaign Targets Taiwanese Companies

Prajeet Nair • December 2, 2024

A threat actor is targeting Taiwanese companies using phishing emails and long-standing vulnerabilities to deliver SmokeLoader malware. The threat actor uses plugins for the infamous malware to directly attack systems rather than using SmokeLoader, as its name suggests, as a loader for other malware.

Fraud Management & Cybercrime

Cyber Incidents Hit Three NHS Hospitals in UK

Marianne Kolbasuk McGee • December 2, 2024

At least three National Health Service hospitals in U.K. are responding to recent cyber incidents, including a children's hospital and a heart and chest specialty hospital - both located in Liverpool - that share IT systems. INC Ransom claims to have stolen data from the two hospitals.

Critical Infrastructure Security

EU Nations That Missed NIS2 Deadline Put On Notice

Akshaya Asokan • November 29, 2024

The European Commission on Thursday opened infringement procedures against 23 EU member states that missed a mid-October deadline for implementing the NIS2 Directive, as well 24 EU members that missed a Critical Entities Resilience Directive deadline.

DevSecOps

Sonatype, Snyk, Black Duck Top Comp Analysis Forrester Wave

Michael Novinson • November 29, 2024

Sonatype, Snyk and Black Duck remained atop Forrester's software composition analysis rankings as commoditization of core features has led to increased competition. Pressure in the market has increased due to both a saturation of core functionalities and license identification.

Security and Exchange Commission compliance (SEC)

CyberEdBoard Profiles in Leadership: Patrick Benoit

Anna Delaney • November 29, 2024

Patrick Benoit, a seasoned security leader and CyberEdBoard member, advises security leaders to lead by example and not worry about showing any of their own vulnerabilities, not least when they make a mistake. "It's OK to fail or misstep … That's what makes you a stronger leader," he said.

ISMG Editors: Major Crypto Mixer Decision Redefines Rules

Anna Delaney • November 29, 2024

In the latest weekly update, ISMG editors discussed Tornado Cash's landmark legal victory and what it means for crypto mixers, the impact of artificial intelligence on data privacy, and advancements in cybersecurity for which the industry can be thankful as it heads into 2025.

Endpoint Security

Just Like Windows: Linux Targeted by First-Ever UEFI Bootkit - UPDATED

Prajeet Nair • November 28, 2024

Cybersecurity researchers have discovered the first-ever UEFI bootkit designed to target Linux systems and subvert their boot process for malicious purposes. The "Bootkitty" malware, first uploaded to VirusTotal this month, appears to be more "proof of concept" than full-fledged threat, they said.

Breach Notification

Breach Roundup: Microsoft Tries Again With Windows Recall

Anviksha More • November 28, 2024

This week, Microsoft previews its latest attempt to introduce AI-enabled Windows Recall - now with added privacy features; over 1,000 cybercrime suspects busted in Africa; regulators report "smart" device update promises often missing; and Florida IT professional caught spying for China.

Blockchain & Cryptocurrency

Cryptohack Roundup: Judge Strikes Down 'Dealer Rule' Change

Rashmi Ramesh • November 28, 2024

This week's cryptohack roundup includes a U.S. federal judge striking down the SEC's expanded "Dealer Rule," a Python crypto library update stealing credentials, why digital payment apps are being excluded from some types of federal oversight, and drug cartels laundering profits via Tether.

Electronic Healthcare Records

Exposed on the Web: Thousands of Devices, Medical Records

Marianne Kolbasuk McGee • November 28, 2024

Thousands of unique IP addresses are potentially exposing medical devices, electronic medical records systems and other sensitive healthcare information to the internet, said security researcher Himaja Motheram of security firm Censys, which made the discovery.