Latest

Business Email Compromise (BEC)

BEC Scams Cost U.S. Companies $300 Million Per Month: Study

Scott Ferguson  •  July 19, 2019

Business email compromise scams are surging, and they're costing U.S. companies a total of more than $300 million a month, according to a recently released analysis by the U.S. Treasury Department. The report pinpoints which sectors are hardest hit by this type of fraud.

Cybercrime

Phishing Attack Aimed at Stealing Payroll Deposits

Marianne Kolbasuk McGee  •  July 19, 2019

A Texas-based healthcare system says hackers unsuccessfully tried to divert employee payroll direct deposits through a phishing attack that also potentially exposed patient data. The incident illustrates how business processes can help avert theft.

Encryption & Key Management

New Audit Finds More Security Vulnerabilities at IRS

Akshaya Asokan  •  July 19, 2019

The Internal Revenue Services' internal financial reporting systems and IT infrastructure have 14 new security vulnerabilities, along with a long list of previously unresolved deficiencies, according to a U.S. Government Accountability Office audit.

Endpoint Security

Researchers Trick Cylance Into Giving Malware a Pass

Jeremy Kirk  •  July 19, 2019

An Australian cybersecurity company says it tricked BlackBerry's Cylance Protect anti-virus product into believing that some of the most pernicious types of malware, including WannaCry and the SamSam ransomware, were benign programs.

Application Security

Tesla Vulnerability: A Bounty Hunter's Tale

Nick Holland  •  July 19, 2019

The latest edition of the ISMG Security Report describes the accidental discovery of a Tesla software vulnerability. Also featured: an analysis of the latest ransomware trends and insights from former federal advisers Richard Clarke and Robert Knake on cyber resilience.

Phishing Scheme Targets Amex Cardholders

Akshaya Asokan  •  July 18, 2019

Researchers have uncovered a new type of phishing campaign that is targeting American Express card users. In these incidents, attackers are sending a hyperlink as part of a phony account update to access the victim's credentials and other account details, according to researchers at the security firm Cofense.

General Data Protection Regulation (GDPR)

Patient Record Snooping Incident Leads to GDPR Fine

Marianne Kolbasuk McGee  •  July 18, 2019

Authorities in the Netherlands recently levied a $516,000 fine under the General Data Protection Regulation against a hospital in the Hague in connection with a data breach involving "dozens" of staffers who snooped on the electronic medical records of a celebrity.

Governance

Despite BlueKeep Warnings, Many Organizations Fail to Patch

Jeffrey Burt  •  July 18, 2019

Weeks after Microsoft issued a patch for the BlueKeep vulnerability, which threatens devices running older versions of Windows, many organizations worldwide have yet to install patches despite alerts from the software giant, government agencies and cybersecurity companies, according to researchers at BitSight.

Cybercrime

Impact of AMCA Breach Continues to Grow

Marianne Kolbasuk McGee  •  July 18, 2019

The impact of the massive American Medical Collection Agency data breach continues to grow. At least two more laboratories have said their patients' data was potentially compromised by the breach. Meanwhile, court filings accuse AMCA of a lack of "cooperation and transparency" in the wake of the incident.

Cybercrime as-a-service

Suspected Rubella Toolkit Mastermind Arrested

Scott Ferguson  •  July 17, 2019

A 20-year-old Dutch man suspected of creating the Rubella Macro Builder toolkit and distributing it on underground forums has been arrested by the Dutch National Police, which received assistance from McAfee. Rubella and other toolkits enable attackers to distribute malware through weaponized Office documents.

Business Continuity Management / Disaster Recovery

Ransomware: As GandCrab Retires, Sodinokibi Rises

Mathew J. Schwartz  •  July 17, 2019

With the GandCrab ransomware-as-service gang promising to retire - and free decryptors now aiding victims - rival Sodinokibi has already stepped into the void, security experts warn. Driven also by attackers wielding Ryuk, Dharma and Phobos, ransom payments by victims have been surging.

Active Defense & Deception

How Deception Technology Is Evolving

Nick Holland  •  July 17, 2019

Deception technology is becoming more sophisticated, enabling organizations to battle against emerging threats, says Alissa Knight, senior analyst at Aite Group, a research and advisory company.