Rachel Monroe has an interesting profile of a ransom negotiator in The New Yorker. But the piece also provides an answer to a puzzling claim in a blog post by REvil that referred to fraudulent middlemen. When the negotiator hired by a victim entered the chat, they discovered that someone had already been negotiating with…
Category: Commentaries and Analyses
Ethical disclosures are being ignored: an unchecked security crisis
Ron Nahamias, Cyberpion co-founder and CBO, has a piece in Security Magazine that includes a topic near and dear to my heart — companies that do not provide a way to notify them of a security breach, leak, or vulnerability. He writes, in part: Sometimes the burying of the head in the sand, even if…
Russia’s FSB reports ‘unprecedented’ hacking campaign aimed at government agencies
Reuters reports: Foreign hackers compromised Russian federal agencies in a digital espionage campaign that Russian officials described as unprecedented in scope and sophistication. The little-noticed report – published this month by Russia’s FSB security service and Rostelecom-Solar, the cybersecurity arm of telecoms company Rostelecom (RTKM.MM) – provides an unusually detailed look at a purportedly state-backed cyber spying…
Ransomware Unmasked: Dispute Reveals Ransomware TTPs
Two of the more well-known Russian-language forums have “arbitration” or “complaint” sections where members can present complaints and evidence against other members involving financial disputes or claims. Those disputes, with evidence provided non-publicly to the moderators/arbitrators, often provide interesting insights into threat actors’ methods or relationships. In the past few weeks, there have been two…
After going up, up, up, will ransom payments in healthcare and education sectors start dropping?
Key points: More than half of ransomware victims reportedly pay ransom, but there is an absence of quality data and reporting that would enable better analyses. As payouts have increased, the number of customers electing to have cyberinsurance coverage (the take-up rate) has increased, although SMBs lag behind mid- to large-sized entities. As payouts have…
One Employee’s Accidental Email Leads To A Significant Data Breach Ruling in Federal Appeals Court
Jeffrey Csercsevits of Fisher Phillips writes: A federal appeals court recently addressed whether employees had standing to bring a lawsuit when their personally identifiable information (PII) was inadvertently circulated to other employees at the company, with no indication of misuse or external disclosure. In McMorris v. Carlos Lopez & Associates, LLC, the 2nd Circuit Court of…