Content by Mathew J. Schwartz

RagnarLocker Deploys a Virtual Machine to Hide Ransomware

Mathew J. Schwartz  •  May 22, 2020

As ransomware gangs attempt to boost their illicit profits, the RagnarLocker ransomware gang has brought a new tactic to bear: installing a full virtual machine on victims' systems to hide their crypto-locking malware while it forcibly encrypts files, security firm Sophos warns.

Toll Group Data Leaked Following Second Ransomware Incident

Mathew J. Schwartz  •  May 20, 2020

Australian shipping giant Toll Group recently suffered its second ransomware outbreak of the year, with Thomas Knudsen, the company's managing director, branding the latest attack as being "serious and regrettable." But was it preventable?

EasyJet Data Breach Exposes 9 Million Customers' Details

Mathew J. Schwartz  •  May 19, 2020

European budget airline EasyJet says it suffered a data breach that exposed 9 million customers' personal details. While no passport details were exposed, the company's ongoing investigation has also found that attackers "accessed" a small number - just 2,208 - of customers' payment card details.

Supercomputer Intrusions Trace to Cryptocurrency Miners

Mathew J. Schwartz  •  May 18, 2020

Cryptocurrency-mining hackers appear to be behind a recent spate of supercomputer and high-performance computing system intrusions. But it's unclear if attackers might also have had data-stealing or espionage intentions.

Crypto-Lock and Tell: Ransomware Gangs Double Down on Leaks

Mathew J. Schwartz  •  May 15, 2020

More ransomware-wielding gangs are not just crypto-locking victims' systems, but also stealing and threatening to leak data unless they get their demanded bitcoin ransom payoff. A growing number of security experts believe the strategy is leading more victims to pay.

Ransomware Reminder: Paying Ransoms Doesn't Pay

Mathew J. Schwartz  •  May 14, 2020

Security experts and law enforcement officials have long argued that paying ransoms doesn't pay. For starters, it directly funds the cybercrime ecosystem and makes it attractive for criminals to keep launching ransomware attacks.

Patch or Perish: Nation-State Hacker Edition

Mathew J. Schwartz  •  May 13, 2020

From 2016 to 2019, sophisticated nation-state attackers preferred to target 10 vulnerabilities more than all others, the U.S. Cybersecurity and Infrastructure Security Agency and FBI warn in a new alert. They say many of these flaws are years old, yet remain unpatched and actively exploited.

Why Are We So Stupid About RDP Passwords?

Mathew J. Schwartz  •  May 7, 2020

In honor of World Password Day, here's a task for every organization that uses remote desktop protocol: Ensure that all of your organization's internet-facing RDP ports have a password - and that it's complex and unique.

Digital Contact-Tracing Apps Must Win Hearts and Minds

Mathew J. Schwartz  •  May 6, 2020

Despite the need to battle COVID-19, several nations' in-development digital contact-tracing apps are already dogged by security and privacy concerns. Whether enough users will ever trust these apps to make them effective remains a major question. Is it too late to get more projects back on track?

Forget Whitelists and Blacklists: Go for 'Allow' or 'Deny'

Mathew J. Schwartz  •  May 5, 2020

Forget "whitelists" and "blacklists" in cybersecurity. So recommends Britain's National Cyber Security Center, in a bid to move beyond the racial connotations inherent to the terminology. Henceforth, NCSC - part of intelligence agency GCHQ - will use the terms "allow list" and "deny list." Will others follow?

Digital Contact-Tracing Apps: Hype or Helpful?

Mathew J. Schwartz  •  May 4, 2020

Technology is no panacea, including for combating COVID-19. While that might sound obvious, it's worth repeating because some governments continue to hype contact-tracing apps. Such apps won't magically identify every potential exposure. But they could make manual contact-tracing programs more effective.

Phishing Campaigns Target Senior Executives via Office 365

Mathew J. Schwartz  •  May 1, 2020

A sophisticated, highly targeted phishing campaign has hit high-level executives at more than 150 businesses, stealing confidential documents and contact lists, says security firm Group-IB. The campaign, which targets Office 365 users, appears to trace to attackers operating from Nigeria and South Africa.

Ransomware: Average Business Payout Surges to $111,605

Mathew J. Schwartz  •  April 30, 2020

The average ransom paid by victims to ransomware attackers reached $111,605 in the first quarter of this year, up 33% from the previous quarter, reports ransomware incident response firm Coveware, which sees the Sodinokibi, Ryuk and Phobos malware families continuing to dominate.

10 Ransomware Strains Being Used in Advanced Attacks

Mathew J. Schwartz  •  April 29, 2020

Many attackers continue to camp out in networks for months, conducting reconnaissance and stealing sensitive data before unleashing ransomware. Experts say many recent efforts trace to gangs wielding the RobbinHood, Valet Loader, NetWalker, PonyFinal, Maze and Sodinokibi strains of crypto-locking malware.

Contact-Tracing App Privacy: Apple, Google Refuse to Budge

Mathew J. Schwartz  •  April 27, 2020

Apple and Google have promised to help facilitate contact-tracing apps, but they've rejected calls to give users' location data to governments, as the U.K., France and some U.S. states are demanding. In response, Germany is among those now backing a privacy-preserving, decentralized model.