Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Data Breaches. Show all posts
phishing threats
Application Security CPU Cyber Security Ransomware Attacks Data Breach Data Breaches Disaster Recovery Financial Cybersecurity Malware-as-a-Service Network Security NVIDIA Operational Security phishing threats

Building Trust Through Secure Financial Dealings


 

Unlike in the past, where money existed as physical objects rather than electronic data, today's financial market is about to be transformed into an increasingly digital one. The ability to protect digital financial assets has become a key priority for those working in the finance industry. 

There is an increasing likelihood that banks, investment houses, and insurance firms will be placed on the frontlines of a cyber-warfare that is rapidly deteriorating, targeted by criminals that are becoming more sophisticated by the day. 

It is especially crucial to note that the financial and insurance sectors are suffering the greatest losses from data breaches in 2023, averaging $5.17 million per incident, according to a report released by IBM in 2023. The digital transformation that has revolutionised the financial services industry has undoubtedly reduced friction, improved operational efficiency, and enhanced customer interactions. 

At the same time, it has increased vulnerabilities, exposing institutions and their clients to unprecedented risks. With the convergence of opportunity and threat, the need for rigorous cybersecurity measures has become an essential part of ensuring the survival and trust of the financial industry, not just as a necessity but as a defining necessity. 

There is a growing sense of importance to safeguarding financial institutions from cyber threats, commonly referred to as financial cybersecurity, and it has become one of the most important pillars of financial resilience for the financial industry. 

In addition to covering a wide range of protective measures, it also helps banks, credit unions, insurance firms, and investment companies to protect vast amounts of sensitive data and high-value transactions that they conduct daily. 

In spite of the fact that these organisations are entrusted with their clients' most sensitive financial details, cybercriminals remain prime targets for those seeking financial gain as well as ideological disruption. There are numerous threats to be aware of, and they range from sophisticated phishing attacks to increasingly complex ransomware strains such as Maze and Ryuk, to the more recent double extortion techniques designed to maximise the leverage of their victims. 

There have been numerous incidents recently that show how attackers can easily exfiltrate and publicly release millions of customer records in one single attack, with the effect of ripple effects across the global economy. In addition to these challenges, institutions are facing the rapid adoption of cloud technologies and managing sprawling supply chains that are inadvertently expanding their attack surface as a result of rapid digital transformation. 

In the context of this vulnerability, the 2020 SolarWinds compromise is an important reminder that stealthy intrusions are possible and that they can persist undetected for months while infiltrating critical financial systems, revealing the extent of these vulnerabilities. As customers increasingly trust digital platforms to handle their banking and investment needs, financial organisations are under tremendous pressure to deploy advanced security measures that can keep up with the evolving innovation of attackers. 

In addition to the immediate costs associated with ransom requests or stolen data, the stakes go much deeper than that. They threaten the very foundations of the financial system itself, and they threaten its stability and trust. A significant increase in remote work was sparked by the COVID-19 pandemic in 2024, leading to an unprecedented surge of cyberattacks, which not only persisted but also intensified.

In response to advancements in defence technology, cybercriminals have developed equally innovative offensive tactics as well, creating a constantly shifting battleground as a result. Among the most disruptive developments has been the rise of Malware-as-a-Service (MaaS), a service that makes sophisticated hacking tools accessible to a wider range of attackers, effectively lowering the barrier to entry.

In the same vein, artificial intelligence has been incorporated into criminal arsenals to make hyper-personalised attacks, which can include everything from deep-fake videos to cloned voices to highly convincing phishing campaigns tailored to individual targets. As far as financial institutions and accounting firms are concerned, the consequences are extremely severe. 

Global estimates indicate that data breaches will cost an average of $4.45 million per incident by 2023, which represents a 15 per cent increase over the past three years. Despite the financial toll of data breaches, reputational damage is also an existential concern, as firms face erosion of client trust and, in some cases, the necessity to close down their doors altogether due to reputational damage. 

In light of these convergences of risks, modern cybersecurity is not just a static protection, but a constant struggle to stay ahead of the game in terms of innovation and resilience. Financial institutions must understand the numerous layers of cybersecurity to be able to build resilient defences against a constantly changing threat environment. 

Across each layer, different roles are performed in safeguarding sensitive information, critical systems, and the trust of millions of customers. Network security, which is at the foundation of all computer networks and data communications, is one of the most important elements, ranging from firewalls and intrusion detection systems to secure virtual private networks to secure computer networks and data communications. 

Furthermore, application security is equally vital, as it ensures that banks and insurers are protected against vulnerabilities by testing their software and digital tools on a regular basis and by updating them regularly. 

The purpose of data security is to ensure that sensitive financial details remain safe and secure, whether they are in transit or at rest, by encrypting, masking, and implementing access controls to ensure that sensitive financial information does not fall into the hands of unauthorised users. 

Providing operational security in addition to these layers ensures that financial transactions remain accurate and confidential for the client. This is done through governing user permissions and data handling procedures, which safeguard data integrity and confidentiality. 

Finally, disaster recovery and business continuity planning ensure that, even if an institution suffers a breach or system failure, they have backups, redundant systems, and comprehensive recovery protocols in place to ensure it can quickly restore operations. 

It is important to note that despite the implementation of these frameworks, the finance industry continues to be threatened by sophisticated cyber threats, despite the fact that they have been in place for quite some time. Phishing campaigns remain among the most common and effective attacks, and fraudsters continue to pose as trusted financial organisations to trick users into disclosing sensitive data. 

There are many kinds of malware attacks, but the most devastating ones are ransomware attacks. They encrypt critical data and demand ransom payments from institutions that need to return to normal operations. 

A DDoS attack can also pose a significant challenge for online banks and trading platforms, overwhelming systems, often causing both financial and reputational damage in the process. Moreover, insider threats are particularly dangerous, whether they occur by negligence or by malice, given employees' privilege to access sensitive systems. 

Man-in-the-middle attacks, which intercept communications between clients and financial institutions, highlight the risk of digital financial interactions, with attackers intercepting data or hijacking transactions between clients and institutions. 

It can be argued that these threats collectively demonstrate the breadth and sophistication of the modern cyber threat and underline the importance of deploying multi-layered, adaptive security strategies in financial services. It is no longer just the U.S. government that is betting on Intel's growth. A new partnership between Intel and Nvidia has been formed to accelerate the development of artificial intelligence. 

In a deal designed to accelerate the development of artificial intelligence, Nvidia has acquired $5 billion worth of Intel shares as part of a new partnership. This agreement requires Intel to build personal computer chips incorporating Nvidia's GPUs, as well as custom CPUs, which will be embedded in Nvidia's AI infrastructure platforms.

Since Intel has been struggling to retain its previous position in computing in spite of fierce competition and rapidly advancing technology, this collaboration is an important one for the company. The company has, under Lip-Bu Tan's leadership, been going through a difficult restructuring process since he assumed the position of chief executive in March. This has involved hiring fewer employees, delayed construction of new facilities, and a renewed focus on securing long-term customers before expanding manufacturing capabilities. 

The Washington support has also played a critical role in Intel's revival efforts, although controversy has been associated with this as well. As the Biden administration pledged more than $11 billion in subsidies to Intel under the CHIPS Act, the Trump administration reversed course by arranging a deal in which the federal government would take a 10 per cent stake in Intel, thereby strengthening Intel's manufacturing base.

