Content by Jeremy Kirk

Ransomware Actors Set Up a Call Center to Lure Victims

Jeremy Kirk  •  August 3, 2021

Ransomware actors have taken a page from the playbooks of tech support scammers of yore by guiding victims to download malware through persuasion over the phone. Microsoft says the technique is more dangerous than it first realized.

Wiper Malware Used in Attack Against Iran's Train System

Jeremy Kirk  •  July 30, 2021

Nearly three weeks ago, Iran's state railway company was hit with a cyberattack that was disruptive and - somewhat unusually - also playful. Security firm SentinelOne says analyzing the wiper malware involved offers tantalizing clues about the attackers' skills, but no clear attribution.

Israeli Government Visits NSO Group Amid Spyware Claims

Jeremy Kirk  •  July 29, 2021

The Israeli government paid a visit on Wednesday to NSO Group, the company whose spyware is alleged to have been covertly installed on the mobile devices of journalists and activists. The visit comes as Israel faces growing pressure to see if NSO Group's spyware, called Pegasus, has been misused.

Australia Says Uber 'Interfered' With Users' Privacy

Jeremy Kirk  •  July 26, 2021

Australia's data regulator has found that Uber interfered with the privacy of 1.2 million of its customers as a result of a 2016 global data breach. Uber says it's made improvements to its systems and its internal security policies.

Kaseya Obtains Decryption Tool After REvil Ransomware Hit

Jeremy Kirk , Doug Olenick , Mathew J. Schwartz  •  July 22, 2021

Remote management software vendor Kaseya has obtained a decryption tool for all organizations affected by the massive ransomware attack launched via its software. The tool should especially help the many small businesses still struggling to recover. Kaseya declined to comment on how it obtained the decryptor.

Spyware Exposé Highlights Suspected Apple Zero-Day Flaws

Jeremy Kirk  •  July 19, 2021

A new exposé tracking how spyware has been used to target journalists and human rights advocates suggests attackers have been exploiting zero-day flaws in Apple applications and devices. Apple says the flaws, while serious, likely pose no risk to the vast majority of its users.

There's a Clear Line From the REvil Ransomware to Russia

Jeremy Kirk  •  July 13, 2021

Threat intelligence researchers are looking closely at REvil, the ransomware gang that infected up to 1,500 companies in a single swoop. A look at the group's online infrastructure shows clear lines to Russian and U.K. service providers that, in theory, could help law enforcement agencies but don't appear eager to...

Kaseya Says Software Fully Patched After Ransomware Attack

Jeremy Kirk  •  July 12, 2021

Software developer Kaseya has released patches for its remote monitoring software, which had been exploited by REvil ransomware attackers to infect up to 60 MSPs and 1,500 of their clients. The patches mitigate the final three vulnerabilities out of seven that researchers reported to Kaseya in early April.

Kaseya: Up to 1,500 Organizations Hit in Ransomware Attack

Jeremy Kirk  •  July 6, 2021

Software vendor Kaseya suspects that 800 to 1,500 organizations - mostly small businesses - were compromised via a ransomware attack that exploited its VSA remote management software. The company won't say if it's negotiating with the attackers for a universal decryption tool that would unlock all victims' files.

Kaseya Was Working on Patches Before Ransomware Attack

Jeremy Kirk  •  July 5, 2021

Kaseya, the remote IT management vendor hit by a ransomware attack that has disrupted operations for numerous customers, was close to fixing a flaw in its software before the notorious REvil operation struck. One Dutch researcher says the attackers beat Kaseya's patching efforts in a "final sprint."

Google Investigates Ad Injected Into 2FA SMS Messages

Jeremy Kirk  •  July 2, 2021

Google says it's investigating how a text advertisement was injected into SMS messages containing two-step verification security codes. The text advertisement contained a link that redirected to a VPN product from antivirus vendor Avira.

Should Western Digital Emergency-Patch Old NAS Devices?

Jeremy Kirk  •  June 30, 2021

The saga around how scores of aging Western Digital NAS devices were remotely erased has deepened with the discovery of a new, unknown software vulnerability. The situation underscores the problems of still-used devices that have been abandoned by manufacturers.

Mercedes-Benz USA Says 1.6 Million Records Exposed

Jeremy Kirk  •  June 29, 2021

Mercedes-Benz USA says one of its vendors exposed 1.6 million records that pertained to its customers and interested buyers. The incident, which involved an unnamed vendor and a cloud storage platform, is similar to one recently disclosed by Volkswagen.

Binance Says It Helped With Clop Money Laundering Bust

Jeremy Kirk  •  June 25, 2021

Cryptocurrency exchange Binance says it recently assisted police in tracking down individuals accused of laundering money for the Clop ransomware group. The exchange acknowledges that illicit money from cyberattacks circulating on virtual currency exchanges is a big security problem.

US Seizes Domains of Websites Linked to Iran, Iraq

Jeremy Kirk  •  June 23, 2021

The U.S. has seized the domains of 36 websites linked with Iran and Iraq for allegedly publishing disinformation and running malicious influencing campaigns targeting Americans. Those running the sites violated sanctions by not obtaining a license to buy domain names from U.S. companies.