Content by Mathew J. Schwartz

Data Breach Toll Tied to Clop Group's MOVEit Attack Surges

Mathew J. Schwartz  •  September 25, 2023

The count of organizations affected by the Clop ransomware group's most recent mass targeting of Progress Software's secure file transfer software doubled last week. National Student Clearinghouse warned that data tied to nearly 900 colleges and universities had been stolen from its MOVEit server.

MGM Resorts Says Hotels 'Operating Normally' After Attack

Mathew J. Schwartz  •  September 22, 2023

MGM Resorts International says its hotels and casinos are now operating "normally" after the company was hit by ransomware-wielding attackers. Even so, numerous systems remain offline - including digital room key cards - as the company seeks to rebuild its IT infrastructure.

Canada Confirms DDoS Attack Disrupted Airport Arrival Kiosks

Mathew J. Schwartz  •  September 21, 2023

A recent, brief disruption at Canadian airports is a reminder that Russia-aligned hacking groups' bark remains worse than their bite. Experts say these groups' impact largely remains minimal, which begs the question of how they disrupted arrival kiosks across Canadian airports.

Lessons to Learn From Clop's MOVEit Supply Chain Attacks

Mathew J. Schwartz  •  September 15, 2023

The Clop ransomware group's zero-day attack on MOVEit software was its fourth data theft campaign targeting secure file transfer users. Organizations can combat such attacks by using data minimization and encryption - among other defenses, says Teresa Walsh, global head of intelligence for FS-ISAC.

LokiBot Information Stealer Packs Fresh Infection Strategies

Mathew J. Schwartz  •  September 14, 2023

In Norse mythology, Loki is a cowardly trickster god who can change age, shape and sex. The malware incarnation is more prosaic, tending to focus on stealing Microsoft users' data, at times by using an ancient vulnerability in Microsoft Office that continues to be widespread.

Caesars Entertainment Reportedly Pays Ransom to Attackers

Mathew J. Schwartz  •  September 14, 2023

Hotel and casino giant Caesars Entertainment paid approximately half of an initial $30 million ransom demand to attackers who infected its systems with ransomware, according to news reports. The attackers appear to be with the same group that hit MGM Resorts.

Kubernetes Advises Users to Patch Command Injection Flaws

Mathew J. Schwartz  •  September 13, 2023

Kubernetes is warning all users to immediately update their clusters to the latest version - released Aug. 23 - to patch a trio of critical command injection vulnerabilities attackers can use to remotely execute code. Akamai has released proof-of-concept code for exploiting one of the flaws.

Big MGM Resorts Outage Traces to Ransomware, Researchers Say

Mathew J. Schwartz  •  September 13, 2023

Booking and reservation systems, as well as slot machines, hotel room door locks, ATMs and more remain offline at multiple MGM Resorts properties as the publicly traded casino hotel giant battles "a cybersecurity issue" that one group of security researchers has tied to a ransomware group attack.

Root Admin User: When Do Common Usernames Pose a Threat?

Mathew J. Schwartz  •  September 11, 2023

Honeypot data collected by CISO Jesse La Grew highlights how attackers continue to target default usernames - including for SSH - together with weak passwords to gain brute force remote access to their targets. Here are essential username, password and remote service practices for combating such attacks.

Feds Urge Immediate Patching of Zoho and Fortinet Products

Mathew J. Schwartz  •  September 8, 2023

Multiple nation-state hacking groups have been exploiting known flaws in Zoho ManageEngine software and Fortinet firewalls to steal data, cybersecurity officials warn. A new alert details exploits of each vulnerability by separate groups that targeted the same aeronautical firm.

Tattletale Ransomware Gangs Threaten to Reveal GDPR Breaches

Mathew J. Schwartz  •  September 7, 2023

Ransomware groups do whatever they can to pressure a victim into paying. Enter the likes of Ransomed, following in the footsteps of Alphv/BlackСat, NoEscape and Good Day-powered Cloak, all of which threaten victims with a world of General Data Protection Regulation violation pain unless they pay.

View to a Phish: W3LL Specializes in Microsoft 365 Hacking

Mathew J. Schwartz  •  September 6, 2023

A sophisticated phishing toolkit called W3LL Panel has been used to exploit at least 8,000 endpoints since the middle of last year to perpetrate costly business email compromise schemes, Group-IB reports. Such toolkits help automate the entire life cycle of a BEC attack.

LockBit Breaches Fence Manufacturer

Mathew J. Schwartz  •  September 5, 2023

High-security fence manufacturer Zaun, which supplies military bases and prisons, said its cybersecurity barriers were breached by the LockBit ransomware group, which subsequently leaked stolen data. Zaun blamed the breach on a "rogue Windows 7 PC" connected to a manufacturing machine.

Cybercrime Tremors: Experts Forecast Qakbot Resurgence

Mathew J. Schwartz  •  September 4, 2023

Has the cry of the Qakbot come to an end? While the pernicious, multifunction malware fell quiet last week thanks to Operation "Duck Hunt," lucrative cybercrime operations have a history of rebooting themselves. Rivals also offer ready alternatives to ransomware groups and other criminal users.

Experts Urge Immediate Juniper Firewall and Switch Patching

Mathew J. Schwartz  •  September 1, 2023

Security experts are warning organizations with Juniper Networks SRX firewalls and EX switches to update them immediately to patch multiple vulnerabilities attackers have been targeting to remotely execute code, and which may allow them to pivot to internal networks.