ExtraHop announced Tuesday it has entered into a definitive agreement to be acquired by the private equity firms Bain Capital Private Equity and Crosspoint Capital Partners for $900 million. The transaction is expected to close in the summer of 2021.
Researchers at Malwarebytes have uncovered the latest tactics, techniques, and procedures used by the North Korean threat group Kimsuky, also known as Thallium, Black Banshee and Velvet Chollima, as it continues to launch espionage attacks. This time it is using an AppleSeed backdoor.
Weeks after VMware issued patches to address vulnerabilities in its vSphere Client (HTML5), threat intelligence firm Bad Packets says threat actors are mass scanning for vSphere hosts vulnerable to remote code execution.
Colonial Pipeline Co. CEO Joseph Blount defended his actions during the opening hours of the May 7 DarkSide ransomware attack against his company as several lawmakers on the Senate Homeland Security and Governmental Affairs Committee grilled the executive for over two hours on Tuesday.
CISA is preparing to expand its vulnerability research and disclosure program, which is now mandatory for nearly all executive branch agencies, by creating a vulnerability disclosure platform service. As part of this effort, the cybersecurity agency is partnering with Bugcrowd and EnDyna.
Ransomware actors continue to target schools and universities across the U.K., and attacks have surged since February, a new report by the U.K's National Cyber Security Center warns. The agency has also released a free tool to help schools detect any compromise.
Thousands of suspected criminals have been relying on the "Anom" encrypted communications platform to coordinate their efforts. But the FBI and Australian police developed Anom as a honeypot for monitoring criminals, producing intelligence that globally led to 800 arrests and massive drug seizures.
Ransomware attacks have evolved over the years as attackers have come out with new strategies for digital extortion, says Chris Novak, global director of the Threat Research Advisory Center at Verizon Business Group. He shares insight from the Verizon 2021 Data Breach Investigations Report.
The U.S. Justice Department reported it recouped $2.3 million of the $4.4 million ransom Colonial Pipeline Co. paid following a May 7 ransomware attack. The DOJ's Ransomware and Digital Extortion Task Force coordinated the effort, in which the FBI tracked payment to a bitcoin wallet it controls.
The recent decision by a Massachusetts-based hospital to pay a ransom in exchange for promises by the attackers to destroy stolen data spotlights the difficult choices many healthcare entities face in the wake of cyberattacks.
Researchers believe that a malware variant that specifically targets poorly protected or misconfigured Windows containers has been uncovered for the first time, according to a report published by Palo Alto Networks' Unit 42. A successful attack establishes a backdoor and persistence.
U.S. Justice Department prosecutors have charged a 55-year-old Latvian woman with helping to develop code for the Trickbot gang as well as stealing banking credentials and deploying ransomware, according to a federal indictment. Alla Witte faces more than 30 years in prison if convicted.
Australian spies should be allowed to take offensive action against some of the world's most prominent ransomware gangs, says Tim Watts, a member of Australia's Parliament who says the move, proposed under the Labor Party's push for a national ransomware strategy, would deter attackers.
A district court in Kazakhstan sentenced two unidentified Cobalt, aka Carbanak, gang members to serve eight years in prison on robbery and attempted robbery charges. The gang members are believed to have been involved in cashing out operations, according to Group-IB.
Investigators have found that ransomware operators gained access to Colonial Pipeline via a VPN account that was no longer used and didn't have two-step verification enabled. The credentials turned up in a data breach, but security researchers say it's unclear if that's how the attackers sourced them.