Content by Jeremy Kirk

Optus Attacker Halts AU$1.5 Million Extortion Attempt

Jeremy Kirk  •  September 27, 2022

The person who stole nearly 10 million customer records from Australian telco Optus withdrew their AU$1.5 million extortion attempt after suddenly releasing 10,000 customer records. Also, Optus says it has not paid a ransom as it grapples with one of the largest data breaches in the country.

Optus Under $1 Million Extortion Threat in Data Breach

Jeremy Kirk  •  September 25, 2022

Australia's Optus telco is facing a $1 million extortion demand to prevent the release of up to 11.2 million sensitive customer records. The data appears to be legitimate. The attacker tells Information Security Media Group an unauthenticated API led to the breach.

Ransomware's Future: A Continuing Money Spinner

Jeremy Kirk  •  September 23, 2022

What is the future of ransomware, and is it going to continue with the same intensity of the last few years? Michael DeBolt of Intel 471 says anti-ransomware efforts, including government action and better cybersecurity practices, are working. But ransomware isn't going away soon.

Australian Telco Optus Investigates Scope of Large Breach

Jeremy Kirk  •  September 23, 2022

A criminal investigation is underway into a breach at Optus, Australia’s second-largest telecommunications company. Optus' CEO says the company will notify those affected. It's unknown so far who perpetrated the attack, and the data has not appeared on the dark web.

The Ransomware Files, Episode 11: The Adult Boutique

Jeremy Kirk  •  September 16, 2022

Dain Drake was CEO of a steel fabrication factory. In June 2019, Drake found himself standing outside a closed adult boutique in Houston at 10:00 a.m. on a Sunday. He called the owner and pleaded for him to come. He needed something inside, which might just save his business - from ransomware.

LA School District Forewarned of Malware, Attack Risks

Jeremy Kirk  •  September 9, 2022

The only surprising aspect of the ransomware attack against Los Angeles Unified School District is that it didn’t happen sooner. The district was warned of cybersecurity weaknesses in the 20 months leading up to its ransomware attack. The Vice Society gang has claimed credit.

LA School District Accounts Appear on Dark Web Before Attack

Jeremy Kirk  •  September 7, 2022

The Labor Day weekend ransomware attack on the Los Angeles Unified School District is drawing serious attention from the U.S. government, which has sent the FBI. The attack vector is unknown, but nearly two dozen compromised district accounts appeared on the dark web in the months before the attack.

Cybercriminal Service 'EvilProxy' Seeks to Hijack Accounts

Jeremy Kirk  •  September 5, 2022

One of the biggest challenges for cybercriminals is how to defeat multifactor authentication. New research has uncovered a criminal service called "EvilProxy" that uses a technique called session hijacking to steal session cookies to bypass MFA and compromise accounts.

During a War, Cyber Intel Firm Opens Ukraine Office

Jeremy Kirk  •  August 30, 2022

Alex Holden, CISO and founder of the cyber intelligence company Hold Security, was preparing to open an office in Ukraine when Russia invaded in February. He went ahead with his plan anyway. In this video interview with Information Security Media Group, he tells why he did it.

Cyber Insurance: A Helping Hand But Premiums Are Rising

Jeremy Kirk  •  August 12, 2022

Cyber insurance can defray costs associated with data breaches and ransomware attacks. But Kelly Butler of the advisory firm Marsh & McLennan Companies says insurers are tightening their requirements for policies due to rising costs associated with increasingly severe incidents.

The Ransomware Files, Ep. 10: Dr. Ransomware, Part 2

Jeremy Kirk  •  August 5, 2022

Is a practicing cardiologist living in Venezuela also a ransomware mastermind? U.S. prosecutors claim Moises Luis Zagala Gonzalez is a cybercriminal polymath. But Zagala's wife says he is innocent and there's a reason for his predicament. "The Ransomware Files" podcast looks at the evidence.

The Ransomware Files, Episode 9: Dr. Ransomware, Part 1

Jeremy Kirk  •  July 13, 2022

Moises Zagala is a 55-year-old cardiologist living in Ciudad Bolivar, Venezuela. He has a bald head and an earnest smile. In one photo, he wears a doctor's white overcoat and has a stethoscope around his neck. But U.S. prosecutors allege Zagala led a double life and claim he's also a cybercriminal.

Paying Ransomware Actors: 'It's a Business Decision'

Jeremy Kirk  •  June 22, 2022

Having to decide whether to pay a ransom to cybercriminals is a decision no one wants to make. But Gartner's Paul Furtado and Hearing Australia CISO Daniel Smith say practitioners should stay objective and leave the decision - and the subsequent moral implications - to the business.

The Ransomware Files, Episode 8: Travelex

Jeremy Kirk  •  June 20, 2022

Ransomware struck global currency exchange and remittance company Travelex on New Year's Eve 2019. Don Gibson, a security architect at Travelex, became publicly linked with the incident, and the undesired attention he received contributed to a health situation that nearly led to a tragic outcome.

The Ransomware Files, Bonus Ep. 1: REvil Is Foiled

Jeremy Kirk  •  May 30, 2022

If software has a dangerous security flaw, should its maker tell customers to shut it down until it’s fixed? It's a tough call, but Dutch company Hoppenbrouwers says the software vendor Kaseya should have done so last year to prevent a massive supply chain attack by the REvil ransomware gang.