Content by Mathew J. Schwartz

Red Cross Tells Hacktivists: Stop Targeting Hospitals

Mathew J. Schwartz  •  October 4, 2023

Hacktivists who hit healthcare or otherwise target civilians are violating international humanitarian law, warns the International Committee of the Red Cross. As many self-proclaimed hacktivists appear to be Russian government cutouts, will legal threats make them rethink their life choices?

Alert: Attackers Actively Exploiting WS_FTP Vulnerabilities

Mathew J. Schwartz  •  October 2, 2023

Large enterprises, including government and educational organizations, are being warned to immediately update their WS_FTP Server, built by Progress Software, to fix serious flaws being actively exploited by attackers. Secure file transfer software remains a top target, especially for extortionists.

Data Breach Toll Tied to Clop Group's MOVEit Attack Surges

Mathew J. Schwartz  •  September 25, 2023

The count of organizations affected by the Clop ransomware group's most recent mass targeting of Progress Software's secure file transfer software doubled last week. National Student Clearinghouse warned that data tied to nearly 900 colleges and universities had been stolen from its MOVEit server.

MGM Resorts Says Hotels 'Operating Normally' After Attack

Mathew J. Schwartz  •  September 22, 2023

MGM Resorts International says its hotels and casinos are now operating "normally" after the company was hit by ransomware-wielding attackers. Even so, numerous systems remain offline - including digital room key cards - as the company seeks to rebuild its IT infrastructure.

Canada Confirms DDoS Attack Disrupted Airport Arrival Kiosks

Mathew J. Schwartz  •  September 21, 2023

A recent, brief disruption at Canadian airports is a reminder that Russia-aligned hacking groups' bark remains worse than their bite. Experts say these groups' impact largely remains minimal, which begs the question of how they disrupted arrival kiosks across Canadian airports.

Lessons to Learn From Clop's MOVEit Supply Chain Attacks

Mathew J. Schwartz  •  September 15, 2023

The Clop ransomware group's zero-day attack on MOVEit software was its fourth data theft campaign targeting secure file transfer users. Organizations can combat such attacks by using data minimization and encryption - among other defenses, says Teresa Walsh, global head of intelligence for FS-ISAC.

Caesars Confirms Ransomware Payoff and Customer Data Breach

Mathew J. Schwartz  •  September 15, 2023

Casino and hotel giant Caesars Entertainment is warning customers that their personal details were stolen in a recent hack attack. After successfully shaking down Caesars for a ransom, the same attackers are continuing to extort MGM Resorts, claiming to have crypto-locked its EXSi hypervisors.

LokiBot Information Stealer Packs Fresh Infection Strategies

Mathew J. Schwartz  •  September 14, 2023

In Norse mythology, Loki is a cowardly trickster god who can change age, shape and sex. The malware incarnation is more prosaic, tending to focus on stealing Microsoft users' data, at times by using an ancient vulnerability in Microsoft Office that continues to be widespread.

Caesars Entertainment Reportedly Pays Ransom to Attackers

Mathew J. Schwartz  •  September 14, 2023

Hotel and casino giant Caesars Entertainment paid approximately half of an initial $30 million ransom demand to attackers who infected its systems with ransomware, according to news reports. The attackers appear to be with the same group that hit MGM Resorts.

Kubernetes Advises Users to Patch Command Injection Flaws

Mathew J. Schwartz  •  September 13, 2023

Kubernetes is warning all users to immediately update their clusters to the latest version - released Aug. 23 - to patch a trio of critical command injection vulnerabilities attackers can use to remotely execute code. Akamai has released proof-of-concept code for exploiting one of the flaws.

Big MGM Resorts Outage Traces to Ransomware, Researchers Say

Mathew J. Schwartz  •  September 13, 2023

Booking and reservation systems, as well as slot machines, hotel room door locks, ATMs and more remain offline at multiple MGM Resorts properties as the publicly traded casino hotel giant battles "a cybersecurity issue" that one group of security researchers has tied to a ransomware group attack.

Root Admin User: When Do Common Usernames Pose a Threat?

Mathew J. Schwartz  •  September 11, 2023

Honeypot data collected by CISO Jesse La Grew highlights how attackers continue to target default usernames - including for SSH - together with weak passwords to gain brute force remote access to their targets. Here are essential username, password and remote service practices for combating such attacks.

Feds Urge Immediate Patching of Zoho and Fortinet Products

Mathew J. Schwartz  •  September 8, 2023

Multiple nation-state hacking groups have been exploiting known flaws in Zoho ManageEngine software and Fortinet firewalls to steal data, cybersecurity officials warn. A new alert details exploits of each vulnerability by separate groups that targeted the same aeronautical firm.

Tattletale Ransomware Gangs Threaten to Reveal GDPR Breaches

Mathew J. Schwartz  •  September 7, 2023

Ransomware groups do whatever they can to pressure a victim into paying. Enter the likes of Ransomed, following in the footsteps of Alphv/BlackСat, NoEscape and Good Day-powered Cloak, all of which threaten victims with a world of General Data Protection Regulation violation pain unless they pay.

View to a Phish: W3LL Specializes in Microsoft 365 Hacking

Mathew J. Schwartz  •  September 6, 2023

A sophisticated phishing toolkit called W3LL Panel has been used to exploit at least 8,000 endpoints since the middle of last year to perpetrate costly business email compromise schemes, Group-IB reports. Such toolkits help automate the entire life cycle of a BEC attack.