Content by Mathew J. Schwartz

Stung by Free Decryptor, Ransomware Group Embraces Extortion

Mathew J. Schwartz  •  March 22, 2023

Not all ransomware groups wield crypto-locking malware. Some have adopted other strategies. Take BianLian. After security researchers released a free decryptor for its malware, instead of encrypting files, the group chose to steal them and demand ransom solely for their safe return.

Hackers Are Actively Exploiting Unpatched Adobe ColdFusion

Mathew J. Schwartz  •  March 22, 2023

Hackers have been actively exploiting vulnerabilities in ColdFusion to remotely compromise servers, Adobe warns. Since at least early January, attackers have been dropping web shells via ColdFusion, but it's unclear if only now-known vulnerabilities are being exploited, security researchers say.

How Russia's Ukraine War Disrupted the Cybercrime Ecosystem

Mathew J. Schwartz  •  March 20, 2023

Russia's invasion of Ukraine in 2022 threw Russia's cybercrime ecosystem into a state of upheaval that still exists to this day. "We identified disruptions to literally every single form of commodified cybercrime," said Alexander Leslie, associate threat intelligence analyst at Recorded Future.

TikTok Says US Threatens Ban Unless Chinese Owners Divest

Mathew J. Schwartz  •  March 17, 2023

TikTok says the Biden administration has demanded that the company's Chinese owners divest their stake in the company or risk seeing the app get banned in America. The U.S., Canada, EU, U.K. and New Zealand have all banned the use of TikTok on government devices, citing national security concerns.

Russia May Be Reviving Cyber Ops Ahead of Spring Offensive

Mathew J. Schwartz  •  March 16, 2023

What happens next in Russia's all-out invasion of Ukraine isn't clear, but experts have been tracking signs that Moscow may be preparing for intensified cyber operations ahead of a spring offensive, developing new wiper malware and getting ready to interfere in European elections and foreign policy.

Rubrik Breached Via Zero-Day Attack Exploiting GoAnywhere

Mathew J. Schwartz  •  March 15, 2023

Cybersecurity software giant Rubrik has joined the ranks of organizations that fell victim to attackers who have been exploiting a zero-day vulnerability in Fortra's widely used managed file transfer software, GoAnywhere MFT. The Clop ransomware gang claims to have exploited at least 130 victims.

Darknet Markets Thrive Despite Repeat Disruptions by Police

Mathew J. Schwartz  •  March 14, 2023

Despite repeated disruptions by law enforcement, underground cybercrime markets continue to thrive. Researchers are tracking the debut of 190 "significant" new darknet markets in 2022, connecting illegal data and access brokers with ransomware groups, fraudsters and others.

LockBit Ransomware Group Claims SpaceX Contractor Data Theft

Mathew J. Schwartz  •  March 14, 2023

The LockBit ransomware operation claims to have stolen data from a Texas-based supplier to Elon Musk's SpaceX, which designs, manufactures and launches rockets and spacecraft. It's the latest PR-grabbing attempt by the prolific LockBit extortion group.

Ukraine Tracks Increased Russian Focus on Cyberespionage

Mathew J. Schwartz  •  March 13, 2023

As Russia's full-scale invasion of Ukraine last year stalled, Russian hacking teams increasingly shifted from causing all-out disruption to cyberespionage, data theft and psychological operations, Ukraine's cybersecurity establishment says in a new lessons learned report.

Blackbaud to Pay $3 Million Over 'Erroneous' Breach Details

Mathew J. Schwartz  •  March 10, 2023

Fundraising and customer relationship management software provider Blackbaud has reached a $3 million settlement agreement with the Securities and Exchange Commission over allegations it made "misleading disclosures about a 2020 ransomware attack that impacted more than 13,000 customers."

US Intelligence Ranks China as Top National Security Threat

Mathew J. Schwartz  •  March 9, 2023

The Chinese government's geopolitical ambitions and willingness to use cyber operations to achieve them pose one of the biggest threats to U.S. national security, the U.S. intelligence community warns. Russia, Iran and North Korea also pose major threats, as do cybercrime and especially ransomware.

Co-Working for the Ransomware Age: How Hive Thrived

Mathew J. Schwartz  •  March 8, 2023

Key to the business success of top ransomware groups remains their ability to find innovative new ways to amass victims. For Hive, which received more than $100 million in ransom payments before being disrupted by law enforcement, the new business strategy that helped it thrive was co-working.

Germany's 5G Safety Review Could Ban Huawei and ZTE Gear

Mathew J. Schwartz  •  March 7, 2023

Germany may belatedly ban Chinese-built telecommunications gear from its 5G networks on national security grounds as the country's Federal Office for Information Security, the BSI, conducts a review. The majority of 5G radio access network equipment in German networks comes from Chinese vendors.

Publicity Stunt: Criminals Dump 2 Million Free Payment Cards

Mathew J. Schwartz  •  March 6, 2023

Here's further proof many cybercriminals are rampant self-promoters: Credit card market BidenCash, which sells compromised payment card data, dumped 2 million payment cards for free. This shows that competition between carder markets - and increasingly, Telegram-based vendors - is fierce.

US Cybersecurity Strategy Doubles Down on Hitting Ransomware

Mathew J. Schwartz  •  March 3, 2023

The Biden administration, in its new national cybersecurity strategy, is doubling down on its efforts to combat ransomware, in part by designating it as a national security problem. Experts say this puts more "instruments of national power" - including military options - at the president's disposal.