Collaborate Disseminate
ESET said it discovered the group, which has been active since 2019.
The post Espionage group targeted hotels, governments, seized on Microsoft Exchange vulnerability appeared first on CyberScoop.
The Department of Homeland Security’s cyber division, a key government agency charged with helping stop and respond to cyberattacks, might be getting ready for a bigger role in the spotlight. One key House committee advanced legislation in July to give the Cybersecurity and Infrastructure Security Agency an extra $400 million. Then, another committee on Sept. 14 separately advanced its take on legislation that would provide an additional nearly $800 million to the agency, which has a $2 billion total budget in the current fiscal year. Those proposed funds come on top of another extra $650 million that Congress and President Joe Biden already provided to CISA in March through the American Rescue Plan focused on COVID-19 relief. And the recent moves on Capitol Hill to bolster CISA, an agency formally established only three years ago, aren’t limited to cash. Both chambers of Congress are contemplating legislation that would make CISA the […]
The post Key lawmakers to CISA: Let us send you more money, power appeared first on CyberScoop.
Continue reading Key lawmakers to CISA: Let us send you more money, power
The Department of Homeland Security’s cyber division, a key government agency charged with helping stop and respond to cyberattacks, might be getting ready for a bigger role in the spotlight. One key House committee advanced legislation in July to give the Cybersecurity and Infrastructure Security Agency an extra $400 million. Then, another committee on Sept. 14 separately advanced its take on legislation that would provide an additional nearly $800 million to the agency, which has a $2 billion total budget in the current fiscal year. Those proposed funds come on top of another extra $650 million that Congress and President Joe Biden already provided to CISA in March through the American Rescue Plan focused on COVID-19 relief. And the recent moves on Capitol Hill to bolster CISA, an agency formally established only three years ago, aren’t limited to cash. Both chambers of Congress are contemplating legislation that would make CISA the […]
The post Key lawmakers to CISA: Let us send you more money, power appeared first on CyberScoop.
Continue reading Key lawmakers to CISA: Let us send you more money, power
The BlackMatter ransomware gang has struck an Iowa agricultural business, New Cooperative, and is demanding a $5.9 million ransom. Several security researchers first called attention to the hack on Monday, and the company confirmed to Bloomberg that it had been hit with a cyberattack and shut down its systems in response. It’s another big hit against the agriculture industry, following the May ransomware attack on JBS by REvil, a gang that researchers said has ties to BlackMatter. New Cooperative is a grain collective based out of Fort Dodge. In negotiations dated Sept. 19 and posted online, a person speaking on behalf of the company said the attack would cause severe problems in the food supply chain. “We are critical infrastructure – we [sic] intertwined with the food supply chain in the US,” they wrote. “If we are not able to recover very shortly, there is going to be a very […]
The post Ransomware gang strikes Iowa agriculture business New Cooperative, the latest hack on food supply chain appeared first on CyberScoop.
As law enforcement braces for the revival of the REvil ransomware gang, a cybersecurity firm on Thursday released a free decryption tool for early victims of the criminals. The decryptor, which Bitdefender developed in coordination with an unnamed law enforcement partner, will aid victims hit before July 13. The Romania-based company said it was still in the middle of an investigation with its partner, which agreed to release the decryptor before completing the joint inquiry to help as many victims as possible. Bitdefender has a long history of working with Europol to release tools that help victims of digital extortion sidestep the process of making a payment. “We believe new REvil attacks are imminent after the ransomware gang’s servers and supporting infrastructure recently came back online after a two month hiatus,” Bitdefender wrote in a blog post. According to another cybersecurity firm, Flashpoint, REvil is already fully back in business. […]
The post Bitdefender releases REvil decryptor as ransomware gang shows signs of return appeared first on CyberScoop.
Continue reading Bitdefender releases REvil decryptor as ransomware gang shows signs of return
Shortly after Congress took action on a $1 trillion infrastructure bill, hackers posing as U.S. Transportation Department officials offered fake project bid opportunities to seduce companies into handing over Microsoft credentials, researchers say. The ploy included layers of attempts to disguise the malicious appeals as authentic government solicitations, and even eventually led the would-be victims back to the actual Department of Transportation website, according to a Wednesday blog post from INKY, an email security company. “The basic pitch was, with a trillion dollars of government money flowing through the system, you, dear target, are being invited to bid for some of this bounty,” wrote Roger Kay, vice president of security strategy for the firm. Never mind that the infrastructure legislation hasn’t fully worked its way through Congress yet, nor that few of the phishing campaign’s targets would even be eligible for the infrastructure projects that bill would fund. It’s the […]
The post Email scammers posed as DOT officials in phishing messages focused on $1 trillion bill appeared first on CyberScoop.
