ReportWire

Tag: Ransomware

  • Hackers Behind the Change Healthcare Ransomware Attack Just Received a $22 Million Payment

    Hackers Behind the Change Healthcare Ransomware Attack Just Received a $22 Million Payment

    [ad_1]

    The ransomware attack targeting medical firm Change Healthcare has been one of the most disruptive in years, crippling pharmacies across the US—including those in hospitals—and leading to serious snags in the delivery of prescription drugs nationwide for 10 days and counting. Now, a dispute within the criminal underground has revealed a new development in that unfolding debacle: One of the partners of the hackers behind the attack points out that those hackers, a group known as AlphV or BlackCat, received a $22 million transaction that looks very much like a large ransom payment.

    On March 1, a Bitcoin address connected to AlphV received 350 bitcoins in a single transaction, or close to $22 million based on exchange rates at the time. Then, two days later, someone describing themselves as an affiliate of AlphV—one of the hackers who work with the group to penetrate victim networks—posted to the cybercriminal underground forum RAMP that AlphV had cheated them out of their share of the Change Healthcare ransom, pointing to the publicly visible $22 million transaction on Bitcoin’s blockchain as proof.

    That suggests, according to Dmitry Smilyanets, the researcher for security firm Recorded Future who first spotted the post, that Change Healthcare has likely paid AlphV’s ransom. “You can see the number of coins that landed there. You don’t see that kind of transaction so often,” Smilyanets says. “There’s proof of a large amount landing in the AlphV-controlled Bitcoin wallet. And this affiliate connects this address to the attack on Change Healthcare. So it’s likely that the victim paid the ransom.”

    A spokesperson for Change Healthcare, which is owned by UnitedHealth Group, declined to answer whether it had paid a ransom to AlphV, telling WIRED only that “we are focused on the investigation right now.”

    Both Recorded Future and TRM Labs, a blockchain analysis firm, connect the Bitcoin address that received the $22 million payment to the AlphV hackers. TRM Labs says it can link the address to payments from two other AlphV victims in January.

    If Change Healthcare did pay a $22 million ransom, it would not only represent a huge payday for AlphV, but also a dangerous precedent for the health care industry, argues Brett Callow, a ransomware-focused researcher with security firm Emsisoft. Every ransomware payment, he says, both funds future attacks by the group responsible and suggests to other ransomware predators that they should try the same playbook—in this case, attacking health care services that patients depend on.

    “If Change did pay, it’s problematic,” says Callow. “It highlights the profitability of attacks on the health care sector. Ransomware gangs are nothing if not predictable: If they find a particular sector to be lucrative, they’ll attack it over and over again, rinse and repeat.”

    The self-described AlphV affiliate who first posted evidence of the payment on RAMP, and who goes by the name “notchy,” complained that AlphV had apparently collected the $22 million ransom from Change Healthcare and then kept the entire sum, rather than share the profits with their hacking partner as they had allegedly agreed. “Be careful everyone and stop deal with ALPHV,” notchy wrote.

    [ad_2]

    Andy Greenberg

    Source link

  • Ransomware Groups Are Bouncing Back Faster From Law Enforcement Busts

    Ransomware Groups Are Bouncing Back Faster From Law Enforcement Busts

    [ad_1]

    Six days before Christmas, the US Department of Justice loudly announced a win in the ongoing fight against the scourge of ransomware: An FBI-led, international operation had targeted the notorious hacking group known as BlackCat or AlphV, releasing decryption keys to foil its ransom attempts against hundreds of victims and seizing the dark web sites it had used to threaten and extort them. “In disrupting the BlackCat ransomware group, the Justice Department has once again hacked the hackers,” deputy attorney general Lisa Monaco declared in a statement.

    Two months and one week later, however, those hackers don’t appear particularly “disrupted.” For the last seven days and counting, BlackCat has held hostage the medical firm Change Healthcare, crippling its software in hospitals and pharmacies across the United States, leading to delays in drug prescriptions for an untold number of patients.

    The ongoing outage at Change Healthcare, first reported to be a BlackCat attack by Reuters, represents a particularly grim incident in the ransomware epidemic not just due to its severity, its length, and the potential toll on victims’ health. Ransomware-tracking analysts say it also illustrates how even law enforcement’s wins against ransomware groups appear to be increasingly short-lived, as the hackers that law enforcement target in carefully coordinated busts simply rebuild and restart their attacks with impunity.

    “Because we can’t arrest the core operators that are in Russia or in areas that are uncooperative with law enforcement, we can’t stop them,” says Allan Liska, a ransomware-focused researcher for cybersecurity firm Recorded Future. Instead, Liska says, law enforcement often has had to settle for spending months or years arranging takedowns that target infrastructure or aid victims, but without laying hands on the attacks’ perpetrators. “The threat actors just need to regroup, get drunk for a weekend, and then start right back up,” Liska says.

    In another, more recent bust, the UK’s National Crime Agency last week led a broad takedown effort against the notorious Lockbit ransomware group, hijacking its infrastructure, seizing many of its cryptocurrency wallets, taking down its dark web sites, and even obtaining information about its operators and partners. Yet less than a week later, Lockbit has already launched a fresh dark web site where it continues to extort its victims, showing countdown timers for each one that indicate the remaining days or hours before it dumps their stolen data online.

