Latvian Woman Charged for Her Role in Creating Trickbot Banking Malware

The U.S. Department of Justice DoJ on Friday charged a Latvian woman for her alleged role as a programmer in a cybercrime gang that helped develop TrickBot malware. The woman in question, Alla Witte, aka Max, 55, who resided in Paramaribo, Suriname, was arrested in Miami, Florida on February 6...

Intelligence-driven disruption of ransomware campaigns

By Neil Jenkins and Matthew Olney. Note: Our guest co-author, Neil Jenkins, is the Chief Analytic Officer at the Cyber Threat Alliance. He leads the CTA's analytic efforts, focusing on the development of threat profiles, adversary playbooks and other analysis using the threat intelligence in the...

How to Protect Your Files From Ransomware

It's a growing threat for individual users and businesses alike—but there are ways to protect yourself...

The FBI’s Director Compares Ransomware Threat to 9/11

Plus, a Supreme Court decision on a controversial anti-hacking law, a WhatsApp walk-back, and more of the week’s top security news...

ALERT: Critical RCE Bug in VMware vCenter Server Under Active Attack

Malicious actors are actively mass scanning the internet for vulnerable VMware vCenter servers that are unpatched against a critical remote code execution flaw, which the company addressed late last month. The ongoing activity was detected by Bad Packets on June 3 and corroborated yesterday by...

Cyberattack Suspected in Cox TV and Radio Outages

A reported ransomware attack on Cox Media Group CMG has crippled streaming and other internal operations of dozens of radio and television stations scattered across America’s 20 broadcast markets. CMG has won’t comment on the reported attack and hasn’t responded to a request for comment. A member...

Ransomware to be investigated like terrorism

The impact of recent ransomware attacks on vital infrastructure in the US has triggered a reaction from the US Attorney’s office. In an internal guidance it says that all ransomware investigations in the field should be centrally coordinated with a recently created task force in Washington...

REvil Ransomware Gang Spill Details on US Attacks

Cybercriminals behind the JBS Foods ransomware attack claim they had no intent to target United States-based firms. The group, identified as the Sodinokibi REvil ransomware gang, also said it was not afraid of being labeled a cyber-terrorist group. A spokesperson for REvil shared its positions in...

Cybercrime, fraud, and insider threats increased in 2020 in the UK, report says

Since the initial lockdown, we have seen the rise of certain types of cybercrime, including scams and fraud campaigns that either bank on the global COVID-19 pandemic or take advantage of potential victims that adhere to work-from-home measures. In the UK, the National Crime Agency NCA has...

Steamship Authority answers question: Who’s the next ransomware victim?

After the attacks on Colonial Pipeline and JBS, many may have been wondering, as we did, what the next ransomware headline was going to be. Well, here it is—another victim in the vital infrastructure of transport and logistics, although this time the impact may be less brutal. Steamship Authority...

Exchange Servers Targeted by ‘Epsilon Red’ Malware

Threat actors have deployed new ransomware on the back of a set of PowerShell scripts developed for making encryption, exploiting flaws in unpatched Exchange Servers to attack the corporate network, according to recent research. Researchers from security firm Sophos detected the new ransomware,...

Podcast: The State of Ransomware

Last month, ransomware group DarkSide targeted operator Colonial Pipeline Co., disrupting fuel supply in the Eastern part of the U.S. The attack on a major U.S. oil pipeline had widespread ripples: it prompted President Joe Biden to declare a state of emergency and caused substantial pain at gas...

REvil Ransomware Ground Down JBS: Sources

The cyberattack that flattened operations at JBS Foods over the weekend was indeed a ransomware strike, the global food distributor has confirmed to the Biden administration, with sources pointing to the REvil Group as the responsible gang. Four people familiar with the matter who weren’t...

JBS says it is recovering quickly from a ransomware attack

This week another major supplier reported it had been hit with ransomware. After the Colonial Pipeline attack last month, this time the victim is the worlds largest meatpacker, JBS. JBS halted cattle slaughter at all its US plants on Tuesday after the attack caused their Australian operations to...

The DarkSide Ransomware Gang

The New York Times has a long story on the DarkSide ransomware gang. A glimpse into DarkSides secret communications in the months leading up to the Colonial Pipeline attack reveals a criminal operation on the rise, pulling in millions of dollars in ransom payments each month. DarkSide offers what...

Cybercriminals Hold $115,000-Prize Contest to Find New Cryptocurrency Hacks

A top Russian-language underground forum has been running a "contest" for the past month, calling on its community to submit "unorthodox" ways to conduct cryptocurrency attacks. The forum's administrator, in an announcement made on April 20, 2021, invited members to submit papers that assess the...

Ransomware Hits a Food Supply Giant—and Underscores Dire Risk

Hackers targeting JBS USA have disrupted meat processing facilities around the world, just one month after the Colonial Pipeline attack caused fuel distribution havoc...

Cyber-Insurance Fuels Ransomware Payment Surge

Ransomware victims are increasingly falling back on their cyber-insurance providers to pay the ransom when they’re hit with an extortion cyberattack. But security researchers warn that this approach can quickly become problematic. In the first half of 2020, ransomware attacks accounted for 41...

Cobalt Strike, a penetration testing tool abused by criminals

If you were to compose a list of tools and software developed by security and privacy defenders that ended up being abused by the bad guys, then Cobalt Strike would unfortunately be near the top of the list. Maybe only Metasploit could give it a run for the first place ranking. Metasploit—probabl...

Cyberattack Forces Meat Producer to Shut Down Operations in U.S., Australia

The world’s largest meat distributor shut down some operations in both the United States and Australia over the Memorial Day weekend after a cyberattack on its IT systems that could have a significant effect on the food supply chain if not resolved quickly. Attackers targeted several servers...