With this backdrop in mind, the partnership between Intel and Nvidia brings together two of the biggest players in the industry. By combining Intel’s established x86 ecosystem with Nvidia’s advanced artificial intelligence and accelerated computing technologies, it brings together the industry’s two most influential players. 

The market responded quickly to Intel's announcement: shares soared by more than 2 per cent on Thursday morning after the announcement, as analysts argued that the momentum could boost the S&P 500 to another record level. It is a significant achievement in the technology sector that Intel and Nvidia have come to an agreement that signals a transformational shift in the way innovation is being driven in an era of rapid digital transformation. 

Intel and NVIDIA have formed an alliance to combine Intel's x86 architecture and manufacturing capabilities with Nvidia's advanced artificial intelligence and accelerated computing capabilities. The alliance is expected to boost artificial intelligence infrastructure and improve processing efficiency, as well as unlock the next generation of computing solutions. 

Investors and stakeholders have many reasons to get excited about this collaboration, since it offers substantial opportunities for investors and stakeholders in the form of enhanced market confidence and an enhanced environment for the development of robust AI ecosystems for enterprise-level and consumer applications. 

The partnership not only provides financial and technological benefits, but it also illustrates the value of proactive adaptation to technological changes, showing how partnerships with government agencies and government-sponsored initiatives can enable businesses to maintain competitiveness. 

Furthermore, as cyber threats continue to rise alongside the digital transformation, integrating advanced artificial intelligence into computing platforms will strengthen security analytics, threat detection, and operational resilience at the same time. 

The Intel and Nvidia collaborations are creating a benchmark for industry leadership, sustainable growth, and market stability through aligning innovation with strategic foresight and risk-aware practices, demonstrating how forward-looking collaboration will shape the future of AI-driven computing and digital financial ecosystems.
Read more »
Ransomwares
Automobile Industry Cyber Attacks cybersecurity concerns Data Breaches data security IT Infrastructure Jaguar Land Rover Jaguar Land Rover Cybersecurity Breach disrupts Production Ransomwares

Jaguar Land Rover Cyberattack Breaches Data and Halts Global Production

Jaguar Land Rover (JLR), the UK’s largest automaker and a subsidiary of Tata Motors, has confirmed that the recent cyberattack on its systems has not only disrupted global operations but also resulted in a data breach. The company revealed during its ongoing investigation that sensitive information had been compromised, although it has not yet specified whether the data belonged to customers, suppliers, or employees. JLR stated that it will directly contact anyone impacted once the scope of the breach is confirmed. 

The incident has forced JLR to shut down its IT systems across the globe in an effort to contain the ransomware attack. Production has been halted at its Midlands and Merseyside factories in the UK, with workers told they cannot return until at least next week. Other plants outside the UK have also been affected, with some industry insiders warning that it could take weeks before operations return to normal. The disruption has spilled over to suppliers and retailers, some of whom are unable to access databases used for registering vehicles or sourcing spare parts. 

The automaker has reported the breach to all relevant authorities, including the UK’s Information Commissioner’s Office. A JLR spokesperson emphasized that third-party cybersecurity experts are assisting in forensic investigations and recovery efforts, while the company works “around the clock” to restore services safely. The spokesperson also apologized for the ongoing disruption and reiterated JLR’s commitment to transparency as the inquiry continues. 

Financial pressure is mounting as the costs of the prolonged shutdown escalate. Shares of Tata Motors dropped 0.9% in Mumbai following the disclosure, reflecting investor concerns about the impact on the company’s bottom line. The disruption comes at a challenging time for JLR, which is already dealing with falling profits and delays in the launch of new electric vehicle models. 

The attack appears to be part of a growing trend of aggressive cyber campaigns targeting global corporations. A group of English-speaking hackers, linked to previously documented attacks on retailers such as Marks & Spencer, has claimed responsibility for the JLR breach. Screenshots allegedly showing the company’s internal IT systems were posted on a Telegram channel associated with hacker groups including Scattered Spider, Lapsus$, and ShinyHunters. 

Cybersecurity analysts warn that the automotive industry is becoming a prime target due to its reliance on connected systems and critical supply chains. Attacks of this scale not only threaten operations but also risk exposing valuable intellectual property and sensitive personal data. As JLR races to restore its systems, the incident underscores the urgent need for stronger resilience measures in the sector.
Read more »
Ransomwares
customer data compromise Cyber Attacks Data Breaches Data Leak data security RansomHub RansomHub ransomware ransomware attacks Ransomware group Ransomwares

Manpower Data Breach Hits 145,000 After RansomHub Ransomware Attack

 

Manpower, one of the world’s largest staffing and recruitment companies, has confirmed that nearly 145,000 individuals had their personal data compromised following a ransomware attack in late December 2024. The company, which operates as part of ManpowerGroup alongside Experis and Talent Solutions, employs more than 600,000 workers across 2,700 offices worldwide and reported $17.9 billion in revenues last year. 

The breach came to light after the company investigated a systems outage at a Lansing, Michigan, franchise in January 2025. According to a filing with the Office of the Maine Attorney General, attackers gained unauthorized access to Manpower’s network between December 29, 2024, and January 12, 2025. In notification letters sent to affected individuals, Manpower revealed that certain files may have been accessed or stolen during this time. The company stated that the breach potentially exposed personal information, though the full scope of data compromised remains undisclosed. 

On July 28, 2025, the staffing firm formally notified 144,189 individuals that their data may have been involved in the incident. Following the discovery, Manpower announced that it had implemented stronger IT security measures and is cooperating with the FBI to pursue those responsible. To mitigate the impact on victims, the company is also offering complimentary credit monitoring and identity theft protection services through Equifax. 

The ransomware group RansomHub has claimed responsibility for the attack. In January, shortly after Manpower disclosed the incident, the group alleged that it had stolen 500GB of sensitive files from the company’s systems. According to RansomHub, the stolen trove included personal and corporate records such as passports, Social Security numbers, contact details, financial documents, HR analytics, and confidential contracts. The gang initially published details of the breach on its dark web site but later removed Manpower’s listing, raising speculation that a ransom may have been paid to prevent further data leaks. 

RansomHub is a ransomware-as-a-service (RaaS) operation that emerged in early 2024, evolving from earlier groups known as Cyclops and Knight. Since then, it has been linked to numerous high-profile attacks against global organizations, including Halliburton, Kawasaki’s European operations, Christie’s auction house, Frontier Communications, Planned Parenthood, and the Bologna Football Club. The group was also behind the leak of data stolen in the massive Change Healthcare cyberattack, one of the largest breaches in the U.S. healthcare sector, impacting more than 190 million individuals. 

Last year, the FBI reported that RansomHub affiliates had breached over 200 critical infrastructure organizations across the United States, further underlining the group’s reach and persistence. While ManpowerGroup has not confirmed the exact nature of the stolen data or whether negotiations occurred, a company spokesperson clarified that the incident was confined to an independently operated franchise in Lansing. The spokesperson emphasized that the franchise runs on a separate platform, meaning no ManpowerGroup corporate systems were compromised.