    None of that means law enforcement’s BlackCat or Lockbit operations haven’t had some effect. BlackCat listed 28 victims on its dark web site for February so far, a significant drop from the 60-plus Recorded Future counted on its site in December prior to the FBI’s takedown. (Change Healthcare isn’t currently listed among BlackCat’s current victims on its site, though the hackers reportedly took credit for the attack, according to ransomware-tracking site Breaches.net. Change Healthcare also didn’t respond to WIRED’s request for comment on the cyberattack.)

    Lockbit, for its part, may be hiding the extent of its disruption behind the bluster of its new leak site, argues Brett Callow, a ransomware analyst at security firm Emsisoft. He says that the group is likely downplaying last week’s bust in part to avoid losing the trust of its affiliate partners, the hackers who penetrate victim networks on Lockbit’s behalf and might be spooked by the possibility that Lockbit has been compromised by law enforcement.

    [ad_2]

    Andy Greenberg

    Source link

  • Notorious ransomware provider LockBit taken over by law enforcement

    Notorious ransomware provider LockBit taken over by law enforcement

    [ad_1]

    Washington — A ransomware service provider that has targeted over 2,000 systems across the globe, including hospitals in the U.S., with demands for hundreds of millions of dollars was taken down Monday, and Russian nationals were charged as part of an international plot to deploy the malicious software, the Justice Department announced Tuesday. 

    Known as LockBit, the network of cybercriminals targets critical components of manufacturing, healthcare and logistics across the globe, offering its services to hackers who deploy its malware into vulnerable systems and hold them hostage until a ransom is paid. The attackers have so far extorted more than $120 million from their victims, officials said, and their program has evolved into one of the most notorious and active.

    As part of this week’s operation, the FBI and its law enforcement partners in the United Kingdom seized numerous public-facing platforms where cybercriminals could initiate contact with and join LockBit. Investigators also seized two servers in the U.S. that were used to transfer stolen victim data. 

    The front page of LockBit’s site has been replaced with the words “this site is now under control of law enforcement,” alongside the flags of the U.K., the U.S. and several other nations, the Associated Press noted.

    Take down notice issued by a group of global intelligence to Lockbit
    A screenshot from Feb. 19, 2024 shows a take down notice that a group of global intelligence agencies issued to a dark web site called Lockbit.

    Handout via Reuters


    According to Attorney General Merrick Garland, the U.S. and its allies went “a step further” by obtaining the “keys” that can unlock attacked computer systems to help victims “regain access to their data,” releasing them from having to pay a ransom. The move could help hundreds of victims worldwide. 

    Two Russian nationals who allegedly used LockBit’s ransomware against companies across the U.S. — in Oregon, New York, Florida and Puerto Rico — were also indicted in New Jersey as part of the Justice Department’s latest play against the group. 

    Artur Sungatov and Ivan Kondratyev joined a growing number of defendants accused by federal prosecutors of attacking American institutions as part of the LockBit scheme. A total of five have now been charged, including an individual who allegedly targeted Washington, D.C.’s police force. 

    LockBit was the most commonly used version of ransomware in 2022, according to a joint cybersecurity advisory published by the FBI and the Cybersecurity and Infrastructure Security Agency last year, and targeted an “array of critical infrastructure sectors, including financial services, food and agriculture, education, energy, government and emergency services, healthcare, manufacturing, and transportation.” 

    The LockBit network was first seen on Russian-speaking cybercrime platforms in 2020 and continued to evolve and grow, targeting computer platforms and various operating systems. By 2022, 16% of ransomware attacks in the U.S. were deployed by the LockBit group, according to the advisory. 

    Criminals conventionally gain access to vulnerable systems through phishing emails or when users visit an infected site while browsing the internet. And U.S. officials consistently warn users to avoid paying ransoms and instead contact law enforcement.

    Federal investigators have recently developed a new approach to combat ransomware attacks that can be both costly to victims and damaging to the normal functioning of society: arming victims with the tools necessary to counter a malware attack. 

    Similar to the LockBit operation, in July 2022, the FBI toppled an international ransomware group called Hive and collected decryption keys for its penetrated computer networks it had breached to conduct what officials called a “21st-century high-tech cyber stakeout.” FBI agents then distributed the keys to the victims whose networks were being ransomed. 

    And in August, investigators took down a criminal network known as the Qakbot botnet — a grouping of computers infected by a malware program that was used to carry out cyberattacks. Law enforcement gained access to the QakBot infrastructure and “redirected” the cyber activity to servers controlled by U.S. investigators, who were then able to inject the malware with a program that released the victim computer from the botnet, freeing it of the malicious host. 

    Victims of LockBit attacks are encouraged to contact the FBI for further assistance. 

    Robert Legare

    Robert Legare is a CBS News multiplatform reporter and producer covering the Justice Department, federal courts and investigations. He was previously an associate producer for the “CBS Evening News with Norah O’Donnell.”

    [ad_2]

    Source link

  • How to Not Get Scammed Out of $50,000

    How to Not Get Scammed Out of $50,000

    [ad_1]

    Plus: State-backed hackers test out generative AI, the US takes down a major Russian military botnet, and 100 hospitals in Romania go offline amid a major ransomware attack.

