Latest

►

Standards, Regulations & Compliance

Advice on International Compliance With US Laws

Suparna Goswami  •  October 27, 2020

Even if a company has no operations in the U.S., it should follow the compliance guidance offered by the U.S. Department of Justice in June, says Benjamin Haley, partner at Covington & Burling LLP, an international law firm.

Endpoint Security

New Online Platform Coordinates IoT Bug Reports

Jeremy Kirk  •  October 27, 2020

A new online platform called VulnerableThings.com is aiming to become the go-to place for reporting and viewing reports on software flaws in IoT devices. The IoT Security Foundation and Oxford Information Labs say the platform could help vendors comply with new IoT regulations and standards.

Cybercrime

Even in Test Mode, New Mirai Variant Infecting IoT Devices

Doug Olenick  •  October 26, 2020

A greatly enhanced variant of the powerful Mirai botnet is already infecting IoT devices even though it's operating in a test environment, according to researchers at cybersecurity firm Avira Protection Lab.

Blockchain & Cryptocurrency

KashmirBlack Botnet Targets Content Management Systems

Prajeet Nair  •  October 26, 2020

Security researchers at Imperva have uncovered a botnet that attacks vulnerabilities in websites' underlying content management systems and then uses these compromised servers to mine for cryptocurrency or send spam to more victims.

Fraud Management & Cybercrime

Phishing Campaign Mimics Microsoft Teams Alerts

Chinmay Rautmare  •  October 23, 2020

Researchers have uncovered a fresh phishing campaign that mimics the automated messages of the popular business communication platform Microsoft Teams in an attempt to harvest users' Office 365 login credentials.

Forensics

LockBit Ransomware Uses Automation Tools to Pick Targets

Prajeet Nair  •  October 23, 2020

The operators behind the LockBit ransomware strain use automation tools and techniques that help the malware quickly spread through a compromised network and also assist in picking specific targets, according to Sophos.

Critical Infrastructure Security

Analysis: The Significance of Russian Hackers' Indictment

Anna Delaney  •  October 23, 2020

The latest edition of the ISMG Security Report analyzes the U.S. indictment against Russian hackers who were allegedly behind NotPetya. Also featured: A discussion of nation-state adversaries and how they operate; an update on Instagram privacy investigation.

Breach Notification

Indian Pharmaceutical Company Investigates Security Incident

Prajeet Nair  •  October 22, 2020

Dr. Reddy's Laboratories, a multinational pharmaceutical company based in India that's testing a COVID-19 vaccine, says it isolated its data center services Thursday following what it calls a "detected cyberattack."

Cyberwarfare / Nation-State Attacks

Elite Russian Sandworm Hackers' Epic OPSEC Problem

Mathew J. Schwartz  •  October 22, 2020

An indictment unsealed this week demonstrates the degree to which Western intelligence agencies have apparently been able to infiltrate the Russian intelligence apparatus to trace attacks back to specific agencies - and individual operators. Shouldn't Russian spies have better operational security?

Cyberwarfare / Nation-State Attacks

Analysis: Can Russia's Cyber Destruction Appetite Be Curbed?

Mathew J. Schwartz  •  October 21, 2020

The U.S. indictment charging that six Russian GRU military intelligence officers were responsible for numerous cyberattacks highlights Moscow's seemingly unending appetite for online destruction. Experts say more than indictments will be required to curb such activity.

►

DevSecOps

Getting Visibility Into Open Source Components

Suparna Goswami  •  October 21, 2020

Many applications use open source components, which can make it challenging to pinpoint any security issues. How can organizations gain better visibility of risks?

Finance & Banking

Home Loan Trading Platform Exposes Mortgage Documentation

Jeremy Kirk  •  October 21, 2020

MAXEX, a company that develops a digital trading platform for the secondary mortgage market in the U.S., leaked 9 GB of internal documentation as well as full mortgage applications for 23 individuals. The data was released by a Swiss-based developer who apparently was unaware it was sensitive.