The REvil gang was hacked and taken offline by a multi-country operation. Confirmed by government officials, the attack was acknowledged by a known leadership figure in the organization.
Which appears to have caused an escalation, as the Groove ransomware gang is calling on other groups to attack US interests. Published as a Russian language blog post, the post aso warns to not target Chinese companies as they would need the use the country as a safe haven if Russia takes a stronger stance on cybercrime.
Researchers at Kaspersky report hacking groups have had to get more efficient – because security on software, web services, email platforms and the like has gotten better. A modern cybercrime operation doesn’t need malware authors and testers, as that’s pulled from a central selling place, and instead have become a cloud based, nimble organization.
At a meeting of local government cybersecurity leaders last week, the focus on was on cultural attitudes. Challenges such as walled-off agencies, employees’ discomfort with mandatory trainings and users’ unease with increasingly standard procedures like multi-factor authentication and single-sign-on protocols were discussed as the biggest challenges to overcome, rather than technical ones.
And in news-you-can-use, Microsoft has announced the Microsoft Security Program for Nonprofits, which offers free access to security assessments, training, and tools. The goal is to sig up 10,000 non-profits in the next year and 50,000 organizations in the next three.
If you work with non-profits, use those programs. That’s free money and it still drives consulting.
Gartner said last week it will get worse before it gets better, and I think this back and forth with the criminals is just setting the stage for that. This is going to be a tit-for-tat as this war escalates.
I found the Kaspersky research a good read – it’s in the know your enemy category. They’re smart.