The breach highlights the growing risks ransomware attacks pose to global enterprises, particularly those handling large volumes of sensitive employee and client data. It also reflects how threat actors like RansomHub continue to exploit vulnerabilities in third-party and subsidiary operations, targeting organizations indirectly when direct access to corporate systems is more difficult.
Read more »
IBM Security
AI governance AI Risks AI Systems AI technology Breaches Cyber Security Data Breaches data security IBM IBM research IBM Security

Racing Ahead with AI, Companies Neglect Governance—Leading to Costly Breaches

 

Organizations are deploying AI at breakneck speed—so rapidly, in fact, that foundational safeguards like governance and access controls are being sidelined. The 2025 IBM Cost of a Data Breach Report, based on data from 600 breached companies, finds that 13% of organizations have suffered breaches involving AI systems, with 97% of those lacking basic AI access controls. IBM refers to this trend as “do‑it‑now AI adoption,” where businesses prioritize quick implementation over security. 

The consequences are stark: systems deployed without oversight are more likely to be breached—and when breaches occur, they’re more costly. One emerging danger is “shadow AI”—the widespread use of AI tools by staff without IT approval. The report reveals that organizations facing breaches linked to shadow AI incurred about $670,000 more in costs than those without such unauthorized use. 

Furthermore, 20% of surveyed organizations reported such breaches, yet only 37% had policies to manage or detect shadow AI. Despite these risks, companies that integrate AI and automation into their security operations are finding significant benefits. On average, such firms reduced breach costs by around $1.9 million and shortened incident response timelines by 80 days. 

IBM’s Vice President of Data Security, Suja Viswesan, emphasized that this mismatch between rapid AI deployment and weak security infrastructure is creating critical vulnerabilities—essentially turning AI into a high-value target for attackers. Cybercriminals are increasingly weaponizing AI as well. A notable 16% of breaches now involve attackers using AI—frequently in phishing or deepfake impersonation campaigns—illustrating that AI is both a risk and a defensive asset. 

On the cost front, global average data breach expenses have decreased slightly, falling to $4.44 million, partly due to faster containment via AI-enhanced response tools. However, U.S. breach costs soared to a record $10.22 million—underscoring how inconsistent security practices can dramatically affect financial outcomes. 

IBM calls for organizations to build governance, compliance, and security into every step of AI adoption—not after deployment. Without policies, oversight, and access controls embedded from the start, the rapid embrace of AI could compromise trust, safety, and financial stability in the long run.
Read more »
Scully Spiker
CrowdStrike outage DanaBot Data Breaches email threat Malicious Activities malware Qakbot Russian Espionage Scully Spiker

DanaBot Malware Enables Data Breaches and Russian Espionage

 


The United States has taken decisive action to eliminate one of the most persistent cybercrime threats in history by joining forces with international law enforcement bodies and several private cybersecurity companies to dismantle the infrastructure behind the notorious malware operation known as DanaBot, whose origins were linked to Russian state security interests over the past decade. 

During this multi-year campaign, hundreds of thousands of infected devices throughout the world were effectively cut off from the botnet's command and control channels by the seizure of the DanaBot server systems hosted within the United States. As CrowdStrike, the leading security company involved in the takedown, reports, the Defence Criminal Investigative Service (DCIS) has neutralised the operators’ ability to issue malicious directives. 

Thus, this criminal enterprise, as well as the wider network of Russian cyberproxies that are increasingly dependent on criminal syndicates for the advancement of their state-sponsored objective, has been disrupted by the operation. DanaBot, a banking Trojan that was tracked by security researchers under the name Scully Spider, has evolved over the years into a sophisticated tool that is capable of stealing credentials, espionaging, and leaking large quantities of data, which is an indication of the convergence between the interests of financial groups and geopolitical agents in espionage. 

A key aspect of cyber defence that is underscoring the importance of dismantling malware infrastructure is its ability to protect critical systems and expose hidden alliances that sustain digital espionage on a global scale, which is why the operation demonstrates the rise in the stakes of cyber defence. Identified and named in May of 2018 by Proofpoint researchers, DanaBot emerged at that time as a significant example of cybercrime malware that was provided as a service at a time when banking trojans predominated the landscape of email-delivered threats.

Initially, DanaBot was a popular payload for the prolific threat actor group TA547, who soon adopted it as their favourite payload, and it soon became a popular choice for other prominent cybercriminal collectives who wanted to take advantage of its versatility. The malware’s architecture was made up of an ever-evolving array of modules which performed both loader operations as well as core malicious functionality, in addition to sophisticated anti-analysis mechanisms that were aimed at frustrating security researchers and evading detection. 

Analysts from Proofpoint pointed out that DanaBot's technical signatures were distinct from earlier strains of financially motivated malware, including resemblances to Reveton ransomware, CryptXXX and others, suggesting that there was a more incremental evolution than an entirely new approach in this malware. 

There are a number of interesting facts about the name of this threat, including that it originated internally, after one researcher suggested that it be named in honour of a colleague's decision that the threat actors later adopted to market this malware to other criminals on the black market. 

A significant footprint was established by DanaBot in the email threat ecosystem during the period between 2018 and 2020 as a result of its extensive distribution by prominent cybercrime groups such as TA547, TA571, and TA564, allowing this threat to establish a substantial presence until its presence waned towards the middle of 2020. 

As a result of this decline, the cybercriminal underground as a whole shifted in the direction of a new generation of loaders, botnets, and information stealers, like IcedID and Qbot, which became increasingly the precursors to high-impact ransomware attacks, in parallel with broader trends within the cybercriminal underground. A resurgence of DanaBot activity has been confirmed through recent security telemetry, suggesting that the malware has been revised to meet the evolving needs of cybercrime as well as state-aligned espionage. 

There is no doubt that this resurgence of threat actors underscores their persistence in adapting to changing environments and continually recycling and retooling established attack frameworks to maintain their dominance in the global cyber world. At the heart of DanaBot was SCULLY SPIDER, an eCrime adversary based in Russia that developed and commercialised the malware to create a highly lucrative Malware-as-a-Service (MaaS) platform. 

It was DanaBot's modular design that set it apart from competing threats in May of 2018, which made it a rapidly spreading threat among cybercriminals, enabling clients to take advantage of credit card theft, large-scale wire fraud, and the targeted exfiltration of cryptocurrency wallets and related data that enabled its rapid adoption in the criminal underground as a result. As a result of DanaBot's adaptability as well as its robust monetisation features, its adoption across the criminal underground has been swift. 

There was, however, something that separated this operation from the typical financial-motivated campaigns in that the Russian authorities appeared to have given SCULLY SPIDER some latitude in their handling of the matter. Russian law enforcement is indeed capable of disrupting or prosecuting these activities, but they have not demonstrated a public record of doing so to date.

A pattern of tacit acceptance in cybercrime can be attributed to the Russian state's geopolitical strategy, which makes use of cybercriminals as de facto proxy forces to exert asymmetric pressure upon Western institutions while maintaining plausible deniability in the process. In its early stages, DanaBot was primarily targeting financial institutions and individuals in Ukraine, Poland, Italy, Germany, Austria, and Australia in its early phases.

A malware attack in October 2018, signalling the malware's operators' ambition to reach a higher-value target in mature financial markets, signalled the malware's operators' ambition to expand their target to banks and payment platforms. DanaBot's technical sophistication was evident from the very outset: early modules included Zeus-derived web injections, credential harvesting, keystroke logging, screen capture, and covert remote access using HVNC components - all of which enabled it to operate remotely. 

