Stay ahead of the headlines

Aug 6, 2024·BleepingComputer

A recent cybercriminal campaign has been identified that targets Android devices globally, using thousands of Telegram bots to distribute SMS-stealing malware aimed at intercepting one-time 2FA passwords for over 600 services. Researchers at Zimperium have tracked this operation since February 2022, uncovering 107,000 distinct malware samples linked to the campaign, which is primarily driven by financial motives. The malware is disseminated through deceptive ads and Telegram bots, which lure victims with promises of pirated apps, subsequently hijacking SMS messages to steal OTPs and facilitate authentication for illicit activities. Most victims are in India and Russia, with significant cases also in Brazil, Mexico, and the U.S. Infected devices are unwittingly used to provide anonymization services for online interactions, leading to potential unauthorized charges and legal implications for the victims. Users are advised to exercise caution by avoiding APKs from outside Google Play, restricting app permissions, and keeping Play Protect active.

Aug 6, 2024·IT Brew

A major IT outage caused by enterprise security firm CrowdStrike on July 19 led to massive disruptions across various sectors, including airlines and businesses, triggering substantial direct and indirect costs estimated in the billions. The root cause was identified as a bug in their quality control system, with most affected systems now restored. However, determining financial liability remains uncertain and could take months or years. Legal actions, including potential class suits and individual claims from affected companies like Delta Air Lines, are expected to prolong the resolution process. Industry experts suggest that software liability limitations and insurance negotiations will further complicate compensation payouts. Despite the outage, significant customer losses for CrowdStrike are not anticipated due to the entrenched nature of enterprise software solutions and the high costs associated with switching providers.

Aug 6, 2024·The Verge

Delta Air Lines CEO Ed Bastian revealed in a CNBC interview that a recent IT outage caused by a CrowdStrike update resulted in costs of half a billion dollars for Delta over five days, leading to over 5,000 flight cancellations and lingering error screens at airports. Bastian criticized Microsoft's platform as fragile, highlighting the need for big tech companies to balance innovation with current stability. Delta's IT department received only free consulting advice as compensation, while the company has since hired attorney David Boies to pursue damages. Moreover, CrowdStrike shareholders have filed a class action lawsuit, alleging false claims about the validation and testing of the faulty update. The incident underscores differences in how Microsoft and Apple handle third-party access to their operating systems and has led to calls for more rigorous testing protocols from vendors with critical access to Delta's systems.

Aug 6, 2024·darkreading

The article discusses a troubling trend where cybersecurity professionals, facing economic pressures and stagnating salaries, are turning to cybercrime for additional income. The Chartered Institute of Information Security (CIISec) has noted a rise in Dark Web advertisements for cybercriminal services, such as developing phishing pages or using AI for malicious coding, by individuals with legitimate cybersecurity day jobs. This shift is driven by mass layoffs and economic uncertainty in the cyber sector, exacerbating stress and employee dissatisfaction. Experts recommend that enterprises improve their understanding of cybersecurity roles, provide professional development, and focus on mental health to combat insider threats and close the skills gap.

Aug 6, 2024·aha.org

OneBlood, a nonprofit blood provider serving several states, is experiencing a ransomware attack that has significantly disrupted its operations. This has led hospitals to implement conservation strategies, impacting patient care. OneBlood continues to operate at reduced capacity without specifying when normal operations will resume. The American Hospital Association (AHA) is coordinating with state and federal bodies, including the Association for the Advancement of Blood & Biotherapies (AABB), to manage the situation. The AHA and Health Information Sharing and Analysis Center released a bulletin highlighting the need for hospitals to integrate third-party suppliers into their risk management plans due to increasing ransomware attacks on critical healthcare providers.

Aug 6, 2024·The Cyber Express

Recent cyberattacks on U.S. healthcare facilities, including a massive ransomware attack on UnitedHealth’s Change Healthcare subsidiary, highlight the sector's urgent need for enhanced cybersecurity measures. A recent report by SecurityScorecard gives the healthcare sector a "B+" rating for cybersecurity, indicating moderate progress but significant areas needing improvement, such as supply chain risks and application security. Chief Technology Officers (CTOs) play a critical role in navigating these challenges, taking on increased responsibilities in strategic decision-making and innovation to protect patient data and maintain operational efficiency. The rise of ransomware groups like BlackCat and BlackSuit underscores the necessity for robust cybersecurity strategies, including regular software updates, network segmentation, and adherence to HIPAA regulations. Advanced AI-driven solutions, like those offered by Cyble, can provide real-time monitoring and vulnerability management to strengthen healthcare defenses.

