Major Texas hospital system hit by ransomware.

Summary

By the CyberWire staff

At a glance.

Major Texas hospital system hit by ransomware.
North Korea's Kimsuky breaches German weapons manufacturer.
T-Mobile will pay $31.5 million over data breaches.

Major Texas hospital system hit by ransomware.

The University Medical Center Health System (UMC) in Lubbock, Texas, is diverting some ambulances following a ransomware attack last Thursday, the Record reports. The health system stated, "We do not currently have an estimated timeline for full restoration of services. We have implemented downtime procedures and accommodations wherever possible in order to minimize any disruption to our patients and our critical services. We continue to carefully evaluate our operations with patient safety in mind. We will only restore services once it is deemed safe to do so."

UMC added, "Third parties that have helped other hospitals address similar issues have been engaged to assist in our response and investigation. Our teams are working around the clock to safely restore systems as quickly as possible."

The Record notes that the attack is concerning because "UMC is the only level 1 trauma center within 400 miles."

Now available: The SpyCloud 2024 Malware and Ransomware Defense Report

SpyCloud’s annual Malware & Ransomware Defense Report is packed with valuable insights from over 500+ security leaders and practitioners from across the US and UK. The findings include details about how infostealer malware is fueling ransomware, the most common entry points used by cybercriminals in ransomware attacks, industry-specific risks, and actionable takeaways on how to protect your organization from the criminal underground. Read the report now.

North Korea's Kimsuky breaches German weapons manufacturer.

Der Spiegel reports that hackers linked to North Korea's Kimsuky group breached Diehl Defence, a German weapons manufacturer that provides missiles to the South Korean military. The threat actor impersonated US defense contractors and targeted Diehl employees with phony job offers designed to trick them into installing malware. The goal of the operation was cyberespionage.

Germany's Federal Office for Information Security (BSI) told Der Spiegel that it's "aware of other organizations in Germany that are affected by the current campaign."

Are You Confident in the Security of Your Remote and Hybrid Employees?

A remote or hybrid workforce expands your company's surface area of attack beyond corporate firewall boundaries. Employees’ personal computers introduce shadow IT, and home networks with default settings are easy targets, compounded by public Wi-Fi vulnerabilities. You need to develop a strategy to stay secure while remote employees work across untrusted networks. To learn how you can secure your company's workforce, get a free copy of the latest ThreatLocker® whitepaper on how to secure remote workforces.

T-Mobile will pay $31.5 million over data breaches.

The US Federal Communications Commission (FCC) has reached a $31.5 million settlement with T-Mobile over four data breaches that occurred in 2021, 2022, and 2023, BleepingComputer reports. As part of the settlement, T-Mobile has also agreed to the following commitments:

"Corporate Governance – T-Mobile’s Chief Information Security Officer will give regular reports to the board concerning T-Mobile’s cybersecurity posture and business risks posed by cybersecurity. This is a foundational requirement for all well-governed companies. Corporate boards need both visibility and cybersecurity domain experience in order to effectively govern. This commitment ensures that the board’s visibility into cybersecurity is a key priority going forward.
"Modern Zero-Trust Architecture – T-Mobile has agreed to move toward a modern zero trust architecture and segment its networks. This is one of the most important changes organizations can make to improve their security posture.
"Robust Identity and Access Management – T-Mobile has committed to broad adoption of multi-factor authentication methods within its network."

[On Demand Podcast] Cloud Security in the Age of Generative AI

Listen to the recent discussion between N2K CyberWire’s Dave Bittner and Sysdig’s Loris Degioanni on how generative AI (GenAI) and Large Language Models (LLMs) are changing the cloud security landscape. We explored how to secure your AI deployments to safeguard sensitive information and went into the state-of-the-art for employing AI to boost the effectiveness of your cloud security teams in the face of evolving threats. Watch or listen to the discussion now.

Notes.

Today's issue includes events affecting Germany, the Democratic People's Republic of Korea, the Republic of Korea, and the United States.

The CyberWire will be taking a brief hiatus tomorrow and Thursday. We'll be back as usual on Friday.

Attacks, Threats, and Vulnerabilities

The Soze Syndicate - Business Email Compromise (Todyl) The Todyl MXDR team recently uncovered a massive identity attack infrastructure spanning thousands of hosts focused on account takeover and BEC. Learn more here.

OpenText Cybersecurity’s 2024 Threat Hunter Perspective Shows Collaboration Between Nation-States and Cybercrime Rings to Inflict More Damage (OpenText) Adversaries are taking advantage of weak security fundamentals and a lack of countermeasures to carry out cyberattacks

CISA and FBI Issue Alert on XSS Vulnerabilities (Security Boulevard) Cross-site scripting (XSS) vulnerabilities continue to be a major concern in today’s software landscape, despite being preventable. CISA and FBI have issued a Secure by Design alert to reduce the prevalence of these vulnerabilities. While XSS attacks have been around for years, they remain a persistent threat due to improper handling of user inputs in The post CISA and FBI Issue Alert on XSS Vulnerabilities appeared first on TuxCare.

