VMware’s Tom Kellermann on Defending Against Ransomware Attacks
In ransomware attacks, cybercriminals attack through the backups because they know that security practitioners rely on backups to save themselves after a ransomware attack. Therefore, it is essential to have multiple backups, says Tom Kellermann, head of cybersecurity strategy at VMware.

https://www.inforisktoday.co.uk/enterprise-backups-are-becoming-targets-for-cybercriminals-a-17820

Also: Increasing Diversity and Inclusion in Cybersecurity
Four ISMG editors discuss important cybersecurity issues, including law enforcement authorities’ disruption of ransomware gang REvil’s operations, how to collaborate as an industry to fight the surge in ransomware attacks hitting businesses, and increasing diversity and inclusion in the workplace.

https://www.inforisktoday.co.uk/ismg-editors-solving-ransomware-problem-together-a-17818

Company Aims to Fill 250,000-Worker Shortfall in Cybersecurity
Microsoft launched a four-year campaign on Thursday with community colleges in the U.S. aimed at recruiting hundreds of thousands of people into the field of cybersecurity. The goal is to fill an expected shortfall of 250,000 workers in cybersecurity, which Microsoft says means rising risk.

https://www.inforisktoday.co.uk/microsoft-launches-cybersecurity-recruitment-campaign-a-17816

Security Experts: ‘Grief’ Ransomware Gang Leaks Alleged NRA Data on Darknet
The National Rifle Association has reportedly fallen victim to a ransomware attack at the hands of a Russian cybercriminal gang known as Grief. The group has reportedly posted 13 files to its website after claiming to have hacked the gun rights advocacy group.

https://www.inforisktoday.co.uk/nra-reportedly-hit-by-russia-linked-ransomware-attack-a-17815

Incident Is Among Latest Involving Healthcare Supply Chain Vendors
A ransomware attack on a medical practice management services firm that included the theft of files containing patient information is among the latest security incidents involving similar third-party vendors.

https://www.inforisktoday.co.uk/phi-stolen-in-practice-management-firms-ransomware-attack-a-17813

Group Uses MATA Framework to Target Defense Orgs, Researchers Say
North Korean advanced persistent threat group Lazarus - aka Hidden Cobra - is developing supply chain attack capabilities using its multiplatform malware framework, MATA, for cyberespionage goals, according to researchers from Kaspersky.

https://www.inforisktoday.co.uk/lazarus-adds-supply-chain-attack-to-list-capabilities-a-17811

Kim Wyman Enters Biden Administration as Key Election Security Leader
CISA announced that Washington Secretary of State Kim Wyman will be the agency’s senior election security lead. She will become a top security official within the Biden administration, inheriting a role that has garnered public attention following interference in 2016 and fraud claims in 2020.

https://www.inforisktoday.co.uk/washington-secretary-state-to-head-election-security-a-17812

Desorden Group Attacks Thailand’s Central Group of Companies
The Desorden hacker group, previously known for its exploits against computer giant Acer and a Singaporean employment agency, has now targeted Thai luxury hotel chain Centara Hotels & Resorts. The group claims to have stolen 400GB of data from the hotel chain’s network.

https://www.inforisktoday.co.uk/hackers-claim-400gb-data-stolen-from-thai-hotel-chain-a-17814

Severe ‘Extortion-Based’ Attack From Foreign Entities, Firm Tweets
Telecom company Voipfone has come under a severe “extortion-based” DDoS attack from foreign entities, according to a tweet by the U.K.-based company. The attack is likely a continuation of the one observed on Thursday, although the company stated that all its systems remained operational.

https://www.inforisktoday.co.uk/voipfone-ddos-attacks-raise-specter-protection-racket-a-17805

4th Major Singapore Data Breach This Year Due to Third-Party Vendors
Singapore healthcare firm Fullerton Health confirms that a data breach in the server of its vendor partner Agape Connecting People was responsible for the leak of 400,000 user accounts. The incident marks the fourth major data breach incident involving third-party vendors in Singapore this year.

https://www.inforisktoday.co.uk/vendor-partner-responsible-for-fullerton-health-data-breach-a-17806

