Author Archives: Tim Starks

Bitdefender releases REvil decryptor as ransomware gang shows signs of return

Posted on by

As law enforcement braces for the revival of the REvil ransomware gang, a cybersecurity firm on Thursday released a free decryption tool for early victims of the criminals. The decryptor, which Bitdefender developed in coordination with an unnamed law enforcement partner, will aid victims hit before July 13. The Romania-based company said it was still in the middle of an investigation with its partner, which agreed to release the decryptor before completing the joint inquiry to help as many victims as possible. Bitdefender has a long history of working with Europol to release tools that help victims of digital extortion sidestep the process of making a payment. “We believe new REvil attacks are imminent after the ransomware gang’s servers and supporting infrastructure recently came back online after a two month hiatus,” Bitdefender wrote in a blog post. According to another cybersecurity firm, Flashpoint, REvil is already fully back in business. […]

The post Bitdefender releases REvil decryptor as ransomware gang shows signs of return appeared first on CyberScoop.

Continue reading Bitdefender releases REvil decryptor as ransomware gang shows signs of return→

Email scammers posed as DOT officials in phishing messages focused on $1 trillion bill

Posted on by

Shortly after Congress took action on a $1 trillion infrastructure bill, hackers posing as U.S. Transportation Department officials offered fake project bid opportunities to seduce companies into handing over Microsoft credentials, researchers say. The ploy included layers of attempts to disguise the malicious appeals as authentic government solicitations, and even eventually led the would-be victims back to the actual Department of Transportation website, according to a Wednesday blog post from INKY, an email security company. “The basic pitch was, with a trillion dollars of government money flowing through the system, you, dear target, are being invited to bid for some of this bounty,” wrote Roger Kay, vice president of security strategy for the firm. Never mind that the infrastructure legislation hasn’t fully worked its way through Congress yet, nor that few of the phishing campaign’s targets would even be eligible for the infrastructure projects that bill would fund. It’s the […]

The post Email scammers posed as DOT officials in phishing messages focused on $1 trillion bill appeared first on CyberScoop.

Continue reading Email scammers posed as DOT officials in phishing messages focused on $1 trillion bill→

CISA hires long-time cyber pro Kiersten Todt as chief of staff

Posted on by

The Cybersecurity and Infrastructure Security Agency is getting Kiersten Todt — a veteran of cyber-focused roles in the executive branch, on Capitol Hill and the private sector — as its chief of staff. Todt has been heading up the Cyber Readiness Institute, a non-profit focused on developing cybersecurity tools for small businesses. She now returns to the public sector at CISA, housed within the Department of Homeland Security. When she last worked for the federal government, it was as executive director of President Barack Obama’s Commission on Enhancing National Cybersecurity. Among the recommendations in its 2016 final report: creation of an agency just like CISA. Now, at CISA, Todt will focus on long-range objectives, allocating resources and the CISA workforce. “I look forward to shaping CISA’s long-term planning and working with industry, federal agencies, and state, local, tribal, and territorial government partners to chart the path forward for a more […]

The post CISA hires long-time cyber pro Kiersten Todt as chief of staff appeared first on CyberScoop.

Continue reading CISA hires long-time cyber pro Kiersten Todt as chief of staff→

Groove ransomware gang is a motley crew of disgruntled hackers, researchers say

Posted on by

Another new ransomware gang is making waves with an unconventional structure, its unique pedigree and an early victim. A coalition of researchers on Thursday explained what makes Groove, a gang that quietly emerged in July with a website, different: Namely, it eschews the traditional ransomware-as-a-service hierarchy in favor of an opportunistic pledge that they’ll work with anyone as long as there’s money to be made. The researchers — from McAfee, Intel 471 and Coveware — traced the group’s origins to a likely split with the Babuk gang, part of a trend of turmoil within extortion groups that use the ransomware-as-a-service (RaaS) model where affiliates get to use an outfit’s malware in exchange for sharing profits. For instance, a disgruntled former Conti affiliate recently leaked the group’s attack playbook. Already, there’s evidence the researchers uncovered that Groove has worked with another ransomware gang, BlackMatter, that likewise recently emerged. That group is […]

The post Groove ransomware gang is a motley crew of disgruntled hackers, researchers say appeared first on CyberScoop.

Continue reading Groove ransomware gang is a motley crew of disgruntled hackers, researchers say→

National cyber director declares ‘too soon to say we’re out of the woods,’ as US enjoys dip in ransomware

Posted on by

After a summer marked by big ransomware attacks from suspected Russian gangs, some of those same groups went quiet. National Cyber Director Chris Inglis said Thursday that it’s too early to tell if the trend will hold. “Those attacks have fallen off. Those syndicates have to some degree deconstructed,” Inglis said at an event hosted by the Ronald Reagan Presidential Foundation and Institute. “I think it’s a fair bet they have self-deconstructed and essentially gone cold and quiet to see whether the storm will blow over and whether they can then come back.” Whether they do so will depend largely on whether Russian President Vladimir Putin takes steps to undo the “permissive” atmosphere after U.S. President Joe Biden warned him repeatedly about ransomware attacks originating from his country. “It’s too soon to say we’re out of the woods on this,” Inglis said. The FBI blamed Russian ransomware gang REvil for […]

The post National cyber director declares ‘too soon to say we’re out of the woods,’ as US enjoys dip in ransomware appeared first on CyberScoop.

