Content by Mathew J. Schwartz

Government Sanctions: No Ransomware Please, We're British

Mathew J. Schwartz  •  February 15, 2023

As ransomware continues to disrupt British organizations, the U.K. for the first time has sanctioned alleged cybercriminals, including accused Conti and TrickBot operators. Ransomware victims must conduct due diligence before paying any ransom, as violating sanctions carries severe penalties.

Russian Found Guilty of Insider Trading in Hacking Case

Mathew J. Schwartz  •  February 15, 2023

Vladislav Klyushin, who ran a Moscow-based IT services firm associated with the Russian government, has been found guilty of running a criminal hacking scheme that earned $90 million via insider trading. He faces up to 50 years in prison. His four alleged co-conspirators remain at large.

Clop Ransomware Claims Widespread GoAnywhere MFT Exploits

Mathew J. Schwartz  •  February 13, 2023

Attackers have been actively exploiting a zero-day vulnerability in widely used managed file transfer software GoAnywhere MFT to take full control of systems, and in some cases to deploy ransomware. Vendor Fortra has released a patch and urged users to review systems for unusual behavior.

Modified ESXiArgs Ransomware Blocks VMware Host Recovery

Mathew J. Schwartz  •  February 9, 2023

Attackers targeting unpatched VMware ESXi hypervisors to hit virtual machines have reportedly modified their ESXiArgs ransomware to prevent victims from using decryption workarounds identified by researchers. The campaign has already amassed nearly 3,000 known victims and could have many more.

E-Commerce Shops: 12% Are Publicly Exposing Private Backups

Mathew J. Schwartz  •  February 8, 2023

Researchers at Sansec warn that 12% of e-commerce sites they studied publicly expose private backups and that hackers are actively scanning for them. Such backups can give attackers customer data, passwords and other details required to gain remote, administrator-level access to an environment.

Ransomware: ESXiArgs Campaign Snares at Least 2,803 Victims

Mathew J. Schwartz  •  February 8, 2023

As the massive ESXiArgs ransomware campaign continues to target unpatched VMware ESXi hypervisors, cybersecurity experts have released a script that can decrypt at least some affected virtual machines. Ransomware trackers count at least 2,803 victims, primarily in France, the U.S. and Germany.

LockBit Group Goes From Denial to Bargaining Over Royal Mail

Mathew J. Schwartz  •  February 7, 2023

The LockBit group has gone from denying it had any involvement in the ransomware attack on Britain's Royal Mail to trying to bargain for a ransom. The ransomware group's site now lists Royal Mail as a victim and demands it pay a ransom or see stolen data get dumped.

Microsoft Experiences Second Major Cloud Outage in 2 Weeks

Mathew J. Schwartz  •  February 7, 2023

Microsoft suffered its second major outage in less than two weeks, as users in North America and beyond were left unable to send, receive or search emails via Outlook.com and unable to access some additional functionality, including calendar APIs. Microsoft blamed unspecified "recent changes."

Notorious Finnish Hacker 'Zeekill' Busted by French Police

Mathew J. Schwartz  •  February 6, 2023

French police arrested hacker Aleksanteri Kivimäki, 25, who's suspected of hacking and extorting a Finnish mental health service provider, leaking patient data and extorting 25,000 patients. The suspect was formerly convicted of disrupting thousands of websites when he was a teenager.

Cyber Insurer Sees Remote Access, Cloud Databases Under Fire

Mathew J. Schwartz  •  February 3, 2023

Criminals lately have been prioritizing two types of attacks: exploiting Remote Desktop Protocol and penetrating cloud databases. So warns cyber insurer Coalition, based on analyzing in-the-wild attacks seen in 2022 via underwriting and claims data, scans of IP addresses and honeypots.

Ransomware Gang Stole Customer Data, Arnold Clark Confirms

Mathew J. Schwartz  •  February 2, 2023

Christmastime was bleak for a number of organizations in Britain that got hit with ransomware, including car dealership giant Arnold Clark, which originally reported that no customer data had been stolen. But the business subsequently revised its assessment, after attackers dumped stolen data.

White House Mulls Banning Huawei's Access to US Technology

Mathew J. Schwartz  •  February 1, 2023

Chinese technology firms could be completely banned from buying U.S.-built technology under export control restrictions being mulled by the White House, which has already restricted access to the advanced semiconductors Beijing needs to realize its large-scale artificial intelligence ambitions.

Will Hive Stay Kaput After FBI Busts Infrastructure?

Mathew J. Schwartz  •  January 31, 2023

What's not to love about an international law enforcement operation visiting disruption on Hive, the ransomware-wielding crime syndicate? But with no suspects in jail, it's unclear how long this takedown might stick before the bad guys reboot or rebrand.

JD Sports Details Data Breach Affecting 10 Million Customers

Mathew J. Schwartz  •  January 30, 2023

JD Sports, a sports fashion retailer with global operations, says personal details pertaining to about 10 million online customers of JD Sports and its Size?, Millets, Blacks, Scotts and MilletSport brands from 2018 to 2020 have been stolen by attackers and warns customers to beware of scammers.

Targets of Opportunity: How Ransomware Groups Find Victims

Mathew J. Schwartz  •  January 27, 2023

As ransomware continues to pummel numerous sectors, and lately especially the manufacturing industry, how does any given organization end up becoming a target or victim? Cybercrime watchers say the answer involves initial access brokers, botnets, targets of opportunity and, above all, profit.