Bureau of Cyberspace and Digital Policy to Include Ambassador, Special Envoy
The U.S. Department of State will create a Bureau of Cyberspace and Digital Policy, led by a Senate-confirmed ambassador-at-large, to advance its cybersecurity diplomacy efforts, according to Secretary of State Antony Blinken. The move is a response to a challenging global threat landscape.

https://www.inforisktoday.co.uk/us-state-department-to-create-dedicated-cyber-office-a-17807

Iranian Government Blames Unnamed Foreign Country
An attack on systems that govern fuel subsidies in Iran reportedly hit all fuel stations and left many of the country’s citizens without gas for hours. Islamic Republic of Iran Broadcasting says that a cyberattack caused widespread disruption to the country’s fuel distribution network.

https://www.inforisktoday.co.uk/cyberattack-reportedly-cripples-iran-gas-stations-a-17803

Rebranding Remains Easy for Ransomware Groups, While Affiliates Already Come and Go
Will the notorious ransomware operation known as REvil, aka Sodinokibi, reboot yet again after someone apparently messed with its infrastructure? Experts suggest that the operation’s brand is burned, and administrators will launch a new group. Many affiliates, meanwhile, already work with multiple groups.

https://www.inforisktoday.co.uk/revils-cybercrime-reputation-in-tatters-will-reboot-a-17802

‘Operation DarkHunTOR’ Seizes Millions in Cash & Crypto, Plus Drugs, Guns
International law enforcement officials on Tuesday announced that some 150 suspects have been arrested globally for buying or selling illegal goods, following a 10-month sting operation, code name “Operation DarkHunTOR,” targeting the dark web.

https://www.inforisktoday.co.uk/us-doj-global-darknet-sting-nabs-150-suspects-a-17799

Ron Ross of NIST Discusses Moving Away From Stovepipe Thinking
In preparation for the relaunch of ISMG’s education platform, CyberEd.io, Ron Ross of the National Institute of Standards and Technology and Brian Barnier, who is designing a course on critical thinking and design thinking, discuss the need for reorienting toward systems thinking in cybersecurity.

https://www.inforisktoday.co.uk/need-for-systems-thinking-in-cybersecurity-a-17798

Steve King of CyberTheory on Getting Serious With Our Defense Strategy
Findings from CyberTheory’s 2021 Third Quarter Review indicate that criminals are exploiting the open-source supply chain, and those exploits are proving much more difficult to identify, defend and stop in terms of complexity and depth than we’ve seen before, says CyberTheory’s director, Steve King.

https://www.inforisktoday.co.uk/defending-against-open-source-supply-chain-attacks-a-17797

Retailer Says an Attempt Was Made to Interfere With Its Systems
Grocery retailer Tesco said it faced a service disruption on its app and website. The company told ISMG that the outage was likely due to an attempt to interfere with its systems. On Monday, a company spokesperson said that both the website and app were now “back up and running.”

https://www.inforisktoday.co.uk/uks-tesco-supermarket-app-website-disrupted-a-17792

Microsoft Says Nobelium APT Is Eyeing Resellers, Tech Service Providers
The actor behind the cyberattack targeting SolarWinds customers - Nobelium - is continuing its campaign to target the global IT supply chain, according to a new advisory from Microsoft, which says 140 resellers and tech service providers have been notified that they have been targeted by the group.

https://www.inforisktoday.co.uk/report-solarwinds-hackers-targeting-supply-chain-a-17793

Move by Colonial Pipeline Attackers Follows Law Enforcement Action Against REvil
Following an outage of the REvil - aka Sodinokibi - ransomware operation due to coordinated law enforcement efforts involving the U.S. and foreign partners, the operators behind DarkSide ransomware have moved Bitcoin worth almost $7 million to multiple new wallets, making it more difficult to track.

https://www.inforisktoday.co.uk/darkside-transfers-7-million-worth-bitcoin-a-17787

Email Addresses Correlate With Accounts on Crypo Price Tracking Service
CoinMarketCap says it has found no evidence of a data beach despite the circulation of a list of 3.1 million email addresses that correlates with accounts on its service. Regardless of the source, the list would be useful for attackers to launch phishing attacks against those interested in cryptocurrency.

https://www.inforisktoday.co.uk/coinmarketcap-no-breach-despite-31m-email-address-leak-a-17789