    [ad_2]

    Andrew Couts

    Source link

  • Why are ransomware gangs making so much money? | TechCrunch

    Why are ransomware gangs making so much money? | TechCrunch

    [ad_1]

    For many organizations and startups, 2023 was a rough year financially, with companies struggling to raise money and others making cuts to survive. Ransomware and extortion gangs, on the other hand, had a record-breaking year in earnings, if recent reports are anything to go by.

    It’s hardly surprising when you look at the state of the ransomware landscape. Last year saw hackers continue to evolve their tactics to become scrappier and more extreme in efforts to pressure victims into paying their increasingly exorbitant ransom demands. This escalation in tactics, along with the fact that governments have stopped short of banning ransom payments, led to 2023 becoming the most lucrative year yet for ransomware gangs.

    The billion-dollar cybercrime business

    According to new data from crypto forensics startup Chainalysis, known ransomware payments almost doubled in 2023 to surpass the $1 billion mark, calling the year a “major comeback for ransomware.”

    That’s the highest figure ever observed, and almost double the amount of known ransom payments tracked in 2022. But Chainalysis said the actual figure is likely far higher than the $1.1 billion in ransom payments it has witnessed so far.

    There’s a glimmer of good news, though. While 2023 was overall a bumper year for ransomware gangs, other hacker-watchers observed a drop in payments toward the end of the year.

    This drop is a result of improved cyber defenses and resiliency, along with the growing sentiment that most victim organizations don’t trust hackers to keep their promises or delete any stolen data as they claim. “This has led to better guidance to victims and fewer payments for intangible assurances,” according to ransomware remediation company Coveware.

    Record-breaking ransoms

    While more ransomware victims are refusing to line the pockets of hackers, ransomware gangs are compensating for this drop in earnings by increasing the number of victims they target.

    Take the MOVEit campaign. This huge hack saw the prolific Russia-linked Clop ransomware gang mass-exploit a never-before-seen vulnerability in the widely used MOVEit Transfer software to steal data from the systems of more than 2,700 victim organizations. Many of the victims are known to have paid the hacking group in efforts to prevent the publication of sensitive data.

    While it’s impossible to know exactly how much money the mass-hack made for the ransomware group, Chainalysis said in its report that Clop’s MOVEit campaign amassed over $100 million in ransom payments, and accounted for almost half of all ransomware value received in June and July 2023 during the height of this mass-hack.

    MOVEit was by no means the only money-making campaign of 2023.

    In September, casino and entertainment giant Caesars paid roughly $15 million to hackers to prevent the disclosure of customer data stolen during an August cyberattack.

    This multimillion-dollar payment perhaps illustrates why ransomware actors continue to make so much money: the Caesars attack barely made it into the news, while a subsequent attack on hotel giant MGM Resorts — which has so far cost the company $100 million to recover from — dominated headlines for weeks. MGM’s refusal to pay the ransom led to the hackers’ release of sensitive MGM customer data, including names, Social Security numbers and passport details. Caesars — outwardly at least — appeared largely unscathed, even if by its own admission could not guarantee that the ransomware gang would delete the company’s stolen data.

    Escalating threats

    For many organizations, like Caesars, paying the ransom demand seems like the easiest option to avoid a public relations nightmare. But as the ransom money dries up, ransomware and extortion gangs are upping the ante and resorting to escalating tactics and extreme threats.

    In December, for example, hackers reportedly tried to pressure a cancer hospital into paying a ransom demand by threatening to “swat” its patients. Swatting incidents rely on malicious callers falsely claiming a fake real-world threat to life, prompting the response of armed police officers.

    We also saw the notorious Alphv (known as BlackCat) ransomware gang weaponize the U.S. government’s new data breach disclosure rules against MeridianLink, one of the gang’s many victims. Alphv accused MeridianLink of allegedly failing to publicly disclose what the gang called “a significant breach compromising customer data and operational information,” for which the gang took credit.

    No ban on ransom payments

    Another reason ransomware continues to be lucrative for hackers is that while not advised, there’s nothing stopping organizations paying up — unless, of course, the hackers have been sanctioned.

    To pay or not to pay the ransom is a controversial subject. Ransomware remediator Coveware suggests that if a ransom payment ban was imposed in the U.S. or any other highly victimized country, companies would likely stop reporting these incidents to the authorities, reversing past cooperation between victims and law enforcement agencies. The company also predicts that a ransom payments ban would lead to the overnight creation of a large illegal market for facilitating ransomware payments.

    Others, however, believe a blanket ban is the only way to ensure ransomware hackers can’t continue to line their pockets — at least in the short term.

    Allan Liska, a threat intelligence analyst at Recorded Future, has long opposed banning ransom payments — but now believes that for as long as ransom payments remain lawful, cybercriminals will do whatever it takes to collect them.

    “I’ve resisted the idea of blanket bans on ransom payments for years, but I think that has to change,” Liska told TechCrunch. “Ransomware is getting worse, not just in the number of attacks but in the aggressive nature of the attacks and the groups behind them.”

    “A ban on ransom payments will be painful and, if history is any guide, will likely lead to a short-term increase in ransomware attacks, but it seems like this is the only solution that has a chance of long-term success at this point,” said Liska.

    While more victims are realizing that paying the hackers cannot guarantee the safety of their data, it’s clear that these financially motivated cybercriminals aren’t giving up their lavish lifestyles anytime soon. Until then, ransomware attacks will remain a major money-making exercise for the hackers behind them.