As Russia's cyber ecosystem has developed, the capabilities and covert operations of the country's principal security and intelligence agencies, including the Federal Security Service, the Foreign Intelligence Service and the General Staff (GRU), have formed the foundation of its formidable cyber ecosystem. Although not all of these entities are directly involved in financially motivated cybercrime, such as ransomware campaigns or the deployment of banking trojans, their connection with criminal hacking groups and willingness to rely on cyber proxies has helped create an environment where global threats remain persistent. 

There has been a significant increase in ransomware attacks over the past few years, and it is now one of the most destructive forms of cyber intrusion in history. Ransomware uses malicious code to encrypt or lock down entire systems when executed on an unsuspecting victim. After that, hackers often demand payment, often in hard-to-trace cryptocurrencies like Bitcoin and Ethereum, to regain access to their computer.

In addition to being profitable and disruptive, this strategy has played an important role in the proliferation of numerous cybercrime groups based in Russia. As a matter of fact, Centre 18 has a long history of combining state-aligned espionage with criminal hacking, and the FSB's main cyber unit has been a prominent player in the intersection of cybersecurity. About a decade ago, this unit made headlines for hiring a former hacker as a deputy director, an act that presaged a series of subsequent scandals. 

CCentre18 was implicated as being responsible for high-profile intrusions targeting U.S. political organisations during the 2016 presidential election, while the GRU, Russia's military intelligence agency, carried out parallel operations to extract sensitive data and disrupt democratic processes in parallel with them. The trajectory of Centre 18 came to a dramatic end when its leaders were exposed to an internal corruption scandal that resulted in charges of state treason being filed against the director, the hacker-turned-deputy director and several accomplices, who were all found guilty. 

While this setback may have had a significant impact on the pattern of cooperation between Russian intelligence services and criminal hackers, the overall pattern has remained relatively unchanged. In particular, one noteworthy example is that Russian hacker Aleksei Belan was recruited by the organisation. Belan is alleged to have played a significant role in the theft of billions of Yahoo email accounts in a breach widely regarded as the largest in history, which is widely regarded as an unprecedented event. 

The state-tolerated actors have been joined by groups such as Evil Corp that have developed a sprawling cybercrime operation. As a result of Evil Corp's development of Dridex (also called Bugat), the notorious banking trojan and ransomware toolkit, Maksim Yakubets' team was credited with the creation of this notorious malware.

Yakubets was indicted by the U.S. Department of Justice in 2019 for orchestrating attacks resulting in an estimated $100 million in fraud, demonstrating how ransomware has become a preferred weapon for profit as well as geopolitical manipulation. As well as stealing banking credentials, DanaBot's operators and criminal affiliates showed an extraordinary ability to perpetrate creative fraud schemes against the broader online economy. 

The users of DanaBot were eager to exploit any digital avenue available for illicit profit, and often chose e-commerce platforms as an ideal target because of their vulnerability to manipulation. It is worth noting that in a particularly notable case documented in the Kalinkin complaint, an affiliate used DanaBot to infiltrate an online storefront and orchestrate fictitious returns and fraudulent purchases. 

In leveraging stolen account credentials, the attackers were able to secure refund payments that far exceeded the original transaction amounts, causing significant financial losses to the retailer, who was unaware of the problem. A number of the victims were online merchants, who sustained fraud across their sales channels due to the malware's adaptability, which goes beyond conventional banking intrusions in order to show the malware's ability to adapt. 

As well as the variety and technical sophistication of the infection pathways used to facilitate these campaigns, DanaBot also routinely entered victim environments through large-scale spam email distributions and malvertising campaigns, which directed users to malicious sites containing exploits. It has also been observed that the malware is sometimes delivered as a secondary payload onto compromised systems, including those already compromised by loaders such as SmokeLoader, which firmly entrenches its position on the computer.

One particularly audacious approach that CrowdStrike observed in November 2021 involved enclosing DanaBot within a compromised version of the npm JavaScript runtime package, which was downloaded nearly 9 million times per week. By using this approach, the attackers demonstrated a willingness to exploit trusted software supply chains.

ESET researchers found that of all of these distribution methods, Google AdWords was identified as the most effective distribution method among them. In addition to creating malicious websites that appeared highly relevant to popular search queries, affiliates purchased paid ad placements to ensure their fraudulent links appeared prominently among legitimate results. Affiliates used this strategy to distribute their malicious websites across the web. 

A combination of social engineering techniques and manipulations of advertising platforms enticed unsuspecting users to download DanaBot under the guise of legitimate programs and services, resulting in the download of DanaBot. In addition to the deception of DanaBot operators, they also set up counterfeit IT support websites that claimed to be helpful resources for resolving technical problems. Those sites enticed users into copying and executing terminal commands, which, in reality, would initiate the process of installing malware. 

DanaBot's criminal network sustained a formidable presence with a multifaceted strategy involving email, ads, poisoned software packages, and fake support infrastructure. This illustrates how modern cybercrime has evolved into an agile enterprise that thrives on innovation, collaboration, and the exploitation of trust at all levels of the digital ecosystem, underpinning modern cybercrime as a modern enterprise. 

A critical lesson is that organisations should be aware of the constantly evolving threat landscape, as demonstrated by DanaBot. Many lessons can be gleaned from the longevity and reincarnation of the malware. Even well-known malware can still be very effective when attackers continually adjust their delivery methods, infrastructure, and monetisation strategies as well. 

It is essential that companies, especially those operating in the financial or personal data sector, are aware that resilience does not simply mean the protection of perimeters. Managing a proactive security posture, monitoring the supply chain dependencies continuously, and educating employees about social engineering are crucial pillars of protection. 

Moreover, there have been many instances of poisoned software repositories and malicious advertising, which underscores why we must scrutinise trusted channels as closely as we do untrusted channels. In a broader policy context, DanaBot's trajectory shows the strategic advantage that permissive or complicit nation-states can confer on cybercriminal operations through providing havens in which malware authors can refine and scale their capabilities without fear of disruption, and therefore providing a competitive advantage to cybercriminals. 

In light of this dynamic, regulators as well as multinational corporations must rethink traditional risk models and adopt intelligence-driven approaches to track threat actors beyond their technical signatures, scrutinising the threat actors' infrastructure, partnerships, and geopolitical ties of those actors. 

It is likely that malware-as-a-service platforms such as DanaBot will remain a persistent threat in the coming years, evolving along with changes in both underground economies and global political environments. For collective defences to be strengthened, coordination between the public and private sectors will be required, as well as the timely sharing of indicators of compromise and greater transparency from technology providers whose platforms are so often exploited as distribution channels by cyber criminals. 

Amidst a cybercrime era that has increasingly blurred into state-sponsored campaigns, vigilance, adaptability, and shared responsibility are no longer optional. They are the foundations on which digital trust and critical systems can be safeguarded as well as protected from a threat that doesn't seem to be receding.
Read more »
Third party breaches
Companies Data Breaches Ransomware Third party breaches

The Growing Danger of Third-Party Security Risks

 


A new study has surfaced a major cybersecurity concern for businesses: security vulnerabilities from third-party partners. According to a recent report by SecurityScorecard, more than a third of all data breaches in 2024 were linked to third-party service providers.


