GPS coordinates added to the graphics used to deface Ukrainian websites pointed to a parking lot, in an apparent error by attackers, Polish investigators say. (Source: Poland's Computer Security Incident Response Team)

Destructive Malware Discovered Targeting Ukrainian Systems

Mathew J. Schwartz • January 17, 2022

The defacement of Ukrainian government websites may have been intended as a smokescreen for a destructive malware attack that failed to execute or has yet to be unleashed, some security experts warn. Ukraine continues to investigate the attack, which it suggests may trace to Russia, Belarus or both.

Cybercrime

Cybersecurity Experts Push for Sweeping FISMA Changes

Latest

3rd Party Risk Management

Record Number of Major Health Data Breaches in 2021

Marianne Kolbasuk McGee • January 17, 2022

In the midst of a global pandemic, the federal breach tally shows that a record number of major health data breaches were reported in the U.S. in 2021, and the overwhelming majority of them involved hacking/IT incidents. Will those trends continue in 2022?

Blockchain & Cryptocurrency

OCC Chief Calls for Collaboration in Crypto Regulations

Devon Warren-Kachelein • January 15, 2022

With 16% of U.S. citizens using a cryptocurrency trading platform, OCC acting Chief Michael Hsu urges collaborative efforts to pass cryptocurrency regulations, which he says could lead to greater innovation in the space.

3rd Party Risk Management

Accellion Agrees to $8.1 Million Breach Settlement

Prajeet Nair • January 15, 2022

More than a year after the December 2020 cyberattack on Accellion's File Transfer Appliance, the company has agreed to an $ 8.1 million settlement to resolve a class action against it following the data exposure that resulted in the theft of both consumer and patient data.

3rd Party Risk Management

Clinic Breach Affecting 200,000 Tied to Vendor's 2020 Attack

Marianne Kolbasuk McGee • January 14, 2022

A family medical practice is notifying nearly 200,000 individuals that their information was compromised in a 2020 ransomware attack on cloud hosting vendor Netgain Technology, an incident that also affected several of the vendor's other clients and hundreds of thousands of their patients.

Application Security

ISMG Editors: Is 2022 the Year of the SBOM?

Anna Delaney • January 14, 2022

In the latest weekly update, four editors at Information Security Media Group discuss important cybersecurity issues, including the importance of incident repose planning; the worldwide impact of the LOg4j flaw, which may lead to 2022 being the year of the SBOM; and the increasingly blurred line between conventional...

Blockchain & Cryptocurrency

North Korean APTs Target Cryptocurrency Startups

Devon Warren-Kachelein • January 14, 2022

A new Lazarus-linked APT threat known as BlueNoroff has emerged and is actively targeting cryptocurrency startups in a campaign called "SnatchCrypto." Research by Kaspersky found that more than 15 venture businesses and their employees have fallen victim to the nation-state threat actors.

3rd Party Risk Management

Ransomware Gatecrashes the Apache Log4j Attack Party

Anna Delaney • January 14, 2022

The latest edition of the ISMG Security Report features an analysis of how attackers are distributing Night Sky crypto-locking malware to exploit Log4j vulnerabilities, lessons learned from Log4j and a security flaw that affects some Tesla-built vehicles.

3rd Party Risk Management

Why Third Parties are the Source of So Many Hacks

Isa Jones • January 14, 2022

Protecting your critical access points and assets should be the number one priority in your cybersecurity strategy.

Governance & Risk Management

Insider Threats are a Quiet Risk in your System

Isa Jones • January 14, 2022

No matter the root cause, the result is the same: reputation damage, fines, compliance issues, and of course the ripple effects that extend outward from a breach.

Governance & Risk Management

Zero Trust Is More Than A Buzzword

Isa Jones • January 14, 2022

Since no one is trusted in this model, insider and outsider access needs to be verified and authenticated each time a user logs into a system.

3rd Party Risk Management

Maryland Health Department Confirms Attack Was Ransomware

Marianne Kolbasuk McGee • January 13, 2022

Maryland officials confirm that a December cyberattack on the state's health department, which is still disrupting some services, involved ransomware - but that no ransom was paid. Also, lawsuits have been filed against a Florida specialty pharmacy in the wake of a November cyber incident.

Business Continuity Management / Disaster Recovery

Ukraine Police Bust Ransomware Suspects Tied to 50 Attacks

Mathew J. Schwartz • January 13, 2022

Police in Ukraine have arrested five individuals on suspicion of using ransomware to extort more than 50 companies across the United States and Europe, as well as to provide an IP-changing service to international hackers to help them distribute malware, steal sensitive data and disrupt sites.