    Read more on TechCrunch:

    [ad_2]

    Carly Page

    Source link

  • Citrix software bug leads to outages at 60 credit unions

    Citrix software bug leads to outages at 60 credit unions

    [ad_1]

    Digital banking functions at approximately 60 credit unions have been interrupted by a ransomware attack on a third-party service provider, but there is no evidence that consumer data has been misused, according to the company whose system was compromised.

    Ongoing Operations, a credit union information-technology firm, says it experienced a cybersecurity incident on Nov. 26. Ongoing Operations added that it has “no evidence of any misuse of information,” although it is “reviewing the impacted data to determine exactly what information was impacted and to whom that information belonged.”

    Neither Ongoing Operations nor its parent company, Trellance, responded to requests for comment.

    A spokesman for the National Credit Union Administration confirmed the number of affected entities in a statement Tuesday, adding that the regulatory agency is “in close contact with affected credit unions.” He also said member deposits at affected federally insured credit unions are covered up to $250,000.

    The incident was a ransomware attack, according to a Nov. 30 statement from Maggie Pope, the CEO of Mountain Valley Federal Credit Union in Peru, New York. Pope said the next day that online banking and bill-pay services had been interrupted by the attack, but members could still use their debit cards and get cash from ATMs or in a branch. Online banking remains down for the credit union.

    The core-banking software provider FedComp notified Mountain Valley of the attack against Trellance, according to Pope. FedComp did not respond to a request for comment.

    FedComp’s own services appear to have been disrupted by the attack. Its data center was “experiencing technical difficulties and is under a country wide outage,” according to a notice on the company’s website Nov. 30 that was later removed but is still visible as a Google cached file.

    FedComp said at the time that “Trellance is still working on resolving the issue.” FedComp has not clarified whether its data center is still disrupted, but one credit union said Tuesday it expected to regain access to its own FedComp server “soon.”

    The credit union, NY Bravest Federal Credit Union, serves New York firefighters and is based in Albany. It uses FedComp’s core-banking services and has been affected by the attack against Trellance. NY Bravest was anticipating an estimate on Tuesday regarding when its services would return, according to a notice on its website.

    NY Bravest told members it “went above and beyond” in responding to the outage to ensure members “felt as little disruption as possible,” claiming the credit union built its own database after the disruption to give staff and members who reached out to the credit union up-to-date balances.

    “While the other credit unions that were affected by this outage sat and waited, NY Bravest FCU went above and beyond and ensured members felt as little disruption as possible,” the credit union’s notice said.

    Before the ransomware attack, Ongoing Operations had failed to patch a vulnerability in the cloud-networking software NetScaler, according to Kevin Beaumont, a cybersecurity researcher who until October served as head of cybersecurity operations at the telecommunications company Vodafone.

    Cloud Software Group, the company that owns NetScaler, warned users on Oct. 10 about the NetScaler vulnerability, later dubbed Citrix Bleed, saying it could result in “unauthorized data disclosure.” Cloud Software Group provided information about how to patch the vulnerability with the announcement.

    On a 0 to 10 scale used to rate the severity of cybersecurity vulnerabilities, Citrix rated the NetScaler vulnerability a 9.4, which is at the high end of the scale.

    On Oct. 23, Cloud Software Group followed up by saying it had reports of “targeted attacks” exploiting the Citrix Bleed vulnerability. A month later, on Nov. 21, federal agencies including the FBI warned that the ransomware group LockBit and its affiliates had been exploiting Citrix Bleed, emphasizing that the move could allow bad actors to “bypass password requirements and multifactor authentication.”

    Ongoing Operations is not the only firm that appears to have neglected these warnings about Citrix Bleed. An attack last month against the U.S. arm of the Industrial and Commercial Bank of China (ICBC), which prevented some U.S. debt brokers from conveying trade contracts, also stemmed from the Citrix Bleed vulnerability, according to a report by The Wall Street Journal.

    For his part, Beaumont pointed out multiple pathways for preventing vulnerabilities like Citrix Bleed and the fallout they can produce, including having software vendors better secure their products and outlawing ransom payments. At the moment, he said, ransomware actors — often teenagers receiving huge sums of money in ransom payments — are far more powerful than they ought to be thanks to companies accepting ransomware attacks as somewhat normal.

    “We shouldn’t have normalized ransomware like we have, especially given the escalating nature of the problem,” Beaumont said.

    [ad_2]

    Carter Pape

    Source link

  • China’s ICBC, the world’s biggest bank, hit by cyberattack that reportedly disrupted Treasury markets

    China’s ICBC, the world’s biggest bank, hit by cyberattack that reportedly disrupted Treasury markets

    [ad_1]

    A pedestrian walks pass a branch of Industrial & Commercial Bank of China (ICBC) in Fuzhou, Fujian province of China.

    VCG | Getty Images

    The U.S. financial services division of Chinese bank ICBC was hit with a cyberattack that reportedly disrupted the trading of Treasurys.

    Industrial and Commercial Bank of China, the world’s largest lender by assets, said Thursday that its financial services arm, called ICBC Financial Services, experienced a ransomware attack “that resulted in disruption to certain” systems.

    Immediately after discovering the hack, ICBC “isolated impacted systems to contain the incident,” the state-owned bank said.

