IT-Security Trends

1. Bank of America employee charged with insider BEC scam  A Bank of America employee and two other perpetrators were accused of money laundering, aggravated identity theft, and alleged involvement in Business Email Compromise (BEC) scams. The three actors targeted small and large companies across the globe, but mainly in the United States.   By using phishing techniques and deploying malware, the threat ...

1. Malware samples target Windows operating systems from its Linux subsystem  Security researchers discovered a strain of malware samples developed to compromise the Windows subsystem in Linux and then laterally move to the native Windows enclave. Threat actors created the malware samples using Python code. They run on Debian systems and have a low detection rate for traditional security controls.   The malware developers packaged the samples in ...

1.  Ransomware gang threatens to leak stolen data if victims contact law enforcement During a ransomware attack, one of the most notorious ransomware groups, Ragnar Locker, threatened to leak complete data of victims who seek help from law enforcement agencies, including the Federal Bureau of Investigation (FBI). The ransomware group claims that incident investigators and recovery experts often collaborate with ...

1.  Cybercriminals Recruit English Speakers for Business Email Compromise Administrative and technical security controls have helped to reduce the effects of business email compromise (BEC). However, as a result, some BEC threat actors struggle to develop compelling phishing email messages for English corporate audiences. According to security researchers, said threat actors are now recruiting native English speakers in mass to ...

1.  FBI Cautions Congress Against Banning Ransomware Payments Senior FBI officials advised the U.S. Congress not to mitigate ransomware threats by making ransom payments illegal. While the FBI cautioned organizations against sending ransomware payments to cybercriminals, the assistant director of the FBI (cyber division) argues that if Congress were to ban ransom payments, it could create opportunities for further extortion ...

1.  A 16-year-old Printer Vulnerability CVE-2021-3438 (CVSS score: 8.8) Impacts Millions of Infrastructures A 16-year-old vulnerability was discovered in popular corporate printers that allow hackers to gain administrative rights to perform several activities on systems, including the ability to install rogue programs, view, change, encrypt or wipe data. This critical vulnerability is prevalent in HP, Samsung, and Xerox printer software, impacting ...

1.  After Paying Off The First Ransomware Demand, Most Firms Face A Second Ransomware Attack Security experts discovered that ransomware attackers deploy secondary ransomware attacks against firms that pay off initial ransom demands. After paying off a ransom demand, firms often receive a decryptor for their hijacked systems. However, most attackers corrupt hijacked systems by creating backdoors that allow future ...

1.  Security researchers reveal stealthy techniques to bypass antivirus tools and ransomware defenses Security researchers discovered significant vulnerabilities in popular antivirus tools, which could be exploited to deactivate protective mechanisms to launch ransomware attacks and other malicious operations. According to said researchers, of the 29 antivirus tools evaluated, 14 were found susceptible to the 'Ghost Control' attack technique. In comparison, ...

1. Kia Motors Suffers a Ransomware Attack, and a $20 million Ransom is Demanded The notorious ransomware gang, DoppelPaymer, has seized critical systems belonging to Kia Motors America. Thus, impacting business continuity within 800 dealerships; the integrity of critical data; and the company’s reputation. According to the attackers, to receive a decryptor and a return back to normalcy, Kia Motors ...

New data shows slow or ineffective software patching leads to more than a quarter of cybersecurity vulnerabilities, Evanina: Chinese government has stolen 80% of personally identifiable US consumer data, threat actors now targeting supercomputers, US federal, legal agencies told to file paper documents, and new ransomware encrypts virtual disks using VMWare vulnerabilities .