Content by Mathew J. Schwartz

Fxmsp Hackers Behind AV Source Code Heist: Still Operating?

Mathew J. Schwartz  •  June 29, 2020

Is the Fxmsp hacking operation still in business? Experts say Fxmsp earned $1.5 million in illicit profits, thanks to a botnet-based business model that enabled the group to sell remote access to hacked networks. But then it advertised source code allegedly stolen from three anti-virus vendors.

Hacking Timeline: Fxmsp's Rise and Apparent Fall

Mathew J. Schwartz  •  June 29, 2020

How long does it take to become a reliable, trusted seller in the cybercrime-as-a-service ecosystem? For the Fxmsp hacking collective, experts say the answer is about a year. The group built a botnet that facilitated network intrusions and data exfiltration, but it was driven off cybercrime forums.

Ransomware Gangs Go (Lady) Gaga for Data Breaches

Mathew J. Schwartz  •  June 24, 2020

Many ransomware gangs hell-bent on seeing a criminal payday have now added data exfiltration to their shakedown arsenal. Gangs' extortion play: Pay us, or we'll dump stolen data. One massive takeaway is that increasingly, ransomware outbreaks also are data breaches, thus triggering breach notification rules.

Nefilim Ransomware Gang Tied to Citrix Gateway Hacks

Mathew J. Schwartz  •  June 22, 2020

Hackers wielding Nefilim ransomware are targeting unpatched or poorly secured Citrix remote-access technology, then stealing data, unleashing crypto-locking malware and threatening to dump data to try to force payment, New Zealand's national computer emergency response team warns.

Britain Makes U-Turn on Digital Contact-Tracing App

Mathew J. Schwartz  •  June 19, 2020

Britain's failure to contain COVID-19 - despite Prime Minister Boris Johnson promising a "world-beating" effort - now includes a failed digital contact-tracing app. A new version, built to work with Apple and Google APIs, may be released by winter. Really, what's the rush?

Maze Ransomware Gang Continues Data-Leaking Spree

Mathew J. Schwartz  •  June 18, 2020

The Maze ransomware gang is continuing to exfiltrate data from victims before crypto-locking their systems, then leaking the data to try to force non-payers to accede to its ransom demands. Don't want to play ransomware gangs' latest games? The only way to opt out is by planning ahead.

Ransom Demands: What Happens If Victims Pay or Don't Pay?

Mathew J. Schwartz  •  June 17, 2020

If your organization gets hit by ransomware, what should happen next? Ideally, organizations will get help to identify the best response, says Kroll's Alan Brill. He notes that many organizations are now carrying cyber insurance coverage, in part, to gain rapid access to incident response tools and expertise.

White House: US Firms Can Work With Huawei on 5G Standards

Mathew J. Schwartz  •  June 16, 2020

The Trump administration's continued press against China snared an unintended victim: America's own influence over 5G standards development. But the U.S. Commerce Department says a new rule will free U.S. firms to work with any company, including China's Huawei, on developing new telecommunications standards.

Claire's: Magecart E-Commerce Hackers Stole Card Data

Mathew J. Schwartz  •  June 15, 2020

Jewelry retailer Claire's says Magecart attackers hits its e-commerce store, hosted on Salesforce Commerce Cloud, and stole an unspecified number of customers' payment card details. Security firm Sansec, which discovered the breach, says Magecart attacks have grown more targeted during lockdown.

City Pays Ransom Despite Pre-Ransomware Outbreak Hack Alert

Mathew J. Schwartz  •  June 12, 2020

The attack sounds ripped from an episode of TV show "24": Hackers have infiltrated a government network, and they're days away from unleashing ransomware. Unfortunately for Florence, a city in Alabama, no one saved the day, and officials are sending $300,000 in bitcoins to attackers for a decryption key.

Financial and Economic Crime Targeted by New Europol Center

Mathew J. Schwartz  •  June 10, 2020

Europe is targeting financial and economic crime, including fraud and money laundering, via the new European Financial and Economic Crime Center, hosted by the EU's law enforcement intelligence agency Europol. Officials say the launch of such a center during the COVID-19 pandemic is no accident.

Phishing Attacks Traced to Indian Commercial Espionage Firm

Mathew J. Schwartz  •  June 9, 2020

Surveillance researchers at Citizen Lab have tied thousands of "Dark Basin" corporate espionage phishing attacks to a small Indian cybersecurity firm called BellTroX InfoTech Services. It's led by Sumit Gupta, who was indicted by the U.S. in 2015 for criminal hacking on behalf of private investigators.

7 Ransomware Trends: Gangs Join Forces, Auction Stolen Data

Mathew J. Schwartz  •  June 8, 2020

Ransomware gangs keep innovating: Maze has begun leaking data on behalf of both Lockbit and RagnarLocker, while REvil has started auctioning data - from victims who don't meet its ransom demands - to the highest bidder. Thankfully, security experts continue to release free decryptors for some strains.

Should 'Killer Robots' Be Banned?

Mathew J. Schwartz  •  June 5, 2020

How big is the step from humans using drones to kill other humans to building lethal autonomous weapons systems that can kill on their own? Ethically and technologically, that's a huge leap. But military planners are working to build what some call "killer robots." And the UN wants them banned.

'Anonymous' Leak of Minneapolis Police Data Is a Hoax

Mathew J. Schwartz  •  June 3, 2020

Not all data breaches are what they might seem, and not all leakers are who they might claim to be. Take the doxing of the Minneapolis Police Department, supposedly by Anonymous hacktivists: The leaked employee information was almost certainly culled from old breaches. So who did it, and why?