    Ransomware is a type of cyberattack. It involves hackers taking control of systems or information and only letting them go once the victim has paid a ransom. It’s a type of attack that has seen an explosion in popularity among bad actors in recent years.

    ICBC did not reveal who was behind the attack but said it has been “conducting a thorough investigation and is progressing its recovery efforts with the support of its professional team of information security experts.”

    The Chinese bank also said it is working with law enforcement.

    ICBC said it “successfully cleared” U.S. Treasury trades executed Wednesday and repo financing trades done on Thursday. A repo is a repurchase agreement, a type of short-term borrowing for dealers in government bonds.

    However, multiple news outlets reported there was disruption to U.S. Treasury trades. The Financial Times, citing traders and banks, said Friday that the ransomware attack prevented the ICBC division from settling Treasury trades on behalf of other market participants.

    The U.S. Treasury Department told CNBC: “We are aware of the cybersecurity issue and are in regular contact with key financial sector participants, in addition to federal regulators. We continue to monitor the situation.”

    ICBC said the email and business systems of its U.S. financial services arm operate independently of ICBC’s China operations. The systems of its head office, the ICBC New York branch, and other domestic and overseas affiliated institutions were not affected by the cyberattack, ICBC said.

    What did the Chinese government say?

    Wang Wenbin, spokesperson for China’s Ministry of Foreign Affairs, said Friday that ICBC is striving to minimize the impact and losses after the attack, according to a Reuters report.

    Speaking at a regular news conference, Wang said ICBC has paid close attention to the matter and has handled the emergency response and supervision well, according to Reuters.

    What do we know about the ransomware attack?

    Nobody has claimed responsibility for the attack yet and ICBC has not said who might be behind the attack.

    In the cybersecurity world, finding out who is behind a cyberattack is often very difficult due to the techniques hackers use to mask their locations and identities.

    But there are clues about what kind of software was used to carry out the attack.

    Marcus Murray, founder of Swedish cybersecurity firm Truesec, said the ransomware used is called LockBit 3.0. Murray said this information has come from sources with relations to Truesec, but was unable to reveal who those sources are due to confidentiality reasons. The Financial Times reported, citing two sources, that LockBit 3.0 was the software behind the attack too. CNBC was unable to independently verify the information.

    This kind of ransomware can make its way into an organization in many ways. For example, by someone clicking on a malicious link in an email. Once in, its aim is to extract sensitive information about a company.

    VMWare cybersecurity team said in a blog last year that LockBit 3.0 is a “challenge for security researchers because each instance of the malware requires a unique password to run without which analysis is extremely difficult or impossible.” The researchers added that the ransomware is “heavily protected” against analysis.

    The U.S. government’s Cybersecurity and Infrastructure Security Agency calls LockBit 3.0 “more modular and evasive,” making it harder to detect.

    LockBit is the most popular strain of ransomware, accounting for around 28% of all known ransomware attacks from July 2022 to June 2023, according to data from cybersecurity firm Flashpoint.

    What is LockBit?

    The LockBit is the group behind the software. Its business model is known as “ransomware-as-a-service.” It effectively sells its malicious software to other hackers, known as affiliates, who then go on to carry out the cyberattacks.

    The leader of the group goes by the online name of “LockBitSup” on dark web hacking forums.

    “The group primarily posts in Russian and English, but according to its website, the group claims to be located in the Netherlands and to not be politically motivated,” Flashpoint said in a blogpost.

    The group’s malware is known to target small and medium-sized businesses.

    LockBit has previously claimed responsibility for ransomware attacks on Boeing and the U.K’s. Royal Mail.

    In June, the U.S. Department of Justice charged a Russian national for his involvement in “deploying numerous LockBit ransomware and other cyberattacks” against computers in the U.S., Asia, Europe and Africa.

    “LockBit actors have executed over 1,400 attacks against victims in the United States and around the world, issuing over $100 million in ransom demands and receiving at least as much as tens of millions of dollars in actual ransom payments made in the form of bitcoin,” the DOJ said in a press release in June.

    — CNBC’s Steve Kopack contributed to this article.

    [ad_2]

    Source link

  • A Cybersecurity Expert Reveals Why You’re a Cybercriminal’s Next Target — and 5 Things You Can Do to Beef Up Your Defense. | Entrepreneur

    A Cybersecurity Expert Reveals Why You’re a Cybercriminal’s Next Target — and 5 Things You Can Do to Beef Up Your Defense. | Entrepreneur

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    If your company was hit by ransomware today, who would you call? Or perhaps a better question: How would you call them? It sounds absurd, but as a cybersecurity expert, I’ve seen organizations paralyzed in the first hours after an incident simply because nobody knows anyone’s cell number anymore. Without access to email or messaging systems, communication grinds to a halt and workers, customers and suppliers are all left wondering what is going on. Panic rapidly escalates into a crisis.

    There’s a tendency to think about cybersecurity as being the responsibility of the IT or security department. But protecting your company comes down to two things: organizational culture and planning. That’s why some of the most important people on cyber defense aren’t in the IT team — they’re in human resources.

    The HR team is uniquely placed to embed cybersecurity preparedness into the everyday working of an organization. It’s responsible for building the policies and processes to mitigate risks and ensure the business has the competencies to be resilient to foreseeable challenges — and those include cyberattacks. And as the custodians of employees’ sensitive personal information, HR teams are themselves prime targets for hackers.

