Lindsey O’Donnell-Welch reports: A series of campaigns, with links to the threat actor behind the SolarWinds supply-chain intrusion, have been targeting cloud service providers with a new malware loader variant called CeeLoader. Researchers with Mandiant in a Monday analysis said they identified two distinct clusters of activity, UNC3004 and UNC2652, which they associate with UNC2452 (also known…
Category: Commentaries and Analyses
U.S. Military Has Acted Against Ransomware Groups, General Acknowledges
Julian E. Barnes reports: The U.S. military has taken actions against ransomware groups as part of its surge against organizations launching attacks against American companies, the nation’s top cyberwarrior said on Saturday, the first public acknowledgment of offensive measures against such organizations. […] General Nakasone would not describe the actions taken by his commands, nor…
TSA issues security rules for rail operators
Lindsey O’Donnell-Welch reports: New cybersecurity requirements from the Transportation Security Administration (TSA) give freight railroads, passenger rail and rail transit operators a 24-hour deadline for reporting security incidents. Starting on Dec. 31, “high-risk” operators and owners across the rail sector must take a number of steps to bolster the cybersecurity of their systems. They must…
Who Is the Network Access Broker ‘Babam’?
Brian Krebs reports: Rarely do cybercriminal gangs that deploy ransomware gain the initial access to the target themselves. More commonly, that access is purchased from a cybercriminal broker who specializes in acquiring remote access credentials — such as usernames and passwords needed to remotely connect to the target’s network. In this post we’ll look at…
FBI says the Cuba ransomware gang made $43.9 million from ransom payments
Catalin Cimpanu reports: The US Federal Bureau of Investigations said today that the operators of the Cuba ransomware have earned at least $43.9 million from ransom payments following attacks carried out this year. In a flash alert sent out on Friday, the Bureau said the Cuba gang has “compromised at least 49 entities in five critical…
Z-CERT: “Small healthcare institutions are generally more vulnerable than large healthcare institutions, such as hospitals”
Interview with the director Wim Hafkamp and security specialist Jan Hanstede of Z-CERT by the DeCrisis manager Which type of healthcare institutions do you feel are the most vulnerable to such a threat? “Small healthcare facilities are generally more vulnerable than large healthcare facilities, such as hospitals. This is because they have less feeling for IT. They…