Latest

Novel Android Malware Targets Korean Banking Users

Prajeet Nair  •  April 18, 2024

A new banking Trojan is targeting Korean users using obfuscation techniques that target the Android manifest, exploit vulnerabilities and take advantage of weaknesses in how Android apps interpret this file. SoumniBot stands out for its approach to camouflaging its malicious intent.

Cybercrime

Breach Roundup: LabHost Goes Down

Anviksha More  •  April 18, 2024

This week, police took down the LabHost phishing-as-a-service site, customer data compromised in Omni Hotels hack, more Ivanti vulnerabilities, a Moldovan botnet operators faces U.S. charges, Cisco warned of data breach in Duo and a Spanish Guardia Civil contractor suffered a ransomware attack.

Critical Infrastructure Security

Hacking the Floodgates: U.S. Dams Face Growing Cyber Threats

Chris Riotta  •  April 18, 2024

Cybersecurity experts and top lawmakers are warning that a successful cyberattack targeting federally-regulated dams across the United States - the majority of which have not received a cyber audit - could result in a severe impact on public health and even mass casualties.

Governance & Risk Management

As NSA Pushes for Microsegmentation, Will Others Follow?

Suparna Goswami  •  April 18, 2024

The National Security Agency last month issued guidance on advancing zero trust programs through the network and environment pillar, with a key focus on microsegmentation. While the concept of microsegmentation is nothing new, why is the NSA behind it? And when will others follow?

Blockchain & Cryptocurrency

Cryptohack Roundup: First Conviction in Smart Contract Hack

Rashmi Ramesh  •  April 18, 2024

Every week, ISMG rounds up cybersecurity incidents in digital assets. This week, sentencing in the first-ever conviction for hacking a smart contract, indictment in a million-dollar illicit mining, FTX executive's sentencing, Railgun's money-laundering defense and Uniswap's Wells Notice.

Fraud Management & Cybercrime

Company Says Change Healthcare Hackers Stole Sensitive Data

Marianne Kolbasuk McGee  •  April 18, 2024

UnitedHealthGroup said for the first time that hackers behind a February ransomware attack against Change Healthcare breached sensitive health information, an admission that triggers a regulatory countdown clock for public disclosures and individual notification.

Cybercrime as-a-service

Dark Web Sales Driving Major Rise in Credential Attacks

Jayant Chakravarti  •  April 18, 2024

The value of corporate credentials in the cybercrime market contributed to a 643% increase in data theft attacks over the past three years, cybersecurity company Kaspersky says. Malicious access brokers stole close to 400 million logins and passwords for numerous websites in the past year.

Cloud Security

From $8.3B to $200M: Why Lacework Is Examining a Sale to Wiz

Michael Novinson  •  April 18, 2024

Wiz is in advanced negotiations to buy Lacework for between $150 million and $200 million. The companies recently signed a letter of intent and are now in the midst of a comprehensive due diligence process, after which a decision will be made on whether the acquisition will go through.

General Data Protection Regulation (GDPR)

EU Data Regulator Threatens Meta's 'Pay or Okay' Model

Akshaya Asokan  •  April 17, 2024

Social media giant Meta's attempt to navigate European data protection rules by offering a fee-based opt-out from behavioral advertising came under fire Wednesday by a trading bloc agency that said freedom from personalized marketing should typically be free.

Cloud Security

Possible Chinese Hackers Use OpenMetadata to Cryptomine

Prajeet Nair  •  April 17, 2024

Hackers who appear to be Chinese are exploiting vulnerabilities in the OpenMetadata platform running as workloads on Kubernetes clusters to download cryptomining software, warned Microsoft. "I want to buy a car," the hackers tell victims in a note and solicit monero donations.

Artificial Intelligence & Machine Learning

Armis Buys Cyber Remediation Startup Silk Security for $150M

Michael Novinson  •  April 17, 2024

San Francisco-based asset intelligence vendor Armis plans to embed AI and automation into the incident prioritization and remediation process through the $150 million acquisition of early-stage startup Silk Security to minimize manual intervention and maximize efficiency.

Governance & Risk Management

Key Lawmaker Heralds 'Landmark' Draft Federal Privacy Bill

Chris Riotta  •  April 17, 2024

Rep. Cathy McMorris Rodgers, R-Wa., chair of the House Energy and Commerce Committee, suggested Wednesday that a draft national data privacy bill making its way through Congress could be the best shot in decades for lawmakers to pass a comprehensive federal privacy law.