Content by Mathew J. Schwartz

Ransomware Groups Seek Fresh Tactics Following Hive Takedown

Mathew J. Schwartz  •  March 27, 2023

Stung by the FBI's infiltration and takedown of the Hive ransomware group, other ransomware operators have been retooling their approaches to make their attacks more effective and operations tougher to disrupt, says Yelisey Bohuslavskiy, chief research officer at threat intelligence firm Red Sense.

GitHub Replaces Private RSA SSH Key After Public Exposure

Mathew J. Schwartz  •  March 24, 2023

GitHub has replaced its private RSA SSH host key after discovering it was being inadvertently exposed to the public via a GitHub repository. Used to safeguard SSH access to Git operations, a bad actor could use the key to impersonate GitHub or eavesdrop. But GitHub reported no signs of abuse.

TikTok CEO Aims to Assure Lawmakers Americans' Data Is Safe

Mathew J. Schwartz  •  March 23, 2023

TikTok CEO Shou Chew appeared Thursday before the U.S. congressional panel to defend his company against accusations that it's imperiling Americans' national security, privacy and mental health. Lawmakers pressed Chew on the company's Chinese ownership, source code and privacy practices.

Russians Can Use Crypto to Evade Sanctions, Researchers Warn

Mathew J. Schwartz  •  March 23, 2023

Dark web merchants have been offering Russians - consumers and criminals alike - services for bypassing international sanctions that may indirectly involve U.S. financial institutions, demonstrating the need for more robust "know your customer" and anti-money laundering checks, researchers warn.

Stung by Free Decryptor, Ransomware Group Embraces Extortion

Mathew J. Schwartz  •  March 22, 2023

Not all ransomware groups wield crypto-locking malware. Some have adopted other strategies. Take BianLian. After security researchers released a free decryptor for its malware, instead of encrypting files, the group chose to steal them and demand ransom solely for their safe return.

Hackers Are Actively Exploiting Unpatched Adobe ColdFusion

Mathew J. Schwartz  •  March 22, 2023

Hackers have been actively exploiting vulnerabilities in ColdFusion to remotely compromise servers, Adobe warns. Since at least early January, attackers have been dropping web shells via ColdFusion, but it's unclear if only now-known vulnerabilities are being exploited, security researchers say.

How Russia's Ukraine War Disrupted the Cybercrime Ecosystem

Mathew J. Schwartz  •  March 20, 2023

Russia's invasion of Ukraine in 2022 threw Russia's cybercrime ecosystem into a state of upheaval that still exists to this day. "We identified disruptions to literally every single form of commodified cybercrime," said Alexander Leslie, associate threat intelligence analyst at Recorded Future.

TikTok Says US Threatens Ban Unless Chinese Owners Divest

Mathew J. Schwartz  •  March 17, 2023

TikTok says the Biden administration has demanded that the company's Chinese owners divest their stake in the company or risk seeing the app get banned in America. The U.S., Canada, EU, U.K. and New Zealand have all banned the use of TikTok on government devices, citing national security concerns.

Russia May Be Reviving Cyber Ops Ahead of Spring Offensive

Mathew J. Schwartz  •  March 16, 2023

What happens next in Russia's all-out invasion of Ukraine isn't clear, but experts have been tracking signs that Moscow may be preparing for intensified cyber operations ahead of a spring offensive, developing new wiper malware and getting ready to interfere in European elections and foreign policy.

Rubrik Breached Via Zero-Day Attack Exploiting GoAnywhere

Mathew J. Schwartz  •  March 15, 2023

Cybersecurity software giant Rubrik has joined the ranks of organizations that fell victim to attackers who have been exploiting a zero-day vulnerability in Fortra's widely used managed file transfer software, GoAnywhere MFT. The Clop ransomware gang claims to have exploited at least 130 victims.

Darknet Markets Thrive Despite Repeat Disruptions by Police

Mathew J. Schwartz  •  March 14, 2023

Despite repeated disruptions by law enforcement, underground cybercrime markets continue to thrive. Researchers are tracking the debut of 190 "significant" new darknet markets in 2022, connecting illegal data and access brokers with ransomware groups, fraudsters and others.

LockBit Ransomware Group Claims SpaceX Contractor Data Theft

Mathew J. Schwartz  •  March 14, 2023

The LockBit ransomware operation claims to have stolen data from a Texas-based supplier to Elon Musk's SpaceX, which designs, manufactures and launches rockets and spacecraft. It's the latest PR-grabbing attempt by the prolific LockBit extortion group.

Ukraine Tracks Increased Russian Focus on Cyberespionage

Mathew J. Schwartz  •  March 13, 2023

As Russia's full-scale invasion of Ukraine last year stalled, Russian hacking teams increasingly shifted from causing all-out disruption to cyberespionage, data theft and psychological operations, Ukraine's cybersecurity establishment says in a new lessons learned report.

Blackbaud to Pay $3 Million Over 'Erroneous' Breach Details

Mathew J. Schwartz  •  March 10, 2023

Fundraising and customer relationship management software provider Blackbaud has reached a $3 million settlement agreement with the Securities and Exchange Commission over allegations it made "misleading disclosures about a 2020 ransomware attack that impacted more than 13,000 customers."

US Intelligence Ranks China as Top National Security Threat

Mathew J. Schwartz  •  March 9, 2023

The Chinese government's geopolitical ambitions and willingness to use cyber operations to achieve them pose one of the biggest threats to U.S. national security, the U.S. intelligence community warns. Russia, Iran and North Korea also pose major threats, as do cybercrime and especially ransomware.