Continue reading National cyber director declares ‘too soon to say we’re out of the woods,’ as US enjoys dip in ransomware→

Russian cybercrime continues as government-backed attacks on companies dwindle, CrowdStrike says

Posted on by

The Russian approach to hacking shifted considerably over the past year, with state-sponsored attacks on commercial organizations dropping off even as the local cybercrime scene dominated the field, CrowdStrike said in a report Wednesday. From July 2020 to June of this year, Russian state-backed hacking outfits accounted for only a tiny sliver of nation-sponsored attacks aimed at commercial enterprises detected by the cyber firm’s threat hunting service, at 1% compared to China’s 69%. (The figure represents the findings from only one threat intelligence firm, and does not account for hacking campaigns that CrowdStrike might have missed.) Meanwhile, the suspected Russia-based hacking group that CrowdStrike calls Wizard Spider, and that has used the Ryuk ransomware since 2018, was responsible for double the number of detected attempted intrusions of any other cybercrime gang over the same period. While CrowdStrike didn’t have comparison figures on the percentages of state-sponsored attacks on commercial organizations […]

The post Russian cybercrime continues as government-backed attacks on companies dwindle, CrowdStrike says appeared first on CyberScoop.

Continue reading Russian cybercrime continues as government-backed attacks on companies dwindle, CrowdStrike says→

Under fire from privacy advocates, Apple delays controversial photo scanning plan

Posted on by

Apple is delaying plans for a contentious U.S. update that the company said it would use to detect child sex abuse images as they’re uploaded to iCloud Photos from iPhones, the company announced on Friday. The reversal comes less than a month after Apple announced the change, during which the company came under heavy criticism from privacy advocates who contended it could enable government surveillance requests. Apple also delayed the rollout of a feature that would scan iMessage images sent or received by children for sexually explicit materials, and notify parents if the children are young enough. The plans stood to jeopardize Apple’s positioning as the tech giant that most valued privacy, but came as it faced pressure from governments and child advocacy groups to do more to combat child sex abuse materials. The update came more than five years after Apple refused to create new software that would have […]

The post Under fire from privacy advocates, Apple delays controversial photo scanning plan appeared first on CyberScoop.

Continue reading Under fire from privacy advocates, Apple delays controversial photo scanning plan→

Hacker, money launderer sentenced to prison for scamming tax preparers and COVID-19 relief programs

Posted on by

A federal judge sentenced two men to prison for a coordinated scheme to hack into tax preparation firms, steal personal information, file fraudulent unemployment claims and income tax returns and then launder the money. The fraudulent unemployment claims aimed to exploit a COVID-19 relief program that netted $280,000 in improper benefits from the state of Washington, the Justice Department announced Thursday. They also included attempts to seek $2.6 million in tax refunds. Bamidele Muraina, a Nigerian national whom DOJ said led the effort to steal identities, received five years and 10 months in prison, as well as three years of supervised release and an order to pay more than $500,000 in restitution. For leading the money laundering leg of the operation, Gabriel Kalembo received four years and two months in prison, along with two years of supervised release and an order to pay nearly $300,000. Starting at least in January […]

The post Hacker, money launderer sentenced to prison for scamming tax preparers and COVID-19 relief programs appeared first on CyberScoop.

Continue reading Hacker, money launderer sentenced to prison for scamming tax preparers and COVID-19 relief programs→

Hacker, money launderer sentenced to prison for scamming tax preparers and COVID-19 relief programs

Posted on by

A federal judge sentenced two men to prison for a coordinated scheme to hack into tax preparation firms, steal personal information, file fraudulent unemployment claims and income tax returns and then launder the money. The fraudulent unemployment claims aimed to exploit a COVID-19 relief program that netted $280,000 in improper benefits from the state of Washington, the Justice Department announced Thursday. They also included attempts to seek $2.6 million in tax refunds. Bamidele Muraina, a Nigerian national whom DOJ said led the effort to steal identities, received five years and 10 months in prison, as well as three years of supervised release and an order to pay more than $500,000 in restitution. For leading the money laundering leg of the operation, Gabriel Kalembo received four years and two months in prison, along with two years of supervised release and an order to pay nearly $300,000. Starting at least in January […]

The post Hacker, money launderer sentenced to prison for scamming tax preparers and COVID-19 relief programs appeared first on CyberScoop.

Continue reading Hacker, money launderer sentenced to prison for scamming tax preparers and COVID-19 relief programs→

Breach notification window, accountability are focus of coming fight on cyber legislation in Congress

Posted on by

Battle lines are drawn in Congress over legislation that would require companies to report some cyber incidents to the federal government, with industry groups lining up to support a House of Representatives bill poised to create fewer challenges for business leaders than a similar proposal in the Senate. The debate involves questions about how quickly companies would have to report attacks, what kinds of specific intrusions would trigger notification and whether failure to comply with the rules would lead to financial penalties. The idea of breach notification legislation gained momentum following last year’s discovery of the SolarWinds hack that compromised nine federal agencies and some 100 companies, as well as the Colonial Pipeline ransomware attack in May. At issue are such questions as whether companies have 24 or 72 hours to report an incident, along with who would be on the hook outside of critical infrastructure owners and operators, if […]

The post Breach notification window, accountability are focus of coming fight on cyber legislation in Congress appeared first on CyberScoop.

Continue reading Breach notification window, accountability are focus of coming fight on cyber legislation in Congress→