Underreported Threats

The research examined 1,000 cybersecurity incidents across different industries and regions. It found that 35.5% of breaches were due to third-party security weaknesses. However, experts believe the real number may be even higher due to many incidents being misclassified or not reported.


High-Risk Sectors

The report also revealed that the nature of these attacks is changing. In 2025, fewer third-party breaches involved technology services than in previous years. Only 46.75% of such breaches were linked to tech-related businesses, a decline from 75% the year before. This means cybercriminals are targeting a broader range of industries.

Among the most affected industries were retail and hospitality, which experienced the highest rate of third-party security breaches at 52.4%. The technology sector followed closely at 47.3%, while energy and utility companies saw a 46.7% breach rate. Even though the healthcare industry had a lower percentage of breaches (32.2%), it faced the highest total number of attacks, with 78 incidents recorded.


Global Hotspots for Third-Party Breaches

Certain countries saw a higher frequency of breaches. Singapore reported the most third-party cyber incidents, with 71.4% of breaches originating from external vendors. The Netherlands followed at 70.4%, while Japan recorded 60%.

The report also pointed out that ransomware groups are increasingly exploiting third-party connections to gain access to their targets. More than 41.4% of ransomware attacks now originate through a compromised third-party vendor. The notorious Cl0p ransomware gang has been particularly active in using this method.


Strengthening Security Measures

Cybercriminals favor third-party breaches because they allow access to multiple organizations at once. Security experts warn that businesses need to move away from occasional security checks of their vendors and instead implement continuous monitoring. By keeping a close watch on external partners' security measures, companies can reduce the risk of cyber threats before they escalate into major breaches.





Read more »
workplace AI tools
Cyber Security cybersecurity policies Data Breaches employee cybersecurity sensitive data risks workplace AI tools

Employee Cybersecurity Habits Are Increasing Organizational Risk: Survey

 


A recent survey involving over 14,000 employees across various industries has unveiled troubling trends in employee behavior that pose significant risks to organizational data security. The findings highlight common yet dangerous practices related to sensitive data management. 
 
Key Findings from the Survey 
 
The report sheds light on several concerning behaviors among employees:
  • Personal Devices: 80% of employees access workplace applications via personal devices that often lack adequate security measures.
  • Privileged Access: 40% of employees routinely download customer data, indicating that privileged access is no longer restricted to IT administrators.
  • Unrestricted Data Modification: One-third of respondents admitted to having the ability to modify sensitive data without restrictions.
  • Independent Financial Approvals: Nearly 30% of employees reported approving substantial financial transactions independently.
Poor Cybersecurity Practices 
 
The survey revealed widespread lapses in basic cybersecurity measures:
  • Reused Credentials: 49% of employees reuse login credentials across multiple work applications.
  • Mixed Use Credentials: 36% admitted to using the same credentials for both personal and professional accounts.
  • Policy Bypassing: 65% of respondents disclosed bypassing cybersecurity policies for personal convenience, increasing the risk of data breaches.
AI Tools and Escalating Security Concerns 
 
The adoption of workplace technologies like artificial intelligence is further complicating data security:
  • AI Usage: 72% of employees reported using AI tools in their work, with many inputting sensitive data.
  • Guideline Adherence: Only 38% of respondents consistently follow data-handling guidelines for AI usage, creating additional vulnerabilities.
The survey underscores the urgent need for organizations to address these alarming trends. Strengthening cybersecurity policies, enforcing compliance, and providing targeted training are essential to mitigate the risks posed by employee behavior. As emerging technologies like AI continue to reshape the workplace, maintaining robust data security practices remains paramount.
Read more »
Users Privacy
AI Chatbots Artificial Intelligence CyberCrime Cybersecurity CyberThreat Data Breaches Netskope Technology Users Privacy

AI Data Breach Reveals Trust Issues with Personal Information

 


Insight AI technology is being explored by businesses as a tool for balancing the benefits it brings with the risks that are associated. Amidst this backdrop, NetSkope Threat Labs has recently released the latest edition of its Cloud and Threat Report, which focuses on using AI apps within the enterprise to prevent fraud and other unauthorized activity. There is a lot of risk associated with the use of AI applications in the enterprise, including an increased attack surface, which was already discussed in a serious report, and the accidental sharing of sensitive information that occurs when using AI apps. 

As users and particularly as individuals working in the cybersecurity as well as privacy sectors, it is our responsibility to protect data in an age when artificial intelligence has become a popular tool. An artificial intelligence system, or AI system, is a machine-controlled program that is programmed to think and learn the same way humans do through the use of simulation. 

AI systems come in various forms, each designed to perform specialized tasks using advanced computational techniques: - Generative Models: These AI systems learn patterns from large datasets to generate new content, whether it be text, images, or audio. A notable example is ChatGPT, which creates human-like responses and creative content. - Machine Learning Algorithms: Focused on learning from data, these models continuously improve their performance and automate tasks. Amazon Alexa, for instance, leverages machine learning to enhance voice recognition and provide smarter responses. - Robotic Vision: In robotics, AI is used to interpret and interact with the physical environment. Self-driving cars like those from Tesla use advanced robotics to perceive their surroundings and make real-time driving decisions. - Personalization Engines: These systems curate content based on user behavior and preferences, tailoring experiences to individual needs.  Instagram Ads, for example, analyze user activity to display highly relevant ads and recommendations. These examples highlight the diverse applications of AI across different industries and everyday technologies. 

In many cases, artificial intelligence (AI) chatbots are good at what they do, but they have problems detecting the difference between legitimate commands from their users and manipulation requests from outside sources. 

In a cybersecurity report published on Wednesday, researchers assert that artificial intelligence has a definite Achilles' heel that should be exploited by attackers shortly. There have been a great number of public chatbots powered by large language models, or LLMs for short, that have been emerging just over the last year, and this field of LLM cybersecurity is at its infancy stage. However, researchers have already found that these models may be susceptible to a specific form of attack referred to as "prompt injection," which occurs when a bad actor sneakily provides commands to the model without the model's knowledge. 

In some instances, attackers hide prompts inside webpages that the chatbot reads later, so that the chatbot might download malware, assist with financial fraud, or repeat dangerous misinformation that is passed on to people by the chatbot. 

What is Artificial Intelligence?


AI (artificial intelligence) is one of the most important areas of study in technology today. AI focuses on developing systems that mimic human intelligence, with the ability to learn, reason, and solve problems autonomously. The two basic types of AI models that can be used for analyzing data are predictive AI models and generative AI models. 

 A predictive artificial intelligence function is a computational capability that uses existing data to make predictions about future outcomes or behaviours based on historical patterns and data. A creative AI system, however, has the capability of creating new data or content that is similar to the input it has been trained on, even if there was no content set in the dataset before it was trained. 

 A philosophical discord exists between Leibnitz and the founding fathers of artificial intelligence in the early 1800s, although the conception of the term "artificial intelligence" as we use it today has existed since the early 1940s, and became famous with the development of the "Turing test" in 1950. It has been quite some time since we have experienced a rapid period of progress in the field of artificial intelligence, a trend that has been influenced by three major factors: better algorithms, increased networked computing power, and a greater capacity to capture and store data in unprecedented quantities. 

