Acting CISA Director Brandon Wales testifying before the Senate Homeland Security and Governmental Affairs Committee

CISA Awaits Technical Details on Colonial Pipeline Attack

Scott Ferguson • May 11, 2021

CISA is still awaiting more technical details from Colonial Pipeline about the Friday ransomware attack that forced it to shut down its operations, Brandon Wales, the agency's acting director, told a Senate committee that's probing the attack and other cybersecurity incidents.

Critical Infrastructure Security

SmileDirectClub: Attack Taking Big Bite Out of Revenue

Latest

Critical Infrastructure Security

Colonial Pipeline: 'A Global Day of Reckoning'

Tom Field • May 11, 2021

Gregory Touhill, the retired Air Force general and former federal CISO under President Obama, minces no words when he describes the Colonial Pipeline ransomware attack as a "global day of reckoning" for critical infrastructure protection.

Business Continuity Management / Disaster Recovery

Alerts: Avaddon Ransomware Attacks Increasing

Prajeet Nair • May 11, 2021

Attackers are using Avaddon ransomware to target diverse organizations in the U.S., Australia and elsewhere, according to the FBI and the Australian Cyber Security Center. Among the recent victims was a service provider to Australian telecommunications company Telstra.

Business Continuity Management / Disaster Recovery

Assessing Whether a Nation-State Had a Role in Pipeline Attack

Steve King • May 11, 2021

Tom Kellerman of VMware Carbon Black shares his opinions about whether a nation-state was behind the recent ransomware attack on Colonial Pipeline and what the U.S. government should do to prevent other cyberattacks.

Cybercrime

DarkSide's Pipeline Ransomware Hit: Strictly Business?

Mathew J. Schwartz • May 11, 2021

"It's not personal ... It's strictly business." That line from "The Godfather" encapsulates the mindset of criminals who extort businesses using ransomware and other tools: Their imperative is profits, no matter any disruption they might cause to critical services, such as those provided by Colonial Pipeline.

Fraud Management & Cybercrime

Pipeline Attack: 'Time for a Disproportionate Response'

Tom Field • May 10, 2021

It’s serious, impactful and raises new questions about critical infrastructure protection. But don’t tell Philip Reitinger of the Global Cyber Alliance that the Colonial Pipeline ransomware attack is any kind of a “wake-up call.” He says we’re long past that.

3rd Party Risk Management

More Healthcare Disruptions Tied to Vendor Incidents

Marianne Kolbasuk McGee , Prajeet Nair • May 10, 2021

Two companies that serve the healthcare sector have reported disruptive cyber incidents affecting their clients, the latest in a string of similar supply chain incidents.

Fraud Management & Cybercrime

Tulsa City Officials Report Ransomware Attack

Doug Olenick • May 10, 2021

Tulsa city officials shut down systems and websites after a Sunday ransomware attack, making it impossible for residents to gain online access to many services.

Critical Infrastructure Security

Colonial Pipeline Confirms Ransomware Causing Disruptions

Scott Ferguson • May 8, 2021

Colonial Pipeline, which oversees more than 5,500 miles of pipeline that supplies fuel throughout the U.S. East Coast, confirmed Saturday that a ransomware attack has disrupted its services, and the company has taken some of its IT systems offline as a precaution.

Critical Infrastructure Security

US and UK Issue Joint Alert on Russian Cyber Activity

Doug Olenick • May 8, 2021

U.S. and U.K. cybersecurity, law enforcement and intelligence agencies issued a joint advisory Friday offering detailed information on how to defend against the activities of the Russian Foreign Intelligence Service, or SVR, in the wake of the 2020 SolarWinds supply chain attack.

Cybercrime

Malspam Campaign Used Hancitor to Download Cuba Ransomware

Akshaya Asokan • May 8, 2021

Attackers co-opted the Hancitor malware downloader and recently used it to deliver Cuba ransomware as part of an email spam campaign for data exfiltration and ransom extortion, a new report by security firm Group-IB finds.

Endpoint Security

How Patched Android Chip Flaw Could Have Enabled Spying

Prajeet Nair • May 7, 2021

A severe vulnerability in a system on certain Qualcomm chips, which has been patched, potentially could have enabled attackers to remotely control Android smartphones, access users' text messages and listen in on conversations, according to a new report from Check Point Software Technologies.

Fraud Management & Cybercrime

CISA Alert Describes FiveHands Ransomware Threat

Doug Olenick • May 7, 2021

The Cybersecurity and Infrastructure Security Agency has issued an alert providing more details on the threat posed by FiveHands ransomware attacks and offering risk mitigation tips.