Aug 6, 2024·Wall Street Journal

CrowdStrike has responded to Delta Air Lines' accusations regarding a recent tech outage that caused significant disruption and financial losses for the airline. In a letter to Delta's legal team, CrowdStrike rejected the claim that it is to blame for Delta's prolonged issues following the outage, asserting that Delta's threats of litigation have created a misleading narrative. The cybersecurity firm, which has its liability capped at single-digit millions, attributed the outage to a bug in its quality-control tool and highlighted that other airlines recovered quickly while Delta struggled for days. The U.S. Department of Transportation is investigating Delta's response to the disruption. Delta CEO Ed Bastian estimated the outage cost the airline $500 million and has initiated an internal review to learn from the incident.

Aug 5, 2024·TechRadar

Cyberattacks on hospitals and healthcare institutions are escalating, with ransomware incidents causing significant disruptions, from cancelled appointments to compromised patient safety. These attacks exploit the healthcare sector's valuable data, often involving high-stakes ransom demands. The cost of cybercrime is projected to reach $10.5 trillion annually by 2025, heavily impacting patients. Persistent use of outdated IT systems and reactive cybersecurity measures exacerbate vulnerabilities. Strategies like network segmentation and an assumed breach approach are recommended to enhance cyber resilience, ensuring continuous operation and increasing response speed to mitigate these threats effectively.

Aug 5, 2024·The Record Media

IBM's annual report on cybersecurity has revealed that the average cost of a data breach has risen to $4.88 million, a 10% increase from last year’s $4.45 million. Conducted with the Ponemon Institute, the study analyzed 604 organizations across 17 industries and 16 countries. This rise was noted as the largest since the pandemic began, with more than half of the organizations passing on the increased costs to customers through higher prices. Significant breach-related costs include lost business and post-breach activities, amounting to $2.8 million. In the healthcare sector, breaches cost an average of $9.77 million, marking it the most affected industry since 2011. The analysis covered various breach causes, including phishing and compromised credentials, with ransomware attack-related breaches showing cost savings when law enforcement was involved. The U.S. led in average breach costs at $9.36 million.

Aug 5, 2024·Fox News

OneBlood, a significant nonprofit blood donation service for over 300 hospitals in the southeastern U.S., has experienced a ransomware attack compromising its software systems and reducing its operational capacity. Despite this, OneBlood continues to collect, test, and distribute blood through manual processes, which are slower and affect inventory availability. The organization is collaborating with cybersecurity experts and law enforcement to address the incident and restore system functionality. In response to the situation, OneBlood has requested that partner hospitals activate critical blood shortage protocols and has called for urgent blood donations, particularly of O positive, O negative, and platelets. National coordination through the AABB Disaster Task Force and contributions from blood centers across the country are aiding OneBlood's efforts. Founded in 2012, OneBlood has grown to become the second-largest blood center in the U.S., distributing over a million blood products annually.

Aug 5, 2024·Becker's Hospital Review

Recent reports indicate that large health systems are showing profits and improved margins post-pandemic, but misconceptions about their financial stability persist. Healthcare leaders like Dr. Craig Kent of UVA Health and Lyndon Edwards of Loma Linda University Medical Center highlight that despite overall sector growth, hospital margins remain thin due to rising supply, pharmaceutical, and labor costs. Much of the substantial healthcare spending goes to pharmaceutical companies and insurers rather than hospitals. Safety-net hospitals particularly struggle, often operating at negative margins, while financial disparity within the healthcare sector deepens. Ongoing financial challenges are amplified by increasing patient acuity and mental health needs, necessitating innovative financial support models to sustain healthcare delivery.

Aug 5, 2024·KrebsOnSecurity

An international prisoner swap between Russia and Western countries resulted in the release of 24 prisoners, including notable cybercriminals and political detainees. Among those repatriated to Russia were Roman Seleznev, convicted of extensive payment card data theft, and Vladislav Klyushin, involved in a $93 million insider trading scam. In exchange, Russia freed 16 prisoners, including Wall Street Journal reporter Evan Gershkovich and ex-U.S. Marine Paul Whelan, both previously accused of espionage. The swap also saw the release of other Americans, several German nationals, and four individuals accused of being Russian spies by Slovenia, Norway, and Poland.

Aug 5, 2024·CIO.com

In a post-truth IT landscape where misinformation is rampant, CIOs must adopt roles as fact-finders, fixers, and framers. They are responsible for validating information, addressing and correcting issues, and contextualizing technology's role within their organizations. This multidimensional approach ensures they navigate through and maintain focus on what genuinely matters, countering both overly optimistic and pessimistic narratives surrounding technology.

