The Grief ransomware operation's dedicated data leak site (victims' names redacted)

Ransomware Changes: DoppelPaymer Rebrands; Babuk Evolves

Mathew J. Schwartz • July 30, 2021

The ransomware landscape changes constantly as groups disappear, change approaches or rebrand. The DoppelPaymer operation, for example, appears to have reinvented itself as Grief, while the administrator of Babuk has launched a ransomware-friendly cybercrime forum called RAMP.

Fraud Management & Cybercrime

Alert for Ransomware Attack Victims: Here's How to Respond

Latest

Cyberwarfare / Nation-State Attacks

Researchers Find More Servers Tied to Russian-Linked Attacks

Scott Ferguson • July 30, 2021

Researchers at the security firm RiskIQ have uncovered about 35 active command-and-control servers connected with an ongoing malware campaign that has been linked to a Russian-speaking attack group known as APT29 or Cozy Bear.

Governance & Risk Management

Patching Woes: Most Frequently Exploited CVEs Listed

Dan Gunderman • July 30, 2021

A joint cybersecurity advisory issued by several agencies this week highlighting the ongoing exploits of longstanding software vulnerabilities illustrates the woeful state of patch management, security experts say.

Fraud Management & Cybercrime

ISMG Editors’ Panel: Ransomware Update

Anna Delaney • July 30, 2021

In the latest weekly update, three editors at Information Security Media Group discuss important cybersecurity issues, including the latest ransomware trends, plus an update on NIST's "zero trust" initiative.

Critical Infrastructure Security

Wiper Malware Used in Attack Against Iran's Train System

Jeremy Kirk • July 30, 2021

Nearly three weeks ago, Iran's state railway company was hit with a cyberattack that was disruptive and - somewhat unusually - also playful. Security firm SentinelOne says analyzing the wiper malware involved offers tantalizing clues about the attackers' skills, but no clear attribution.

Critical Infrastructure Security

Analysis: Keeping Track of Ransomware Gangs

Anna Delaney • July 30, 2021

The latest edition of the ISMG Security Report features an analysis of the disappearance of ransomware-as-a-service groups, such as REvil and Darkside, and how that impacts the wider cybercrime ecosystem. Also featured: ransomware recovery tips; regulating cyber surveillance tools.

Cyberwarfare / Nation-State Attacks

Israeli Government Visits NSO Group Amid Spyware Claims

Jeremy Kirk • July 29, 2021

The Israeli government paid a visit on Wednesday to NSO Group, the company whose spyware is alleged to have been covertly installed on the mobile devices of journalists and activists. The visit comes as Israel faces growing pressure to see if NSO Group's spyware, called Pegasus, has been misused.

Recruitment & Reskilling Strategy

Tips on Recruiting, Retaining Cybersecurity Staff

Anna Delaney • July 28, 2021

To recruit and retain cybersecurity specialists, organizations must "stop expecting people just to be sort of 'focused monkeys' and doing one particular task and turning the handle," says Keith Martin, professor of information security at Royal Holloway University in the U.K.

Business Continuity Management / Disaster Recovery

Kaseya's Unitrends Technology Has Zero-Day Flaws

Prajeet Nair • July 28, 2021

Researchers are warning of three zero-day vulnerabilities in Kaseya's Unitrends cloud-based enterprise backup and disaster recovery technology. The news comes after a July 2 ransomware attack exploiting flaws in Kaseya's VSA software had a major impact.

Business Continuity Management / Disaster Recovery

Measuring Success of 'No More Ransom' Project

Rashmi Ramesh • July 28, 2021

Europol says the "No More Ransom" project, a portal launched five years ago, so far has helped more than 6 million ransomware victims worldwide recover their files for free so they could avoid paying almost 1 billion euros ($1.2 billion) in ransoms.

Governance & Risk Management

M&A Update: Deloitte and Sophos Make Acquisitions

Doug Olenick • July 27, 2021

Brisk M&A activity in the cybersecurity sector continues. Among the latest moves: Deloitte and Sophos each have announced two acquisitions.

Business Continuity Management / Disaster Recovery

Kaseya Says It Paid No Ransom to Obtain Universal Decryptor

Doug Olenick • July 26, 2021

Remote management software company Kaseya says it obtained the ability to decrypt all victims of a massive REvil - aka Sodinokibi - attack via its software, without paying a ransom to attackers. But Kaseya has still not revealed how it obtained the decryption key, except to say it was supplied by a third party.

Cybercrime

Attackers Rely on 'Exotic' Languages for Malware Creation

Rashmi Ramesh • July 26, 2021

Malware developers increasingly are relying on "exotic" programming languages - such as Go, Rust, DLang and Nim - to create malicious code that can avoid detection by security tools and add a layer of obfuscation to an attack, according to a report released Monday by BlackBerry.