ISMG Editors: Chinese Hackers Raise Stakes in Cyberespionage

Anna Delaney • October 11, 2024

In the latest weekly update, ISMG editors discussed the implications of the U.S. investigation into Chinese hackers targeting telecom wiretap systems, the catastrophic risks of AI and the recent veto of an AI safety bill in the U.S., and the latest global ransomware response guidance.

►

CISO Trainings

Russia Arrests 100 in Cryptex Crypto Exchange Crackdown

Latest

Attack Surface Management

Hackers Prowling For Unencrypted BIG-IP Cookies, Warns CISA

David Perera • October 11, 2024

Unencrypted cookies tied to a suite of secure gateway technology from F5 are gateways for hackers to reach internal devices on corporate networks, warns the Cybersecurity and Infrastructure Security Agency. BIG-IP uses persistent cookies as a traffic load-balancing convenience.

Artificial Intelligence & Machine Learning

Regulating AI Catastophic Risk Isn't Easy

Rashmi Ramesh • October 11, 2024

An attempt by the California statehouse to tame the potential of artificial intelligence catastrophic risks hit a roadblock when Governor Gavin Newsom vetoed the measure late last month. One obstacle is lack of a widely-accepted definition for "catastrophic" AI risks.

Fraud Management & Cybercrime

Ransomware Task Force Details Impact of Disrupting Operators

Mathew J. Schwartz • October 11, 2024

While a Ransomware Task Force study of 2023 ransomware group disruptions finds they're often "tactical and temporary," report co-author Taylor Grossman said recent, major law enforcement actions may "really strategically pull them apart and make it harder for them to regroup."

Government

DOD Unveils Final CMMC Rule for Defense Contractors

Chris Riotta • October 11, 2024

The Department of Defense is set to implement significant changes to the Cybersecurity Maturity Model Certification program, effective October 15, streamlining compliance for contractors by introducing a tiered system while enhancing security standards.

Endpoint Security

European Council Adopts Cyber Resilience Act

Akshaya Asokan • October 10, 2024

The European Council on Thursday adopted security-by-design regulation that makes patching and vulnerability updates mandatory for connected devices. The regulation will ensure that "products with digital components are made secure throughout the supply chain and throughout their life cycle."

Fraud Management & Cybercrime

Operation Cronos Is Disrupting LockBit, Says UK Official

Akshaya Asokan • October 10, 2024

A British cybersecurity official touted Operation Cronos, an international operation against LockBit, saying multiple strikes aimed at the ransomware-as-a-service have disrupted its ability to recruit hackers. The operation has resulted in indictments, sanctions, and server takedowns.

Artificial Intelligence & Machine Learning

GenAI Impact on Election Disinformation Limited, Says OpenAI

Rashmi Ramesh • October 10, 2024

Foreign threat actors are using generative artificial intelligence to influence U.S. elections, but their impact is limited, said OpenAI. Threat actors from China, Russia, Iran, Rwanda and Vietnam maliciously used AI tools to support influence operations.

Artificial Intelligence & Machine Learning

Relyance AI Raises $32M to Take on AI Governance Challenges

Michael Novinson • October 10, 2024

Relyance AI raised $32 million in Series B funding to grow its data governance platform. The funds will be used to scale operations, enhance real-time data visibility, and support enterprises in complying with complex global privacy regulations, ensuring responsible AI adoption across industries.

Governance & Risk Management

SSA Struggling to Modernize Fraud Prevention Tech, GAO Warns

Chris Riotta • October 10, 2024

The Social Security Administration is facing criticism for failing to update its fraud prevention technology, leaving financial institutions and federal authorities at risk of missing synthetic identity scams, according to a new Government Accountability Office report.

Cybercrime

Breach Roundup: Global Signal Exchange to Curb Online Fraud

Anviksha More • October 10, 2024

This week, the Global Signal Exchange hopes to dent online crime, a Fidelity data breach, phishing platform targets Microsoft 365 users, October Patch Tuesday, Pavel Durov said he's always cooperated with police, Highline Public Schools and CreditRiskMonitor updates, ADT and Casio suffered breaches

Cybercrime

Internet Archive Data Breach Exposes 31 Million Accounts

Mathew J. Schwartz • October 10, 2024

The nonprofit Internet Archive has been hit by hackers, who stole usernames and for 31 million accounts, including email addresses and bcrypt-hashed passwords. In recent days, the digital archive has also suffered defacement and repeat denial-of-service attacks.

Incident & Breach Response

Marriott Pays $52M to Settle US States' Breach Litigation

David Perera • October 9, 2024

The world's largest hotel chain agreed Wednesday to pay $52 million and submit to 20 years of third-party monitoring of its cybersecurity program to settle a rash of data breaches affecting millions of guests. The sizeable payout is part of a settlement reached with 50 U.S. attorneys general.