Aside from technological advancements, the very way we think about intelligent machines has changed dramatically since the 1960s. This has resulted in a great number of developments that are taking place today. Even though most people are not aware of it, AI technologies are already being utilized in very practical ways in our everyday lives, even though they may not be aware of it. As a characteristic of AI, after it becomes effective, it stops being referred to as AI and becomes mainstream computing as a result.2 For instance, there are several mainstream AI technologies on which you can take advantage, including having the option of being greeted by an automated voice when you call, or being suggested a movie based on your preferences. The fact that these systems have become a part of our lives, and we are surrounded by them every day, is often overlooked, even though they are supported by a variety of AI techniques, including speech recognition, natural language processing, and predictive analytics that make their work possible. 

What's in the news? 


There is a great deal of hype surrounding artificial intelligence and there is a lot of interest in the media regarding it, so it is not surprising to find that there are an increasing number of users accessing AI apps in the enterprise. The rapid adoption of artificial intelligence (AI) applications in the enterprise landscape is significantly raising concerns about the risk of unintentional exposure to internal information. A recent study reveals that, between May and June 2023, there was a weekly increase of 2.4% in the number of enterprise users accessing at least one AI application daily, culminating in an overall growth of 22.5% over the observed period. Among enterprise AI tools, ChatGPT has emerged as the most widely used, with daily active users surpassing those of any other AI application by a factor of more than eight. 

In organizations with a workforce exceeding 1,000 employees, an average of three different AI applications are utilized daily, while organizations with more than 10,000 employees engage with an average of five different AI tools each day. Notably, one out of every 100 enterprise users interacts with an AI application daily. The rapid increase in the adoption of AI technologies is driven largely by the potential benefits these tools can bring to organizations. Enterprises are recognizing the value of AI applications in enhancing productivity and providing a competitive edge. Tools like ChatGPT are being deployed for a variety of tasks, including reviewing source code to identify security vulnerabilities, assisting in the editing and refinement of written content, and facilitating more informed, data-driven decision-making processes. 

However, the unprecedented speed at which generative AI applications are being developed and deployed presents a significant challenge. The rapid rollout of these technologies has the potential to lead to the emergence of inadequately developed AI applications that may appear to be fully functional products or services. In reality, some of these applications may be created within a very short time frame, possibly within a single afternoon, often without sufficient oversight or attention to critical factors such as user privacy and data security. 

The hurried development of AI tools raises the risk that confidential or sensitive information entered into these applications could be exposed to vulnerabilities or security breaches. Consequently, organizations must exercise caution and implement stringent security measures to mitigate the potential risks associated with the accelerated deployment of generative AI technologies. 

Threat to Privacy


Methods of Data Collection 

AI tools generally employ one of two methods to collect data: Data collection is very common in this new tech-era. This is when the AI system is programmed to collect specific data. Examples include online forms, surveys, and cookies on websites that gather information directly from users. 

Another comes Indirect collection, this involves collecting data through various platforms and services. For instance, social media platforms might collect data on users' likes, shares, and comments, or a fitness app might gather data on users' physical activity levels. 

As technology continues to undergo ever-increasing waves of transformation, security, and IT leaders will have to constantly seek a balance between the need to keep up with technology and the need for robust security. Whenever enterprises integrate artificial intelligence into their business, key considerations must be taken into account so that IT teams can achieve maximum results. 

As a fundamental aspect of any IT governance program, it is most important to determine what applications are permissible, in conjunction with implementing controls that not only empower users but also protect the organization from potential risks. Keeping an environment in a secure state requires organizations to monitor AI app usage, trends, behaviours, and the sensitivity of data regularly to detect emerging risks as soon as they emerge.

A second effective way of protecting your company is to block access to non-essential or high-risk applications. Further, policies that are designed to prevent data loss should be implemented to detect sensitive information, such as source code, passwords, intellectual property, or regulated data, so that DLP policies can be implemented. A real-time coaching feature that integrates with the DLP system reinforces the company's policies regarding how AI apps are used, ensuring users' compliance at all times. 

A security plan must be integrated across the organization, sharing intelligence to streamline security operations and work in harmony for a seamless security program. Businesses must adhere to these core cloud security principles to be confident in their experiments with AI applications, knowing that their proprietary corporate data will remain secure throughout the experiment. As a consequence of this approach, sensitive information is not only protected but also allows companies to explore innovative applications of AI that are beyond the realm of mainstream tasks such as the creation of texts or images.  
Read more »
Privacy
Apache Solir Cyberattacks CyberCrime Cybersecurity Cyberthreats Data Breach Data Breaches Deloitte Communication Hacker Forensic IntelBroker Privacy

IntelBroker Leak Claims Involve Deloitte Communications

 


An anonymous threat actor named IntelBroker claimed to be responsible for the leak of internal messaging from Deloitte, one of the world's leading auditing firms. According to reports, the breach occurred in September 2024 when an Apache Solr server had its default login credentials accidentally exposed to the internet, allowing unauthorized access to the server with default credentials. 

There are numerous types of data breaches which can be classified as violations of privacy. A breach of confidentiality can involve unauthorized access to, alteration, or release of personal data at an organization without its consent. In other words, a data breach does not only refer to releasing (leaking) the data but also to the underhanded data processing that initiates the release. 

There has been a breach in the security of personal data (as referred to in Article 13 of the Personal Data Protection Act of 2018) that has led to unauthorized access to the information. Whenever there is a data breach, personal data are exposed to loss or unauthorised processing, and these are the issues against which the security measures are meant to protect. 

An anonymous threat actor named IntelBroker claimed to be responsible for the leak of internal messaging from Deloitte, one of the world's leading auditing firms. A breach occurred when an Apache Solr server, an open-source search engine, was unintentionally exposed to the internet in September 2024, allowing unauthorized users to access the system. This oversight made Deloitte vulnerable, one of the leading auditing and consulting firms in the world. 

There is a wide range of information that has been compromised, including email addresses, internal settings, and intranet communications. As a result of the evidence that IntelBroker, which is part of the BreachForums community, provided, it is obvious that they were provided access to sensitive communications while using this platform, with evidence that supports this claim. 

Founded in 2004 as a resource for cybercriminals, BreachForums has become a hub for the organization ever since. With over 120,000 members, Hacker Forensics serves as the successor to RaidForums, an online market where stolen data and hacking tools are traded. The site has been the subject of law enforcement efforts that have led to multiple seizures of the site; however, it appears under different guises every time it is investigated. 

In this community, IntelBroker is an important figure and has been identified with several successful breaches that have resulted in high-level media attention. The breach forums have built up a reputation for being a hub for cybercriminals since their inception. As the successor to RaidForums, it facilitated the trade of stolen data and hacking tools online by supporting the trading of stolen data. 

There have been numerous seizures of the site by law enforcement agencies, but it has continued to resurface under various guises despite the efforts of law enforcement. Among the prominent figures in the cyber community, IntelBroker has become well-known for orchestrating several high-profile breaches over the years. 

There was a breach of security that was made possible by exploiting a vulnerability in Deloitte's Apache Solr server, which was left unpatched. Several organizations around the world use Apache Solr as their enterprise search platform due to its ease of use and reliability. If these vulnerabilities are not addressed properly, they can result in serious breaches of security in such software and to a person. 

With the increasing reliance on digital infrastructures by organizations, it is crucial to ensure these systems are secure from unauthorized access due to the prevalence of cyber attacks. To gather more information about the claim, Cyber Security News contacted Deloitte for more information. During the breach, Deloitte took advantage of an Apache Solr server that had been left unsecured by Deloitte, which enabled the hack. 