    Unfortunately, this vital role is often overlooked. So here are five ways HR can help make your business a tough target for cybercriminals.

    Related: 78% of Employers Are Using Remote Work Tools to Spy on You. Here’s a More Effective (and Ethical) Approach to Tracking Employee Productivity.

    Build a cybersecurity culture

    Eternal vigilance is the price of our liberty to roam the internet. The number of threats is mind-blowing — a recent report found the average education institution faces more than 2,300 attempts to breach its systems in a week, while healthcare organizations fend off more than 1,600 attacks. With so many digital grenades being lobbed, it’s incredibly hard to catch them all. However, a strong cybersecurity culture helps an organization defend against attacks and limits the blast radius when one does get through. The tough part: Everyone has to be on the same page when it comes to online behaviors.

    Step one is to ensure you have the training tools so that employees know what they should and should not be doing. Most organizations are reasonably good at this. Whereas, many fall short by not putting that information into practice every day.

    The best way to ensure that everyone considers cybersecurity a fundamental part of their responsibilities is to build it into performance reviews. This should not take the form of calling out workers for every dodgy link they click on. Instead, it should be a constructive conversation about how they’re keeping up with their cyber literacy training. There are cyber health-check tools that workers can use to analyze their online behavior and address weaknesses (like reusing Pa$$w0rd across half the internet or not using two-factor authentication) and often these can be used to track progress toward cybersecurity goals at an organizational level.

    When safety precautions are regularly discussed, they just become part of how you do business.

    Protect your crown jewels

    HR has custody of some of the most sensitive information in an organization — and hackers know this. In the past five years or so, many companies have adopted platforms that enable employees to self-serve routine tasks like vacation requests. However, third-party platforms come with risks. Hackers target them in so-called supply chain attacks, knowing that if they get lucky, they can access troves of information from multiple companies. In 2021, more than 300 organizations were breached in a hack of a widely used file transfer system. One of these was the University of California, which said the information exposed included employees’ social security numbers, driver’s licenses and passport details (the UC system offered its staff free ID monitoring services).

    Job one for HR professionals is to ensure employee data remains confidential. Perform extensive due diligence before your organization signs up for any third-party HR service. Only consider companies that comply with international standards (SOC 2 and ISO 27001 are the main ones to look out for) and check online for reports of security incidents at the site in the past few years. Also, look into where your data is being stored and how it is being backed up. Depending on your location and industry, you may have to comply with data residency laws.

    Stop hoarding data

    Updating the data retention policy should be on the to-do list of every HR department. I say updating because every company has a data retention policy whether they know it or not. If yours isn’t written down, then your policy is simply to keep everything forever. And that exposes you to considerable risk. The more data you have, the worse a breach can be — it’s especially bad if you’re hoarding data you no longer need. Many jurisdictions have limits on how long companies should retain sensitive information — it’s often around seven years for records on former employees.

    Figure out who will call the shots when a breach happens

    Cybersecurity may be everyone’s day-to-day responsibility, but when an attack gets through there should be one person in charge of the response. In cybersecurity lingo, we call this the incident commander. While everyone can have an opinion on the best course of action, decision-making power rests with them.

    The job spec for incident commander only has one line: It’s whoever best understands cybersecurity issues in your organization. Depending on the size of your business, that might be a cybersecurity leader, the head of IT or it could be Joanne in accounting who took a few courses on this stuff. Whoever it is, make sure you’ve identified them before an incident happens and have clearly communicated that to your team. Once a cybersecurity incident happens, events move quickly — in one case I was involved in, the hackers gave a 45-minute warning before starting to post sensitive information — so you don’t want to waste time figuring out who’s in charge.

    Run some drills

    Planning is only one half of the equation. Practice is the other. Plenty of research has shown that people don’t think clearly in stressful situations. We perform drills for fires and earthquakes to give us a framework to fall back on in an emergency. The same idea works for cybersecurity incidents. Set aside two hours once a year to run a tabletop exercise with key staff that simulates what you’ll do if the company is hacked. In these exercises, someone takes the role of a moderator to explain the nature of the attack and what’s been affected, while everyone else plays out how they’d respond.

    The first time you conduct the exercise, it’ll likely be a mess — but that’s the point. The scramble to figure things out will reveal the gaps in your plans. Over time, the drills will become second nature.

    Related: So, You’ve Been Hacked. These are the Best Practices for Business Leaders Post-Hack

    And write contact information down — on paper

    Put the incident team’s phone numbers down on paper and update the list regularly. Yes, it’s old school. Yes, it’s annoying. And yes, one day you’ll be thankful you did.

    [ad_2]

    Claudette McGowan

    Source link

  • ‘Bulletproof’ hosting site that allegedly enabled 400 ransomware attacks seized, founder indicted

    ‘Bulletproof’ hosting site that allegedly enabled 400 ransomware attacks seized, founder indicted

    [ad_1]

    FBI Director Christopher Wray testifies before a House Judiciary Committee hearing on “oversight of the Federal Bureau of Investigation” and alleged politicization of law enforcement, on Capitol Hill in Washington, U.S., July 12, 2023.

    Jonathan Ernst | Reuters

    The mastermind behind a ransomware hosting service that allegedly helped criminals collect more than 5,000 bitcoin in ransom from hundreds of victims was indicted in federal court this week, prosecutors announced Thursday. At current prices, that bitcoin would be worth more than $146 million.

