Report: NSO Group Spyware Found on State Department Phones

Dan Gunderman • December 3, 2021

Spyware from sanctioned Israeli firm NSO Group has reportedly been detected on at least nine iPhones belonging to U.S. State Department officials with "state.gov" email addresses, who are located in Uganda or whose work focuses on Uganda, according to Reuters.

►

Cybercrime

Firm Held Onto Palo Alto VPN Zero-Day for 11 Months

Latest

Incident & Breach Response

Researcher: Healthcare Staffing Database Exposed Worker PII

Marianne Kolbasuk McGee • December 3, 2021

A security researcher says a misconfigured, non-password-protected database of a healthcare staffing company potentially exposed the personal information in about 170,000 medical worker records. The staffing firm, however, disputes the details of what was allegedly contained in the database.

3rd Party Risk Management

TSA Issues New Cybersecurity Requirements for Rail Sector

Dan Gunderman • December 3, 2021

The U.S. Transportation Security Administration has issued new security directives for higher-risk freight railroads, passenger rail, and rail transit that it says will strengthen cybersecurity across the transportation sector in response to growing threats to critical infrastructure.

Anti-Phishing, DMARC

Ingredients of a Good Insider Risk Program

Suparna Goswami • December 3, 2021

Any technology that allows you to do a full-person assessment by taking into account nontechnical data as well as technical data is a value-add to an insider risk program, says Peter J. Lapp, former special agent at the FBI. He discusses the ingredients in a good insider risk program.

Business Continuity Management / Disaster Recovery

BIO-ISAC: Beware of Tardigrade Attacks on Biomanufacturers

Marianne Kolbasuk McGee • December 3, 2021

The Bioeconomy Information Sharing and Analysis Center is warning biotechnology organizations, including vaccine makers and other biomanufacturers, of escalating threats involving Tardigrade malware, which experts say is used to launch ransomware and other potentially serious attacks.

Cybercrime

Arrest Points to Ubiquiti Breach Being an Inside Job

Prajeet Nair • December 3, 2021

A former employee of a New York-based technology company, likely to be IoT technology company Ubiquiti, has been arrested for stealing confidential data and extorting his employer for nearly $2 million. If convicted, the suspect faces up to 37 years in prison.

Account Takeover Fraud

Deepfakes, Voice Impersonators Used in Vishing-as-a-Service

Soumik Ghosh • December 3, 2021

Advanced voice impersonation and deepfake technologies are giving rise to cybercrime groups that offer Vishing-as-a-Service, security researchers say. Vishing is proving to be successful in tricking victims and bypassing voice authorization mechanisms.

Business Continuity Management / Disaster Recovery

Ransomware Operations Double Down on Data Leak Sites

Mathew J. Schwartz • December 3, 2021

Many ransomware-wielding attackers continue to rely on initial access brokers to easily gain deep access to victims' systems, allowing them to steal data and attempt to pressure victims into paying via data leak sites. Researchers say that the number of victims being listed on such sites has surged.

Account Takeover Fraud

ISMG Editors: Are We Close to Cracking Cybercrime Ecosystem?

Anna Delaney • December 3, 2021

In the latest weekly update, four editors at Information Security Media Group discuss important cybersecurity issues, including how the FBI has seized bitcoins from an alleged REvil ransomware affiliate, how to mitigate risks from BIN attacks and the latest COVID-19 trends globally.

Business Continuity Management / Disaster Recovery

Need to Negotiate a Ransomware Payoff? Newbies: Start Here

Anna Delaney • December 3, 2021

The latest edition of the ISMG Security Report features an analysis of best practices for negotiating a ransom payment. Also featured: Busting Zero Trust myths and the dangers of mythologizing defenders.

Critical Infrastructure Security

Cyber Officials Outline Critical Infrastructure Protections

Dan Gunderman • December 2, 2021

Several cybersecurity officials charged with safeguarding U.S. critical infrastructure on Thursday outlined both current progress and the complexity of today's network defense. Oversight officials also testifying before the House discussed top-line items that remain outstanding among major agencies.

Breach Notification

Planned Parenthood LA Data Exfiltrated, 400,000 Affected

Marianne Kolbasuk McGee • December 2, 2021

Planned Parenthood of Los Angeles is notifying about 400,000 individuals of a hacking incident in October involving the exfiltration of files containing sensitive health data, including patients' diagnoses and medical procedures. Could other similarly high-profile entities and their patients become the next targets?

Cybercrime

Report: Aberebot-2.0 Hits Banking Apps and Crypto Wallets

Soumik Ghosh • December 1, 2021

A new variant of the Aberebot banking Trojan has been discovered by Cyble's researchers. Christened Aberebot-2.0, the latest malware version not only uses more advanced spying capabilities, it also has increased its target list to 213 banking apps and nine crypto wallets in 22 countries.