Several organizations around the world use Apache Solr as their enterprise search platform due to its ease of use and reliability. As a result, vulnerable systems can provide a home for severe security breaches if these vulnerabilities are not addressed properly. Organizations must ensure that their digital infrastructures are protected from unauthorized access to ensure that they will continue to operate successfully. 
Read more »
Vulnerabilities and Exploits
Data Breaches Data Exploit data security File Transfer Tool MOVEit Remote Workers Vulnerabilities and Exploits

Fresh MOVEit Vulnerability Under Active Exploitation: Urgent Updates Needed

 

A newly discovered vulnerability in MOVEit, a popular file transfer tool, is currently under active exploitation, posing serious threats to remote workforces. 

This exploitation highlights the urgent need for organizations to apply patches and updates to safeguard their systems. The vulnerability, identified by Progress, allows attackers to infiltrate MOVEit installations, potentially leading to data breaches and other cyber threats. MOVEit users are strongly advised to update their systems immediately to mitigate these risks. Failure to do so could result in significant data loss and compromised security. Remote workforces are particularly vulnerable due to the decentralized nature of their operations. The exploitation of this bug underscores the critical importance of maintaining robust cybersecurity practices and staying vigilant against emerging threats. 

Organizations should ensure that all systems are up-to-date and continuously monitored for any signs of compromise. In addition to applying patches, cybersecurity experts recommend implementing multi-layered security measures, including firewalls, intrusion detection systems, and regular security audits. Educating employees about the risks and signs of cyber threats is also essential in maintaining a secure remote working environment. The discovery of this MOVEit vulnerability serves as a reminder of the ever-evolving landscape of cybersecurity threats. 

As attackers become more sophisticated, organizations must prioritize proactive measures to protect their data and operations. Regularly updating software, conducting security assessments, and fostering a culture of cybersecurity awareness are key strategies in mitigating the risks associated with such vulnerabilities. 

Organizations must act swiftly to update their systems and implement comprehensive security measures to protect against potential cyberattacks. By staying informed and proactive, businesses can safeguard their remote workforces and ensure the security of their sensitive data.
Read more »
web filtering
Cyber Security CyberCrime Cybersecurity Data Breaches DNS filtering employee productivity high-risk sites internet access web filtering

Enhancing Workplace Security and Productivity with Effective Web Filtering

 

Internet access is essential in modern workplaces but can lead to distractions and security risks. To combat this, many employers use web filtering to block websites deemed unproductive or inappropriate.

The primary goal of web filters is to maintain employee productivity by limiting personal internet use during work hours. Additionally, they aim to reduce cybersecurity risks associated with high-risk sites. As cybercrime increases and data breaches become more costly, employers are enhancing web security policies to protect their organizations.

To better understand web filtering trends, the aggregated data from NordLayer’s DNS filtering service was analyzed. This research, which does not include identifiable business or user information, reveals the most commonly restricted website categories, helping create secure and productive work environments.

How Employees Are Affected By Website Filtering

Restricting internet access is crucial for boosting cybersecurity and productivity. Our research identified that 72% of employers block malware and adult content sites, while 43% block gambling websites. These findings are consistent with other studies showing widespread internet restrictions in corporate settings. For instance, a survey found that 64% of employees reported their company used a firewall to limit web access, though 40% bypass these controls using mobile data.

A 2018 study indicated that web filtering increases with company size: 96% of large businesses with over 1,000 employees restrict at least one online service, compared to 92% of midsize companies and 81% of small businesses. The same study estimated that 58% of employees spend over four hours per week on non-work-related sites without filtering, with 26% spending more than seven hours weekly on personal browsing. This translates to significant productivity losses, with full-time staff wasting 26 paid days annually.

Why Businesses Should Consider Web Filtering

While web filtering is already widely adopted, there are compelling reasons for more organizations to implement it as part of their cybersecurity and acceptable use policies.

From a security standpoint, restricting access to malware sites and other high-risk categories is crucial. Malware infections can lead to data breaches, disruptions, and financial losses. With the rise in cybercrime, web filtering serves as a preventive measure.

Beyond security, unrestricted internet access can lead to legal liabilities if employees access inappropriate or illegal content using company devices. This can result in regulatory violations, harassment issues from explicit material, or data exfiltration through file-sharing services.

Productivity is another key factor. Limiting personal internet use during work hours helps minimize distractions and increase focus on job duties. These benefits make a strong case for integrating web filtering into cybersecurity strategies.

How To Properly Implement Web Filtering

Balancing secure and productive internet access requires careful implementation. While some may see content filtering as restrictive, it is becoming essential to protect networks, data, and devices. Proper configuration and clear use policies can create a safer online workplace without hindering legitimate business activities.

Finding this balance is crucial for maximizing the internet’s business utility while safeguarding critical assets. Overly restrictive filtering that blocks essential work resources or categories like social media can frustrate employees and disrupt workflows.

The best approach involves thorough planning and customizing filtering rules to align with an organization’s needs and culture. Flexibility for temporary access and whitelist approvals for legitimate business purposes is essential. Collaboration between human resources, IT, and security departments is necessary to develop and communicate reasonable use policies.

Monitoring and adjusting filter effectiveness are also important. As new cybersecurity threats emerge and business needs evolve, filtering rules may need updates. Employee feedback can provide valuable insights into potential overblocking issues..
Read more »
Transparency
Cyber Security Data Breaches Financial Institutions SEC Regulations Transparency

Financial Institutions Now Required to Disclose Breaches Within 30 Days

Financial Institutions Now Required to Disclose Breaches Within 30 Days

The 30-Day Deadline

The Securities and Exchange Commission (SEC) is demanding financial institutions to report security vulnerabilities within 30 days of discovering them.

Why the Change?

On Wednesday, the SEC adopted revisions to Regulation S-P, which controls how consumers' personal information is handled. The revisions require institutions to tell individuals whose personal information has been compromised "as soon as practicable, but no later than 30 days" after discovering of illegal network access or use of consumer data. The new criteria will apply to broker-dealers (including financing portals), investment businesses, licensed investment advisers, and transfer agents.

"Over the last 24 years, the nature, scale, and impact of data breaches has transformed substantially. These amendments to Regulation S-P will make critical updates to a rule first adopted in 2000 and help protect the privacy of customers’ financial data. The basic idea for covered firms is if you’ve got a breach, then you’ve got to notify. That’s good for the investor,” said SEC Chair Gary Gensler. 

Challenges and Compliance

Notifications must describe the occurrence, what information was compromised, and how impacted individuals can protect themselves. In what appears to be a loophole in the regulations, covered institutions are not required to provide alerts if they can demonstrate that the personal information was not used in a way that caused "substantial harm or inconvenience" or is unlikely to do so.

The revisions compel covered institutions to "develop, implement, and maintain written policies and procedures" that are "reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information." The amendments include:

The standards also increase the extent of nonpublic personal information protected beyond what the firm gathers. The new restrictions will also apply to personal information received from another financial institution.

SEC Commissioner Hester M. Peirce expressed concern that the new regulations could go too far.

