CISA and the FBI issued a warning reminding critical infrastructure partners that the US holiday weekend is ripe for cyber actors. That’s backed by data – security professionals report that Eighty-six percent report missing a holiday or essential weekend activity with family and friends. Oh, and Seventy percent report being forced to respond to a ransomware attack while intoxicated to get the job done.
Almost three-quarters (72%) of small and medium businesses report more cybersecurity concernsthan they did a year ago. Much of that concern stems from experience. As more SMBs have sent people to work from home because of COVID-19, just more than half (52%) have dealt with a cyberattack in the last year. Ten percent suffered more than ten hacks. Those stats come from a new report, “The State of Cybersecurity in SMBs in 2021-2022,” conducted by software developer Devolutions.
New rules banks finalized last week – they must report major cybersecurity incidents within 36 hours. Beginning in May 2022, financial executives will need to be more forthcoming about computer system failures and interruptions, such as ransomware or denial-of-service attacks that have the potential to disrupt customers’ ability to access their accounts or impact the more extensive financial system.
The UK’s National Cyber Security Centre says it warned the owners of more than 4,000 online stores that their sites were compromised in Magecart attacks to steal customers’ payment info. These hacks compromise online stores to harvest and steal the payment and/or personal info submitted by customers at the checkout page.
A scheme to lure insiders into deploying ransomware on employer systems has led to an arrest. Customers of the cybersecurity firm Abnormal Security were sent emails with the subject “Partnership affiliate offer,” requesting that the recipient considered becoming an accomplice in a cyberattack. The motivation – desperation. The 23-year old suspect was focused on raising money for a startup.
Ransomware is now lucrative for the gangs conducting those attacks. They are repurposing their teams to deliver more victims. This in a new report from Sophos. Sophos said that ransomware is becoming more modular, with different groups specializing in particular elements of an attack. It also pointed to the linked rise of ‘ransomware-as-a-service, where criminal gangs can purchase access to tools to run their ransomware attacks when they lack the technical ability to create those tools themselves.
These so-called ransomware ‘affiliates’ don’t even have to find their potential victims: the ransomware ecosystem has developed so that they can go to other groups who specialize in gaining access to corporate networks and who will sell that backdoor onto them.
But what has changed now is that ransomware developers are now using this as-a-service model to optimize their code and get the biggest payouts, offloading to others the tasks of finding victims, installing and executing the malware, and laundering the cryptocurrencies.
Friends don’t let friends solve security issues drunk.
But more seriously, tactically make sure you’re ready for the long holiday weekend in the US, as that’s “a thing” and should be factored in. Strategy-wise, understanding the enemy continues to be critical – and they are WAY more organized than most think. This is not random.
The move to work from home and COVID accelerated a trend, not created one. Those stats about hacks would have happened, just potentially slower. Don’t be distracted there, and instead note how reporting and legal obligations continue to grow here. We’re slowly moving further and further down the road to being a regulated industry.