Aug 5, 2024·Cybersecurity Dive

A recent global IT outage caused by a faulty CrowdStrike software update has reignited concerns about the security of the software supply chain, echoing issues from the 2020 SolarWinds attack. The U.S. Government Accountability Office highlighted the event, which impacted 8.5 million Microsoft Windows systems, in a new report. The White House emphasized persistent vulnerabilities related to memory safety in software development and called for industry-wide adoption of memory-safe programming languages. Microsoft and CrowdStrike are investigating the incident, attributed to a memory safety error in the CSagent.sys driver, and are exploring prevention strategies. The Cybersecurity and Infrastructure Security Agency is collaborating with partners to assess and mitigate the repercussions of the outage.

Aug 5, 2024·ciodive.com

The recent software update failure in CrowdStrike's platform caused significant disruptions worldwide, highlighting the risks associated with automatic updates in IT systems. The incident, which led to the Blue Screen of Death on millions of Windows computers, impacted various sectors, including airlines and banking, and resulted in financial losses exceeding $5.4 billion for Fortune 500 companies. This event underscored the need for IT leaders to adopt more stringent quality assurance and risk mitigation practices, such as canary deployments and staggered updates, to prevent widespread issues from faulty software updates in the future.

Aug 2, 2024·The Guardian

CrowdStrike, a cybersecurity firm, is facing an investor lawsuit filed by Plymouth County Retirement Association in Texas, following a significant global computer outage linked to its software in July. The lawsuit alleges that CrowdStrike misled investors by falsely claiming that its technology was rigorously tested and validated. The plaintiffs argue that inadequate software testing led to the widespread outage, damaging CrowdStrike's reputation and legal standing. Additionally, the company faces other legal actions, including from Delta Air Lines, which estimates a $500 million loss due to the disruption. Despite the fallout, CrowdStrike maintains that the lawsuit is baseless. The outage's overall cost to major companies is estimated at $5 billion, and the company's response included giving $10 UberEats vouchers to team members, which were subsequently blocked by Uber.

Aug 2, 2024·cnn.com

A cyberattack has compromised OneBlood, a key blood-donation nonprofit that supports over 250 hospitals in the southeastern US. Reported initially by CNN, the incident is suspected to be a ransomware attack, leading to significant service disruptions. OneBlood’s software outage is affecting blood product distribution, forcing the organization to manually label products and operate at a reduced capacity. Hospitals in Alabama, Florida, Georgia, and the Carolinas are impacted, and emergency blood shortage protocols have been activated. The nonprofit is collaborating with cybersecurity experts and law enforcement to resolve the issue.

Aug 2, 2024·Becker's Healthcare

Mark Cuban has issued a stark warning to self-insured employers about the potential for lawsuits related to pharmacy rebates in employee benefits programs. Highlighting the increasing legal pressures, Cuban emphasizes that it's not a matter of if, but when these employers will face class action lawsuits that could surpass previous major settlements, such as those in the tobacco industry. Recent lawsuits against companies like Wells Fargo and Johnson & Johnson for alleged mismanagement and inflated drug prices underline the growing scrutiny under the Employee Retirement Income Security Act (ERISA). Employers are advised to thoroughly review their contracts and claims data to ensure fiduciary compliance and mitigate potential legal risks.

Aug 2, 2024·cyberscoop

The Senate Homeland Security and Governmental Affairs Committee has advanced three key bipartisan cybersecurity bills, moving them towards full Senate consideration. The "Streamlining Federal Cybersecurity Regulations Act" seeks to harmonize conflicting federal cybersecurity rules to ease the regulatory burden on the private sector. The "Healthcare Cybersecurity Act" aims to enhance collaboration between the Cybersecurity and Infrastructure Security Agency and the Department of Health and Human Services to strengthen cyber defenses in the healthcare sector. Lastly, the "Federal Cyber Workforce Training Act" focuses on developing a centralized resource and training center to improve the federal cybersecurity workforce, leveraging private sector and academic expertise. All bills were passed with a 10-1 vote, with opposition from Sen. Rand Paul over concerns about increased spending. The full Senate vote schedule has not yet been determined.

Aug 2, 2024·cyberscoop

Microsoft has taken control of the domain rockcaptcha.com, which was used by a trio of Vietnamese individuals to sell CAPTCHA bypass services and create fraudulent accounts, following a court order on July 23. This action is part of an ongoing investigation into the group, dubbed Storm-1152, responsible for generating around 750 million fake Microsoft accounts and facilitating various cybercrimes including ransomware and data theft. The group had resumed operations on a smaller scale after a previous disruption in December 2023, which had significantly impacted their activities. The use of AI to defeat CAPTCHA puzzles and generate fraudulent accounts is noted as an emerging trend in cybercrime. The seizure aims to further undermine the group's credibility and operational capabilities.