Latest

Account Takeover

Card Skimmer Found Hitting Vulnerable E-Commerce Sites

Doug Olenick  •  July 8, 2020

A credit card skimmer that has been operating since April is specifically targeting sites hosted on Microsoft IIS servers that are currently running an out-of-date version of ASP.NET, according to security firm Malwarebytes. About 27 million websites still use this now unsupported software.

Cybercrime

Feds Indict 'Fxmsp' for Hacking Multiple Firms

Ishita Chigilli Palli  •  July 8, 2020

The U.S. Justice Department has charged Kazakhstan national Andrey Turchin with being the hacker known as "Fxmsp," as well as running a hacking collective known by the same name that's been tied to 300 attacks worldwide, including against anti-virus vendors.

►

Governance & Risk Management

CCPA Enforcement: What to Expect Now

Anna Delaney  •  July 8, 2020

Attorney Sadia Mirza, offers an update on the July 1 California Consumer Privacy Act enforcement and what security and privacy professionals should expect over the next few months.

►

COVID-19

DIACC: Building a Fully Digital Canada

Anna Delaney  •  July 8, 2020

Joni Brennan, president of the Digital ID & Authentication Council of Canada (DIACC), says identity management is a core component to building a solid foundation for a socioeconomic safety net, particularly during a pandemic. However, engagement and education are also vital components to establishing a strong...

Electronic / Mobile Payments Fraud

'Keeper' Group Targeted Payment Card Data on 570 Sites

Akshaya Asokan  •  July 8, 2020

A hacking group known as "Keeper" has been using Magecart-like web skimmers to target the online checkout sites and portals of hundreds of e-commerce sites in order to steal the payment card data from about 184,000 customers, according to Gemini Advisory. The thefts are estimated to total in the millions.

Anti-Phishing, DMARC

Microsoft Seizes Domains Used for COVID-19 Phishing Scam

Doug Olenick  •  July 7, 2020

A U.S. federal court has issued an injunction that gives Microsoft permission to seize control of several malicious domains being used to operate a COVID-19-themed phishing scam, according to recently unsealed court documents.

Cybercrime

Russian BEC Gang Targets Hundreds of Multinational Companies

Akshaya Asokan  •  July 7, 2020

A newly uncovered Russia-based business email compromise gang has been targeting hundreds of large, multinational corporations in over 40 countries since 2019, according to the security firm Agari.

Endpoint Security

More Than 1,000 IoT Security Guidelines: Which One to Use?

Jeremy Kirk  •  July 7, 2020

With more than 1,000 IoT security guidelines, recommendations and best practices, which ones should an organization follow? Researchers at Carleton University in Canada say 91 percent of the guides are outcome-based, which are not necessarily easy for manufacturers to follow.

Cybercrime

Purple Fox Malware Targets More Vulnerabilities

Ishita Chigilli Palli  •  July 7, 2020

The developers behind the Purple Fox fileless downloader malware recently upgraded their operation and are now targeting two new vulnerabilities to gain access to networks, according to a report by security firm Proofpoint.

Business Continuity Management / Disaster Recovery

Ransomware + Exfiltration + Leaks = Data Breach

Mathew J. Schwartz  •  July 7, 2020

Ransomware-wielding attackers continue to pummel organizations. But labeling these as being just ransomware attacks often misses how much these incidents involve serious network intrusions, exfiltration of extensive amounts of data, data leaks and, as a result, reportable data breaches.

Cybercrime

Just How Lucrative Are BEC Scams?

Doug Olenick  •  July 6, 2020

A Nigerian national who has been extradited to the United States allegedly laundered millions of dollars stolen in business email compromise scams, according to the Justice Department. He flaunted his lavish lifestyle on social media, prosecutors say.

Cybercrime

Patching Urged as F5 BIG-IP Vulnerability Exploited

Ishita Chigilli Palli  •  July 6, 2020

Security researchers warn that the number of exploit attempts targeting a critical vulnerability in F5 Networks' BIG-IP networking products has steadily increased since the company first announced the flaw late last week. They urge users to immediately apply patches.