The Cybersecurity and Infrastructure Security Agency is getting Kiersten Todt — a veteran of cyber-focused roles in the executive branch, on Capitol Hill and the private sector — as its chief of staff. Todt has been heading up the Cyber Readiness Institute, a non-profit focused on developing cybersecurity tools for small businesses. She now returns to the public sector at CISA, housed within the Department of Homeland Security. When she last worked for the federal government, it was as executive director of President Barack Obama’s Commission on Enhancing National Cybersecurity. Among the recommendations in its 2016 final report: creation of an agency just like CISA. Now, at CISA, Todt will focus on long-range objectives, allocating resources and the CISA workforce. “I look forward to shaping CISA’s long-term planning and working with industry, federal agencies, and state, local, tribal, and territorial government partners to chart the path forward for a more […]
The post CISA hires long-time cyber pro Kiersten Todt as chief of staff appeared first on CyberScoop.
Continue reading CISA hires long-time cyber pro Kiersten Todt as chief of staff
Another new ransomware gang is making waves with an unconventional structure, its unique pedigree and an early victim. A coalition of researchers on Thursday explained what makes Groove, a gang that quietly emerged in July with a website, different: Namely, it eschews the traditional ransomware-as-a-service hierarchy in favor of an opportunistic pledge that they’ll work with anyone as long as there’s money to be made. The researchers — from McAfee, Intel 471 and Coveware — traced the group’s origins to a likely split with the Babuk gang, part of a trend of turmoil within extortion groups that use the ransomware-as-a-service (RaaS) model where affiliates get to use an outfit’s malware in exchange for sharing profits. For instance, a disgruntled former Conti affiliate recently leaked the group’s attack playbook. Already, there’s evidence the researchers uncovered that Groove has worked with another ransomware gang, BlackMatter, that likewise recently emerged. That group is […]
The post Groove ransomware gang is a motley crew of disgruntled hackers, researchers say appeared first on CyberScoop.
Continue reading Groove ransomware gang is a motley crew of disgruntled hackers, researchers say
After a summer marked by big ransomware attacks from suspected Russian gangs, some of those same groups went quiet. National Cyber Director Chris Inglis said Thursday that it’s too early to tell if the trend will hold. “Those attacks have fallen off. Those syndicates have to some degree deconstructed,” Inglis said at an event hosted by the Ronald Reagan Presidential Foundation and Institute. “I think it’s a fair bet they have self-deconstructed and essentially gone cold and quiet to see whether the storm will blow over and whether they can then come back.” Whether they do so will depend largely on whether Russian President Vladimir Putin takes steps to undo the “permissive” atmosphere after U.S. President Joe Biden warned him repeatedly about ransomware attacks originating from his country. “It’s too soon to say we’re out of the woods on this,” Inglis said. The FBI blamed Russian ransomware gang REvil for […]
The post National cyber director declares ‘too soon to say we’re out of the woods,’ as US enjoys dip in ransomware appeared first on CyberScoop.
The Russian approach to hacking shifted considerably over the past year, with state-sponsored attacks on commercial organizations dropping off even as the local cybercrime scene dominated the field, CrowdStrike said in a report Wednesday. From July 2020 to June of this year, Russian state-backed hacking outfits accounted for only a tiny sliver of nation-sponsored attacks aimed at commercial enterprises detected by the cyber firm’s threat hunting service, at 1% compared to China’s 69%. (The figure represents the findings from only one threat intelligence firm, and does not account for hacking campaigns that CrowdStrike might have missed.) Meanwhile, the suspected Russia-based hacking group that CrowdStrike calls Wizard Spider, and that has used the Ryuk ransomware since 2018, was responsible for double the number of detected attempted intrusions of any other cybercrime gang over the same period. While CrowdStrike didn’t have comparison figures on the percentages of state-sponsored attacks on commercial organizations […]
The post Russian cybercrime continues as government-backed attacks on companies dwindle, CrowdStrike says appeared first on CyberScoop.