CSO Perspectives has returned for a 13th season. Tune in to the season premiere to hear our CSO Rick Howard go through cybersecurity first principles as they apply to the infosec workforce gap. This show is a CyberWire Pro exclusive, so subscribe to Pro to catch new episodes every Monday. Subscribe and listen.
US software company DomainTools has issued its annual report on the most prominent ransomware families, and that report indicates significant changes to the ransomware landscape in the past twelve months. External forces like Russia’s invasion of Ukraine last year saw cyber gangs rebranding to avoid sanctions. The infamous Conti ransomware group issued pro-Russia sentiments shortly after the invasion (which the group attempted to walk back days later), and a whistleblower leaked details about their operations that eventually led Conti to shut down its operations. Since then, elements of the old group have sprung up under new names like Royal, Black Basta, Karakut, and Quantum. Royal and Black Basta are now among the top five ransomware groups by victimology, beaten only by heavy-hitters Lockbit 3.0, AlphVM, and CLOP. The most targeted sector is construction, followed by healthcare, which has seen a major surge in attacks impacting a greater number of individuals. World governments have increased their efforts to disrupt the business operations of ransomware groups by shutting down cryptocurrency exchanges and sanctioning individuals tied to ransomware families like Trickbot. Coupled with arrests of prominent group members, law enforcement operations have had an impact on how ransomware groups operate. Ransomware payments also took a steep drop, influenced by victims’ ability to restore their systems from backups, and the refusal of cyber insurance companies to accept claims connected to ransomware attacks. That said, attackers are focusing more attacks on healthcare, higher ed, and local governments, sectors that hold sensitive personal data and are more likely to pay up in order to avoid disruption of services.
Crossing the pond, new research from UK software company Macro 4 indicates that two-thirds of IT leaders feel the EU’s General Data Protection Regulation (GDPR) has eroded customer trust in organizations. While the GDPR was intended to make businesses more trustworthy by increasing transparency, the one hundred IT leaders surveyed by Macro 4 say it somehow had the opposite effect, making consumers more aware of the importance of protecting their data and less trusting of the organizations that handle it. Jim Allum, Director, Commercial and Technical at Macro 4, told Infosecurity Magazine, “Most IT leaders seem to feel that the regulation has made people more suspicious about how their data is being used. This is possibly because people are better informed now about how their data could be compromised or misused.” Consumer worries have no doubt been further fed by headline-making data breaches and noncompliance fines handed out to household brands (most recently, Meta) found in violation of the GDPR. It’s also worth noting that 86% of respondents to the survey say they feel the GDPR must be updated to better address emerging advances in AI tech like ChatGPT. On a positive note, 72% of those surveyed said the recent increase in hybrid working, and the resultant increase in company or personal data being handled outside the office, has led their companies to invest more time and funding to ensure compliance with the GDPR.
Updates to Legion: A Cloud Credential Harvester and SMTP Hijacker (Cado Security) Cado Labs have encountered an updated version of a cloud-focused hacktool named Legion with some additional functionality.
YouTube Pirated Software Videos Deliver Triple Threat: Vidar Stealer, Laplas Clipper, XMRig Miner (Fortinet Blog) The FortiGuard Labs team investigates a threat campaign targeting YouTube viewers. Get a view of its entire attack chain along with the malware components that make up this campaign. …
The Most Prolific Ransomware Families: 2023 Edition (DomainTools) We’ll discuss the events that forced the most prolific ransomware families to evolve, the top targeted industries, and influences on RaaS.
Cuba ransomware claims cyberattack on Philadelphia Inquirer (BleepingComputer) The Cuba ransomware gang has claimed responsibility for this month's cyberattack on The Philadelphia Inquirer, which temporarily disrupted the newspaper's distribution and disrupted some business operations.
Arms maker Rheinmetall confirms BlackBasta ransomware attack (BleepingComputer) German automotive and arms manufacturer Rheinmetall AG confirms that it suffered a BlackBasta ransomware attack that impacted its civilian business.
Canadian Nurses Association hit by cyber attack (IT World Canada) The Canadian Nurses Association says it has suffered a cybersecurity incident, but isn't commenting on a report that the attack was ransomware. "We can confirm having experienced an IT security incident on April 3, 2023 which impacted some of our systems," Alexandre Bourassa, the association's public affairs lead, said in an email to IT World
Health insurer says patients’ information was stolen in ransomware attack (Record) Patient data at Harvard Pilgrim Health Care was copied and taken during a period from late March to mid-April, according to the system's parent organization, Point32Health.
Harvard Pilgrim says customers' information compromised in cyber attack (CBS News) Harvard Pilgrim said they are not aware of misuse of information, but they are offering free credit monitoring to members.
Marine unit accidentally emails out 39,000 bank accounts, other personal info (Task & Purpose) There are no indications that any of the personal information was forwarded outside official government channels.
The timeline: Records show the immediate aftermath of the cyber attack on Rochester Public Schools (Rochester Post Bulletin) Although the district initially shut everything on its network down, it soon after restored email access to the district's top administration.