AFP News Agency's Content Delivery Systems Hit by Cyberattack (Hackread) Follow us on Twitter (X) @Hackread - Facebook @ /Hackread

The Playstation Network is down in a global outage (BleepingComputer) The PlayStation Network is suffering a global outage, with subscribers confirming that they can no longer play online games or access the company's website.

Marketplace

Kevin Mandia to Join SpecterOps as Chair of Board of Directors - SpecterOps (SpecterOps) Kevin Mandia, founder of Mandiant and Co-Founder and General Partner at Ballistic Ventures, has been appointed as the new chair of SpecterOps' Board of Directors.

Products, Services, and Solutions

CyCognito Report Exposes Rising Software Supply Chain Threats (PR Newswire) /PRNewswire/ -- CyCognito today announced the release of its second annual "State of External Exposure Management 2024," providing critical insights into the...

Quantum Partners With Veeam for Accelerated Ransomware Recovery, End-to-End Immutability, and Air-Gapped Cyber Resilience (BusinessWire) ActiveScale 7.0 and ActiveScale Cold Storage Achieve Veeam Ready Qualification

Axio Unveils Quantification Wizard for Quick Time to Value with CRQ (BusinessWire) Transforms Cyber Risk Quantification to Enable Business-Aligned Decision Making and Accelerate Risk Mitigation

ProcessUnity Harnesses the Power of AI to Extend Risk Management Efforts (BusinessWire) Formalized suite of AI functionality modernizes risk management programs to deliver the insights needed to expedite processes and improve reach, consistency, efficiency, and defensibility

Introducing Quadrant Continuous Threat Exposure Management (Quadrant Security) Quadrant Launches Continuous Threat Exposure Management (CTEM) Service To Bolster Cybersecurity Resilience

Halcyon Announces Anti-Ransomware Protection for Linux Environments (BusinessWire) With a Marked Increase in the Abuse of Linux Systems in Ransomware Operations, Halcyon Linux Offers Real-Time Protection and Response Against Multi-Platform Ransomware Attacks

Axio Unveils Quantification Wizard for Quick Time to Value with CRQ (BusinessWire) Transforms Cyber Risk Quantification to Enable Business-Aligned Decision Making and Accelerate Risk Mitigation

Legislation, Policy, and Regulation

California passes car data privacy law to protect domestic abuse survivors (The Record) A bill requiring connected car manufacturers to allow drivers to cut off remote access to their vehicles so they cannot be tracked by abusers was signed into law by California Gov. Gavin Newsom on Friday.

DoJ audit finds CISA faces challenges in cyber threat information sharing, as participation hits record low (Industrial Cyber) DoJ audit finds CISA faces challenges in cyber threat information sharing, as participation hits record low.

Litigation, Investigation, and Law Enforcement

Crooked Cops, Stolen Laptops & the Ghost of UGNazi (KrebsOnSecurity) A California man accused of failing to pay taxes on tens of millions of dollars allegedly earned from cybercrime also paid local police officers hundreds of thousands of dollars to help him extort, intimidate and silence rivals and former business…

Man charged for selling forged license keys for network switches (BleepingComputer) The U.S. government has indicted a co-owner of a Minnesota IT company for his participation in an international conspiracy to sell forged license keys for networking devices.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Uniting Women in Cyber 2024 (Arlington, Virginia, USA, Oct 1, 2024) The premier networking event to advance diversity in cybersecurity! Join renowned cyber leaders and experts from all walks of life. Uniting Women in Cyber (UWIC) event convenes a powerful and diverse network of cyber leaders and experts to discuss emerging global trends, technological advancements, and workforce development. UWIC is the premier event for professionals, aspiring practitioners and all who are interested in cybersecurity, to meet and network with national leaders in the field. Come and be a part of a vibrant, diverse community to learn, share ideas, and expand your professional network!

HITRUST® Collaborate 2024 (Frisco, Texas, USA, Oct 1 - 3, 2024) HITRUST Collaborate is the most comprehensive information protection and risk management conference for privacy, security, and compliance. The 2.5-day conference includes keynotes, panel discussions, and educational sessions for industry professionals.

Insider Risk Management Program Evaluation & Optimization Training Course (Laurel, Maryland, USA, Oct 2 - 3, 2024) This highly sought after and very comprehensive training course, will ensure that the Insider RIsk Program Manager / Insider Threat Program (ITP) Manager and other key stakeholders that support the program, have the Core / Advanced Knowledge, Blueprint, Resources needed for developing, managing or optimizing a program. Students will be provided with an ITP Management Toolkit that provides an abundance of educational resources, templates and checklists for ITP development, management and optimization. Our student satisfaction levels are in the exceptional range. The Insider Threat Defense Group is so confident about our training courses that they come with a money back training guarantee.

SecureWorld Dallas (Plano, Texas, USA, Oct 3, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld Denver (Denver, Colorado, USA, Oct 10, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 10.01.24

At a glance.

Major Texas hospital system hit by ransomware.

North Korea's Kimsuky breaches German weapons manufacturer.

T-Mobile will pay $31.5 million over data breaches.

Notes.

Attacks, Threats, and Vulnerabilities

Marketplace

Products, Services, and Solutions

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Events