We’re very pleased to announce that the Retail & Hospitality ISAC Podcast has joined the CyberWire Podcast Network. Join host Luke Vander Linden for chats with members of the InfoSec community to discuss the latest challenges, opportunities, and best practices unique to cybersecurity in the retail and hospitality industry. Tune in and subscribe.
The Minneapolis Public Schools District, located in the US state of Minnesota, suffered a ransomware attack that forced the district to cancel services last week. In preparation for students to return to their classrooms, school officials on Friday sent an email to parents and issued a public statement explaining that the district began experiencing technical issues on February 20 that resulted in the shutdown of school internet, phones, cameras, badge access, copiers/printers, and building alarms. “MPS experienced technical difficulties affecting the operability of certain computer systems related to what we now know is an encryption event,”officials stated. “MPS IT staff and external IT specialists have been working around the clock to investigate the source of this disruption and to confirm its impact on our systems.” By the time the statement was sent, many systems had been fully restored, and students were walked through a password reset process when they returned to school on Monday.
The Record from Recorded Future News notes that this is just the latest incident in a recent surge of attacks targeting educational institutions. The Cybersecurity and Infrastructure Security Agency (CISA) said the number of K-12 cyber incidents has risen from four hundred in 2018 to over thirteen hundred in 2021, and forty-five school districts totalling nearly two thousand schools were impacted by ransomware in 2022. CISA Director Jen Easterly stated, “As the mom of a student in high school, to be watching these hacks that have happened across the country — many of which we find out about, some of which we don’t — it’s one of the reasons why we have made K-12 school districts a priority this year, to work with them closely to help drive down risk.”
Bad news for game enthusiasts looking for easy access to hot games. HackRead reports that a new phishing campaign is using fake video game files to deploy malware. AhnLab Security Emergency response Center (ASEC) has discovered a new ChromeLoader campaign in which hackers are embedding the malware in what appear to be fake versions, or “cracks,” of popular games on platforms including ROBLOX, Steam, and Nintendo. The researchers have dubbed the operation “uncommon” due to its ability to bypass antivirus programs and other cybersecurity mechanisms in order to evade detection. The fraudulent cracks for sought-after games like Elden Ring, Red Dead Redemption 2, Call of Duty, Portal 2, and Minecraft are actually VHD files that infect web browsers with ChromeLoader malware and redirect traffic to fake advertising websites. As Gearrice notes, the campaign’s use of VHD files is unusual, as cracked software is usually distributed through ISO files, which create a virtual optical disk drive on the PC, while VHD files create a virtual hard disk. The simplest way to avoid this hack is to do the right thing and only go for that authentic version of Mario Kart.
YouTube breached child protection laws, suit claims (Compting) A British man has made the first ever complaint against a Big Tech firm under the Children's Code, a 2021 law that requires companies to take the best interests of child users into account.
Hackers Claim They Breached T-Mobile More Than 100 Times in 2022 (KrebsOnSecurity) Three different cybercriminal groups claimed access to internal networks at communications giant T-Mobile in more than 100 separate incidents throughout 2022, new data suggests. In each case, the goal of the attackers was the same: Phish T-Mobile employees for access…
Gamers are fixing a video game ‘taken over’ by hackers (TechCrunch) Hackers are targeting Activision's first person shooter Black Ops III exploiting significant vulnerabilities. These two gamers are fighting back.
DISH tells SEC that ransomware attack caused outages; personal info may have been stolen (The Record from Recorded Future News) Satellite broadcast giant DISH told the SEC that a ransomware attack is what caused the “system issues” that occurred over the weekend.
Dish CEO says data was stolen in cyberattack that’s kept systems down for days (The Verge) “Certain data was extracted.”
cracked versions of these cult games steal your data (Gearrice) As we know, “cracked” software and video games are often full of viruses and other malware. Researchers from the Ahnlab Security Emergency Response Center
Fake ROBLOX and Nintendo game cracks drop ChromeLoader malware (HackRead) What’s worse, in the new campaign, ChromeLoader malware evades detection by security software.
Hackers steal sensitive law enforcement data in a breach of the U.S. Marshals Service (NPR) The federal agency has revealed that it was the victim of a ransomware attack last week in which hackers stole sensitive data.
Incident 2 – Additional details of the attack (LastPass Support) Despite high confidence in the outcomes of our investigation and actions taken in response to the first incident, the threat actor leveraged information stolen during the first incident, information available from a third-party data breach, and a vulnerability in a third-party media software package to launch a coordinated second attack.
LastPass says employee’s home computer was hacked and corporate vault taken (Ars Technica) Already smarting from a breach that stole customer vaults, LastPass has more bad news.
