Top 10 tools used by ransomware groups during 2021 attacks (Source: Group-IB)

Ransomware Attack Vectors: RDP and Phishing Still Dominate

Mathew J. Schwartz • May 19, 2022

Attackers who successfully infect targets with ransomware primarily first gain access by exploiting poorly secured remote desktop protocol or VPN connections or by using malware-laden phishing emails, reports security firm Group-IB, based on more than 700 attacks it investigated in 2021.

3rd Party Risk Management

Late-Stage Startups Feel the Squeeze on Funding, Valuations

Latest

Endpoint Detection & Response (EDR)

Palo Alto CEO: Vendor Consolidation is Fueling Our Growth

Michael Novinson • May 19, 2022

Palo Alto Networks' product portfolio is paying dividends as customers look to reduce their vendor footprint, says CEO Nikesh Arora. He says despite pressures in the global economy, enterprises aren't currently stressing about their IT budgets.

Fraud Management & Cybercrime

2 Health Plans Report Major Breaches Following Attacks

Marianne Kolbasuk McGee • May 19, 2022

Two recent apparent ransomware attacks on health plans have potentially affected hundreds of thousands of individuals. One of the incidents allegedly involved the Conti ransomware group, and the other allegedly involved Hive. One of the health plans is already facing legal fallout.

Critical Infrastructure Security

Ransomware Ecosystem: Big Changes Since Colonial Pipeline

Anna Delaney • May 19, 2022

The latest edition of the ISMG Security Report analyzes the changes in the ransomware landscape one year after the attack on Colonial Pipeline. It also revisits the Ryuk ransomware attack on a school district in Illinois and examines common culprits hindering effective Zero Trust adoption.

3rd Party Risk Management

Victim List in EHR Vendor Hack Grows as New Details Emerge

Marianne Kolbasuk McGee • May 18, 2022

The list of ophthalmology practices and the number of individuals affected by a December hacking incident at a cloud-based electronic health records vendor, which resulted in deleted databases, are growing as more details about the attack slowly emerge.

Cybercrime

North Korean IT Workers Using US Salaries to Fund Nukes

Prajeet Nair • May 18, 2022

North Korean information technology workers have been attempting to obtain employment in public and private sectors in the United States to fund their home country's weapons of mass destruction and ballistic missiles programs, according to an advisory from U.S. federal agencies.

Blockchain & Cryptocurrency

Cryptocurrency-Stealing 'Cryware' Malware Attacks Surge

Mathew J. Schwartz • May 18, 2022

Criminals are doubling down on their use of information-stealing malware, such as Cryptobot, RedLine Stealer and QuilClipper, to steal private keys and siphon off cryptocurrency being stored in internet-connected hot wallets or to raid cryptocurrency holders' online exchange accounts.

Application Security

CISA Removes Windows Flaw From Exploited Catalog List

Prajeet Nair • May 17, 2022

The U.S. Cybersecurity and Infrastructure Security Agency has announced that it is temporarily removing a Windows protection defect from its Known Exploited Vulnerability Catalog because of a risk of authentication failures after the recent Microsoft patch update.

Business Continuity Management / Disaster Recovery

Conti Claims It Has 'Insiders' in Costa Rican Government

Mihir Bagwe • May 17, 2022

Ransomware group Conti, which has been holding to ransom crypto-locked Costa Rican government systems since April, has claimed on its leak site Conti News that it has "insiders" in the country's government, and that they are working toward the compromise of "other systems."

Critical Infrastructure Security

Feds Say 'Multi-Tasking Doctor' Built Thanos Ransomware

Mathew J. Schwartz • May 17, 2022

U.S. authorities have charged a cardiologist based in Venezuela with developing and selling multiple strains of ransomware, including Jigsaw and Thanos, as well as recruiting affiliates to use the crypto-locking malware against victims in return for a cut of any ransoms paid.

Electronic Healthcare Records

An Initiative to Enhance Patient ID, Record Matching

Marianne Kolbasuk McGee • May 17, 2022

A new initiative aims to create a standards-based nationwide patient credential and matching ecosystem to ultimately improve matching patients with their electronic health information, says Scott Stuewe, CEO of DirectTrust, the nonprofit, vendor-neutral organization that is leading the effort.

3rd Party Risk Management

Trusting Our Global Supply Chain

Steve King • May 17, 2022

In this episode of "Cybersecurity Unplugged," Tim Danks of Global Risk Perspectives discusses issues around trusting our global supply chain, including the role of Huawei, the steps needed to secure critical infrastructure, and the process for determining a comfortable level of risk management.

Breach Notification

AvosLocker Claims Data Theft From Another Healthcare Entity

Marianne Kolbasuk McGee • May 16, 2022

In its most recent assault against a healthcare entity, ransomware-as-a-service operator AvosLocker claims to be behind an attack allegedly involving data theft from Texas-based CHRISTUS Health, which operates hundreds of healthcare facilities in the U.S., Mexico and South America.