Content by Mathew J. Schwartz

Leaks Reveal Moscow Source for Hacking, Disinformation Tools

Mathew J. Schwartz  •  March 30, 2023

Leaked documents from a Moscow IT consultancy reveal how the Russian government has commissioned tools for its military and intelligence agencies for conducting cyber operations, information warfare, and controlling the internet, as well as training critical infrastructure hackers.

Ransomware Groups Hit Unpatched IBM File Transfer Software

Mathew J. Schwartz  •  March 30, 2023

Security experts are urging users of IBM's Aspera Faspex file-exchange application to take it offline immediately unless they've patched a flaw being actively exploited by ransomware groups, including Buhti and IceFire. Separately, QNAP is warning customers to prepare for emergency security fixes.

Phishing Campaign Tied to Russia-Aligned Cyberespionage

Mathew J. Schwartz  •  March 30, 2023

A hacking group with apparent ties to Russia or Belarus has been using "simple yet effective attack techniques and tools" to gain access to multiple governments' email systems as part of apparent cyberespionage operations in support of Russia's invasion of Ukraine, researchers warn.

Pentagon Doubles Down on Zero Trust

Mathew J. Schwartz  •  March 29, 2023

A top Pentagon technology official on Wednesday emphasized the U.S. Department of Defense's embrace of zero trust. "We've committed to implementing zero trust across the DOD by 2027, which is an ambitious yet critical milestone," Department of Defense CIO John B. Sherman told a Senate panel.

Look Beyond TikTok: Massive Data Collection Is the Real Risk

Mathew J. Schwartz  •  March 29, 2023

There's much national security ado about how much user data gets collected by the Chinese-owned, wildly popular video-sharing app TikTok. But as France's ban of "recreational apps" from government-issued devices highlights, a bigger-picture approach for combating surveillance is required.

Ransomware Groups Seek Fresh Tactics Following Hive Takedown

Mathew J. Schwartz  •  March 27, 2023

Stung by the FBI's infiltration and takedown of the Hive ransomware group, other ransomware operators have been retooling their approaches to make their attacks more effective and operations tougher to disrupt, says Yelisey Bohuslavskiy, chief research officer at threat intelligence firm Red Sense.

GitHub Replaces Private RSA SSH Key After Public Exposure

Mathew J. Schwartz  •  March 24, 2023

GitHub has replaced its private RSA SSH host key after discovering it was being inadvertently exposed to the public via a GitHub repository. Used to safeguard SSH access to Git operations, a bad actor could use the key to impersonate GitHub or eavesdrop. But GitHub reported no signs of abuse.

TikTok CEO Aims to Assure Lawmakers Americans' Data Is Safe

Mathew J. Schwartz  •  March 23, 2023

TikTok CEO Shou Chew appeared Thursday before the U.S. congressional panel to defend his company against accusations that it's imperiling Americans' national security, privacy and mental health. Lawmakers pressed Chew on the company's Chinese ownership, source code and privacy practices.

Russians Can Use Crypto to Evade Sanctions, Researchers Warn

Mathew J. Schwartz  •  March 23, 2023

Dark web merchants have been offering Russians - consumers and criminals alike - services for bypassing international sanctions that may indirectly involve U.S. financial institutions, demonstrating the need for more robust "know your customer" and anti-money laundering checks, researchers warn.

Stung by Free Decryptor, Ransomware Group Embraces Extortion

Mathew J. Schwartz  •  March 22, 2023

Not all ransomware groups wield crypto-locking malware. Some have adopted other strategies. Take BianLian. After security researchers released a free decryptor for its malware, instead of encrypting files, the group chose to steal them and demand ransom solely for their safe return.

Hackers Are Actively Exploiting Unpatched Adobe ColdFusion

Mathew J. Schwartz  •  March 22, 2023

Hackers have been actively exploiting vulnerabilities in ColdFusion to remotely compromise servers, Adobe warns. Since at least early January, attackers have been dropping web shells via ColdFusion, but it's unclear if only now-known vulnerabilities are being exploited, security researchers say.

How Russia's Ukraine War Disrupted the Cybercrime Ecosystem

Mathew J. Schwartz  •  March 20, 2023

Russia's invasion of Ukraine in 2022 threw Russia's cybercrime ecosystem into a state of upheaval that still exists to this day. "We identified disruptions to literally every single form of commodified cybercrime," said Alexander Leslie, associate threat intelligence analyst at Recorded Future.

TikTok Says US Threatens Ban Unless Chinese Owners Divest

Mathew J. Schwartz  •  March 17, 2023

TikTok says the Biden administration has demanded that the company's Chinese owners divest their stake in the company or risk seeing the app get banned in America. The U.S., Canada, EU, U.K. and New Zealand have all banned the use of TikTok on government devices, citing national security concerns.

Russia May Be Reviving Cyber Ops Ahead of Spring Offensive

Mathew J. Schwartz  •  March 16, 2023

What happens next in Russia's all-out invasion of Ukraine isn't clear, but experts have been tracking signs that Moscow may be preparing for intensified cyber operations ahead of a spring offensive, developing new wiper malware and getting ready to interfere in European elections and foreign policy.

Rubrik Breached Via Zero-Day Attack Exploiting GoAnywhere

Mathew J. Schwartz  •  March 15, 2023

Cybersecurity software giant Rubrik has joined the ranks of organizations that fell victim to attackers who have been exploiting a zero-day vulnerability in Fortra's widely used managed file transfer software, GoAnywhere MFT. The Clop ransomware gang claims to have exploited at least 130 victims.