    Artur Grabowski’s LolekHosted service operated for about a decade and advertised itself as a haven for “everything but child porn,” according to Florida prosecutors. Clients allegedly used the hosting service to deploy ransomware viruses that infected around 400 networks around the world. Ransomware attacks typically lock and encrypt the data on an organization’s computers so they’re unusable until the victim pays a fee.

    Grabowski and his co-conspirators allegedly refused to cooperate with law enforcement requests, protected allegedly criminal actors from takedowns, and profited immensely from the service.

    Grabowski was charged with computer fraud, wire fraud, and conspiracy to commit international money laundering.

    Grabowski himself is also the subject of a $21.5 million seizure order.

    The indictment against the Grabowski was unsealed in Florida court Wednesday. Grabowski remains at large.

    Three other unindicted and unnamed co-conspirators were also involved in the alleged scheme, prosecutors said in the charging document.

    His “100% privacy hosting” service was seized Tuesday by the IRS’ Criminal Investigation unit and the Federal Bureau of Investigation. Grabowski, a Polish national, faces a maximum sentence of 45 years, if he is ever detained and convicted.

    Federal prosecutors have stepped up their efforts to curtail ransomware attacks. Earlier this year, the Justice Department launched a dedicated unit focused on combating cyber national security threats.

    A string of ransomware prosecutions have also been unsealed in U.S. courts, although with perpetrators scattered around the world, it’s unclear how many will face time behind bars.

    WATCH: Ransomware attacks have surged 20%, CEO says

    [ad_2]

    Source link

  • ThreatHunter.ai Launches Comprehensive FIVE EYES Solution to Revolutionize Cybersecurity

    ThreatHunter.ai Launches Comprehensive FIVE EYES Solution to Revolutionize Cybersecurity

    [ad_1]

    ThreatHunter.ai is proud to announce the launch of its comprehensive FIVE EYES cybersecurity solution, designed to provide complete coverage and protection against all manner of threats

    Press Release
    –

    Mar 14, 2023 21:00 EDT


    BREA, Calif., March 14, 2023 (Newswire.com)
    –
    Leading cybersecurity firm ThreatHunter.ai has announced the launch of its comprehensive FIVE EYES solution, a cutting-edge approach to cybersecurity that provides unparalleled protection to organizations. FIVE EYES represents the most comprehensive and advanced suite of cybersecurity services on the market, utilizing the latest advancements in AI, machine learning, and human expertise to provide complete coverage and protection against even the most sophisticated threats.

    The FIVE EYES solution is built on a foundation of five core components: First Eyes, More Eyes, Extra Eyes, Secret Eyes, and Private Eyes. 

    • First Eyes helps businesses without robust cybersecurity programs to manage potential risks and protect against cyber attacks, providing an essential supplement to their existing cybersecurity measures.
    • More Eyes offers advanced capabilities for threat detection and response, including 24/7 monitoring and dedicated cybersecurity experts to manage potential threats.
    • Extra Eyes provides businesses with real-time mitigation and hands-on support, including MSSP services and vCISO programs, to help them manage potential cyber threats.
    • Secret Eyes offers businesses a live threat feed of intelligence, specific and unique to each customer, providing an unmatched level of protection against cyber threats.
    • Private Eyes offers dark web monitoring and customized threat intelligence, helping businesses to keep track of data that may have leaked and protecting them from reputational and financial damage.

    “At ThreatHunter.ai, we believe that cybersecurity is more than just a series of tools and technologies,” said CEO James McMurry. “It’s about combining advanced AI and machine learning with expert human threat hunters to deliver a comprehensive solution that truly provides complete coverage and protection. That’s what the FIVE EYES solution is all about.”

    ThreatHunter.ai’s FIVE EYES solution is available now, and interested organizations can contact the company for more information.

    About Threathunter.ai

    ThreatHunter.ai, a 100% Service-Disabled Veteran Owned Small Business, is a leading provider of AI-driven threat hunting solutions. Its advanced machine learning algorithms and expert analysis help organizations detect, identify, and respond to cyber threats. Its solutions are designed to supplement existing security resources and provide a fresh perspective on how to address today’s complex cyber threats.

    For more information about ThreatHunter.ai and the “Five Eyes” program, please visit www.threathunter.ai/eyes-platform.

    Source: ThreatHunter.ai

    [ad_2]

    Source link

  • Ransomware hacking campaign targets Europe and North America, Italy warns 

    Ransomware hacking campaign targets Europe and North America, Italy warns 

    [ad_1]

    Italy’s National Cybersecurity Agency (ACN) warned on Sunday of a large-scale campaign to spread ransomware on thousands of computer servers across Europe and North America. 

    France, Finland and Italy are the most affected countries in Europe at the moment, while the U.S. and Canada also have a high number of targets, the ACN warned, according to Italian news agency ANSA. 

    The attack targets vulnerabilities in VMware ESXi technology that were previously discovered but that still leave many organizations vulnerable to intrusion by hackers.

    “These types of servers had been targeted by hackers in the past due to their vulnerability,” according to ACN. “However, this vulnerability of the server was not completely fixed, leaving an open door to hackers for new attacks.”

    France was the first country to detect the attack, according ANSA. 

    The French cybersecurity agency ANSSI on Friday released an alert to warn organizations to patch the vulnerability.

