Content by Mathew J. Schwartz

Microsoft Attributes MOVEit Transfer Hack to Clop Affiliate

Jayant Chakravarti , David Perera , Mathew J. Schwartz  •  June 5, 2023

Microsoft says an affiliate of the Russian-speaking Clop ransomware gang is behind a rash of attacks exploiting a recently patched vulnerability in Progress Software's MOVEit application. Known victims include British payroll provider Zellis, which says eight corporate customers were affected.

Pentagon to Pay Starlink for Ukraine's Satellite Broadband

Mathew J. Schwartz  •  June 2, 2023

The U.S. Department of Defense says it will pay for Starlink satellite broadband access for Ukraine as it battles Russia's all-out invasion. Military experts say Starlink remains essential for supporting Ukraine's battlefield communications, including drone reconnaissance.

After Ransomware Attack, Oakland Faces Data Breach Lawsuit

Mathew J. Schwartz  •  June 1, 2023

A flurry of legal complaints and a lawsuit have been filed against the city of Oakland, California, after it fell victim to a ransomware attack. The Play group claimed credit for the attack and posted some of stolen information, which includes personal details, ID numbers and health information.

Conti's Legacy: What's Become of Ransomware's Most Wanted?

Mathew J. Schwartz  •  June 1, 2023

Former members of the defunct Conti ransomware group are continuing to ply their trade under a variety of other guises, including Royal and Black Basta. Thanks to their agile and innovative approaches, post-Conti operations are "stronger than ever," one ransomware expert reports.

Hackers Exploited Zero-Day Bug for 8 Months, Barracuda Warns

Mathew J. Schwartz  •  May 31, 2023

Barracuda Networks is warning that a zero-day vulnerability that it recently discovered and patched in its Email Security Gateway appliances appears to have been exploited since October 2022. Attackers used the flaw to gain persistent remote access to networks and exfiltrate data, it said.

Gouda Hacker: Charges Tie to Ransomware Hit Affecting Cheese

Mathew J. Schwartz  •  May 30, 2023

How many hackers can claim to have caused a national cheese shortage, not least in the Gouda-loving Netherlands? Enter Mikhail Matveev, a Russian national who's been indicted for wielding not one but three strains of ransomware, in what experts say is a needed focus on ransomware affiliates.

Invoice and CEO Scams Dominate Fraud Affecting Businesses

Mathew J. Schwartz  •  May 29, 2023

Losses to fraud reported by Britain's financial services sector exceeded $1.5 billion in 2022, declining by 8% from 2021, says trade association UK Finance. About 40% of losses tied to authorized push payment fraud, in which victims get tricked into transferring funds to attackers.

Sports Warehouse Fined $300,000 Over Payment Card Data Theft

Mathew J. Schwartz  •  May 29, 2023

Online sports retailer Sports Warehouse has agreed overhaul its security program and pay a $300,000 fine to New York State after hackers stole 20 years' worth of payment card data and customer information the company was storing in plaintext on its e-commerce server.

Capita Hack Fallout: Regulator Sees Breach Reports Surge

Mathew J. Schwartz  •  May 26, 2023

Britain's privacy watchdog has seen a surge in data breach reports from outsourcing giant Capita's customers tied to two incidents: a March hack attack by a ransomware group against Capita and one of the company's Amazon Web Service buckets being left unsecured for six years.

Mass Exploitation of Zyxel Network Appliances Underway

Mathew J. Schwartz  •  May 25, 2023

Versions of the Mirai botnet are targeting a vulnerability present in numerous Zyxel network devices. Zyxel patched the vulnerability in April but it's not clear how many users have applied the fix. Security experts warn the flaw appears to be exploited at a massive scale.

Capita Issued Erroneous Breach Details, Officials Report

Mathew J. Schwartz  •  May 24, 2023

Breach notifications from British outsourcing giant Capita mount amid signs the multibillion-pound company doesn't have a firm grip on how much data it exposed. For a company that trumpets its ability to "achieve better outcomes," Capita's inability to grasp the impact of its breaches is ironic.

IT Worker Admits Piggybacking on Hacker's Extortion Attempt

Mathew J. Schwartz  •  May 23, 2023

An IT security analyst has confessed to trying to blackmail his employer by altering ransom notes sent from a hacker to a board member and changing the cryptocurrency payment address to one he controlled. After his employer detected the unusual activity, U.K. police traced it back to the worker.

Android Fingerprint Biometrics Fall to 'BrutePrint' Attack

Mathew J. Schwartz  •  May 22, 2023

Security researchers have demonstrated a practical attack that can be used to defeat biometric fingerprint checks and log into a target's Android - but not Apple - smartphone. Dubbed "BrutePrint," the brute force attack is inexpensive and practical to deploy at a large scale.

Ukraine's Cyber Defense Success: Top Takeaways

Mathew J. Schwartz  •  May 18, 2023

Fifteen months after Russia intensified its illegal invasion of Ukraine, experts say top cyber defense lessons policymakers and defenders should apply include focusing on resilience. Building for resilience acknowledges the inevitability of ongoing attacks.

Royal Ransomware Group Builds Its Own Malware Loader

Mathew J. Schwartz  •  May 17, 2023

The Royal ransomware group, which spun off from Conti in early 2022, is refining its downloader malware using tactics and techniques that appear to draw directly from other post-Conti groups, as well as working closely with trusted former associates of Conti, REvil and Hive, researchers say.