Best Practices

"Today’s Regulation S-P modernization will help covered institutions appropriately prioritize safeguarding customer information," she said. "Customers will be notified promptly when their information has been compromised so they can take steps to protect themselves, like changing passwords or keeping a closer eye on credit scores. My reservations stem from the rule's breadth and the likelihood that it will spawn more consumer notices than are helpful."

Regulation S-P has not been substantially modified since its adoption in 2000.

Last year, the SEC enacted new laws requiring publicly traded businesses to disclose security breaches that have materially affected or are reasonably projected to damage business, strategy, or financial results or conditions.

Read more »
Security
8Base Cyber Attacks CyberCrime Cyberscoop Cybersecurity CyberThreat Cyberthreats Data Breaches Security

UN Agency Faces Data Crisis: Ransomware Hack Exposes Extensive Data Theft

 


It is reported that the United Nations Development Programme (UNDP) is investigating a cyberattack involving human resources information stolen from its IT systems due to a breach. To eradicate poverty, fight inequality, and eliminate exclusion from society, UNDP, the UN's global development network, works in more than 170 countries and territories.

Donations are received from UN member states, private companies, and multilateral organizations. According to a statement released by the organisation published Tuesday, there was a hack in the local IT infrastructure at UN City, Copenhagen, in late March. In a statement released by the UNDP on Tuesday, the organization said that a “data extortion actor” had stolen human resources and procurement information in UN City, Copenhagen and that the IT infrastructure was targeted.

In the statement, it was not disclosed what kind of data had been stolen from the organization that is the lead agency on international development for the UN. According to notifications shared with affected parties and viewed by CyberScoop, hackers were able to access several servers and steal data that was significant in scope. 

CyberScoop was informed that the notification information included in its notification may include data about former and current employees' family members, as well as information about contractors, including dates of birth, social security numbers, bank account information, passport details, and information about their bank accounts, bank accounts, and passports. 

A UNDP entry on the 8Base ransomware gang's dark web data leak website has been added to its dark web data leak website since March 27, but the UN agency has yet to identify a specific threat group responsible for the attack. In their assertions, the attackers claim their operators were able to exfiltrate large amounts of sensitive information through the documents they were able to acquire during the breach. 

They allegedly leaked a large amount of confidential information via a now-extinct link, including personal information, accounting data, certificates, employment contracts, confidentiality agreements, invoices, receipts, and much more, according to the reports. They emerged in March 2022, and they spiked their activity in June 2023 after they began attacking companies across a greater range of industry verticals and switched to double extortion to increase their revenue. 

Data leaks were a major issue for the extortion group in May of 2023 when they claimed to be "honest and simple" pen testers that targeted "companies that neglected employees' and customers' privacy and the importance of their data." There have been over 350 victims listed on the site of this ransomware group so far, with some days announcing up to six victims at the same time. 

In 8Base, a custom version of Phobos ransomware has been used, a malicious program that emerged in 2019 and has many code similarities to the Dharma ransomware family. Additionally, in January 2021, the United Nations Environmental Programme (UNEP) announced that over 100,000 employee records containing personally identifiable information (PII) were made available online after a data breach. 

In July 2019, there was also a breach of UN networks in Geneva and Vienna, where a Sharepoint vulnerability allowed access to personnel records, health insurance data, and commercial contract data in an event, that a UN official described as a "major meltdown."
Read more »
Technology
AI Cybersecurity Data Breaches Deepfake Technology Digital Security Frank Abagnale online accounts passkey authentication Phishing Scams Social Engineering Technology

Expert Urges iPhone and Android Users to Brace for 'AI Tsunami' Threat to Bank Accounts

 

In an interview with Techopedia, Frank Abagnale, a renowned figure in the field of security, provided invaluable advice for individuals navigating the complexities of cybersecurity in today's digital landscape. Abagnale, whose life inspired the Steven Spielberg film "Catch Me If You Can," emphasized the escalating threat posed by cybercrime, projected to reach a staggering $10.5 trillion by 2025, according to Cybersecurity Ventures.

Addressing the perpetual intersection of technology and crime, Abagnale remarked, "Technology breeds crime. It always has and always will." He highlighted the impending challenges brought forth by artificial intelligence (AI), particularly its potential to fuel a surge in various forms of cybercrimes and scams. Abagnale cautioned against the rising threat of deepfake technology, which enables the fabrication of convincing multimedia content, complicating efforts to discern authenticity online.

Deepfakes, generated by AI algorithms, can produce deceptive images, videos, and audio mimicking real individuals, often exploited by cybercriminals to orchestrate elaborate scams and extortion schemes. Abagnale stressed the indispensability of education in combating social engineering tactics, emphasizing the importance of empowering individuals to recognize and thwart manipulative schemes.

One prevalent form of cybercrime discussed was phishing, a deceitful practice wherein attackers manipulate individuals into divulging sensitive information, such as banking details or passwords. Phishing attempts typically manifest through unsolicited emails or text messages, characterized by suspicious links, urgent appeals, and grammatical errors.

To fortify defenses against social engineering and hacking attempts, Abagnale endorsed the adoption of passkey technology, heralding it as a pivotal advancement poised to supplant conventional username-password authentication methods. Passkeys, embedded digital credentials associated with user accounts and applications, streamline authentication processes, mitigating vulnerabilities associated with passwords.

Abagnale underscored the ubiquity of passkey technology across various devices, envisioning its eventual displacement of traditional login mechanisms. This transition, he asserted, is long overdue and represents a crucial stride towards enhancing digital security.

Additionally, Techopedia shared practical recommendations for safeguarding online accounts, advocating for regular review and pruning of unused or obsolete accounts. They also recommended utilizing tools like "Have I Been Pwned" to assess potential data breaches and adopting a cautious approach towards hyperlinks, assuming every link to be potentially malicious until verified.

Moreover, users are advised to exercise vigilance in verifying the authenticity of sender identities and message content before responding or taking any action, mitigating the risk of falling victim to cyber threats.
Read more »
transport
China Data Breaches geographic Military Safety Security transport

China Issues Alert on Geographical Information Data Breaches Impacting Transportation and Military

 

 China has recently issued a stern warning regarding the use of foreign geographic software, expressing serious concerns about the potential leakage of critical information related to its essential infrastructure and military. The Ministry of State Security, while refraining from directly attributing blame, has asserted that the identified software is equipped with "backdoors," designed to facilitate deliberate and unauthorized access to sensitive data.

This cautionary move comes at a time of heightened global tensions, with China prioritizing the reinforcement of security measures within key industries. This focus on security has been particularly accentuated amid increased saber rattling towards Taiwan and continued assurances from the United States to the island nation.

There is a growing suspicion that China may be involved in a series of recent cyberattacks aimed at probing the infrastructure of the United States. The alleged objective is to develop a comprehensive attack playbook, presumably in anticipation of potential hostilities between the two superpowers.

In response to these concerns, the United States has taken proactive steps to secure the domestic production of semiconductors, earmarking substantial investments under the CHIPS Act. The objective is to establish semiconductor manufacturing facilities across the country, a move considered essential for national security.

This strategic initiative by the United States is underscored by the perceived risk of Chinese espionage associated with the current reliance on semiconductor imports from production hubs in East Asia. The investment in domestic semiconductor production is thus framed as a crucial measure to mitigate vulnerabilities and safeguard national interests in the face of evolving geopolitical dynamics..
Read more »
Subscribe to: Posts (Atom)