    It is estimated that thousands of computer servers have been compromised around the world, and according to analysts the number is likely to increase. Experts are warning organizations to take action to avoid being locked out of their systems.  

    [ad_2]

    Elena Giordano

    Source link

  • Madison County Circuit Clerk’s Office Chooses NETArchive From Alliance Storage Technologies

    Madison County Circuit Clerk’s Office Chooses NETArchive From Alliance Storage Technologies

    [ad_1]

    NETArchive Protects Madison County Circuit Clerk’s Court Records with Fast, Secure Data Archiving and High Availability Replication

    Press Release
    –


    updated: Jul 11, 2018


    COLORADO SPRINGS, Colo., July 11, 2018 (Newswire.com)
    –
    Alliance Storage Technologies, the leading provider of hybrid cloud data archiving solutions, announces a customer win at Madison County Circuit Clerk’s Office in Madison County, Illinois, responsible for filing, recording and certifying state and local court cases and related court documents. Multiple Alliance Professional Archiving Systems are now installed to meet their requirements to protect, secure and ensure immediate and continued access to court data.

    With a new State of Illinois mandate requiring that civil court records are electronically stored and available for real-time access, the Circuit Clerk’s Office was concerned that the potential for added workload might overwhelm their existing data archiving infrastructure. It was imperative that sub-second access is provided to court records while ensuring that their IBM iSeries server is not overwhelmed and that access to archive data be distributed to the archive storage tier. The Circuit Clerk’s Office had to simultaneously ensure that if a Disaster Recovery event should occur, that they could be back up and running in minutes.

    Access times have been greatly improved. Where data access previously required direct media access, taking 20 seconds on average, it is now virtually instantaneous. By utilizing the NETArchive’s RAID storage tier to cache our archived court records, we have ensured that we can meet Illinois State mandates requiring online access to digitized records in an exceptionally timely manner. Importantly, we have also ensured no additional impact to the iSeries System performance by distributing I/O workload to the NETArchive system.

    Brian Davis, Manager Application Support of The Madison County Circuit Court Office

    The solution consists of a NETArchive S10 Network Attached Storage (NAS) which is the primary active archive, with a fully integrated high-performance server, large RAID capacity, I/O backplane to support the increased workloads and Sony’s Optical Disk Archive technology providing highly scalable optical capacities of up to 1.6 PBytes with groundbreaking optical drive I/O performance. The Circuit Clerk’s existing UDO Archive Appliance, in service for 10 years, will now act as the passive high availability system in the replication pair. With all original data being easily synchronized (replicated) between the two systems, they are ready for immediate failover should it be required. This integrates seamlessly with the JANO® Justice Case Management System running on their IBM iSeriesTM Server.

    “Access times have been greatly improved,” said Brian Davis, Manager Application Support of The Madison County Circuit Court Office. “Where data access previously required direct media access, taking 20 seconds on average, it is now virtually instantaneous. By utilizing the NETArchive’s RAID storage tier to cache our archived court records, we have ensured that we can meet Illinois State mandates requiring online access to digitized records in an exceptionally timely manner. Importantly, we have also ensured no additional impact to the iSeries System performance by distributing I/O workload to the NETArchive system.”

    To maximize their ROI, the existing UDO Archive Appliance was implemented as the passive system in the high availability replication pair. The Madison County Circuit Courts Office is now prepared to rapidly respond to any disaster event including cyber attacks such as ransomware. “Installation of the NETArchive with continued usage of the UDO Archive Appliance has allowed us to make the most of our previous investments and fully meet the challenges and goals we identified,” said Brian Davis of the Circuit Court Office.

    “The NETArchive hybrid cloud data archiving solution offers compliant long-term data retention, an unmatched level of data durability and security, with a permanent WORM compliant copy of last resort backed by a 100-plus-year media warranty,” said Chris Carr, CEO, Alliance Storage Technologies. “Incorporating optional enterprise features for data archiving and data protection such as AES-256 data encryption with integrated key management, industry-standard access authentication, built-in data backup and recovery options, and high-availability data replication, NETArchive meets the needs of the most demanding data archiving environments.”

    About Madison County Circuit Clerk’s Office

    The Madison County Circuit Clerk’s Office mission is to file and process state and local court cases, maintain and certify court records, store court exhibits, clerk trials and process all paper records for the courts. In a typical year, over 65,000 cases are filed and managed by the Madison County Circuit Clerk’s office, located in the State of Illinois.

    About Alliance Storage Technologies

    Alliance Storage Technologies Inc. is the leading provider of cloud and optical data archiving solutions. The company’s flagship product, NETArchive® gives organizations the most reliable, unalterable, secure archive that protects data for decades not just years. Alliance’s solutions are trusted by thousands of businesses worldwide and meet the most stringent regulatory requirements with game-changing performance and efficiency at an unrivaled price, so customers can actively archive, manage, optimize and secure critical information assets with confidence.

    For more information, visit http://www.alliancestoragetechnologies.com or call 719-593-7900.

    Media Contact: 
    Marketing Director 
    Phone: 719.593.7900 
    Email: Marketing@astiusa.com

    Follow us on:

    LinkedIn – Alliance Storage Technologies Inc.

    Twitter – @AllianceStorage  #NETArchive

    Source: Alliance Storage Technologies Inc.

    [ad_2]

    Source link