Police raided a property last week in Ukraine as part of their investigation into an alleged ransomware-wielding crime group. (Image: Ukrainian Cyber Police)

Police Bust Suspected Ransomware Group Ringleader in Ukraine

Mihir Bagwe • November 28, 2023

Police have arrested a group of criminals in Ukraine, including their alleged ringleader, who they suspect launched ransomware attacks against organizations across 71 countries, amassing at least 1,800 victims, from which they demanded ransoms collectively worth hundreds of millions of dollars.

Endpoint Security

ONCD Temporarily Fills Critical Vacant Federal Cyber Role

Latest

Security Information & Event Management (SIEM)

CrowdStrike SIEM Demand Rises Amid Cisco-Splunk, Legacy Woes

Michael Novinson • November 28, 2023

Discontent with legacy SIEM offerings and Cisco's proposed acquisition of Splunk has driven "a significant and pronounced increase in interest" in CrowdStrike's SIEM offering. It hit the $100 million ARR milestone last quarter thanks to LogScale's search speed, data gravity and cost efficiency.

Critical Infrastructure Security

Iranian Hacking Group Attacks Pennsylvania Water Authority

Chris Riotta • November 28, 2023

The U.S. Cybersecurity and Infrastructure Security Agency is investigating a cyberattack from an Iranian hacking group known as "Cyber Av3ngers" that targeted a small municipal water authority in Pennsylvania over its use of Israeli-owned software, according to officials.

Government

Second Front Raises $40M to Support More Classified Networks

Michael Novinson • November 28, 2023

A vendor focused on fast-tracking government access to commercial software closed its Series B funding round to support more classified and regulated environments. The $40 million will allow Second Front Systems to support additional bespoke networks in the U.S. Defense and National Security space.

Cybercrime

Apparent GE Hack Raises National Security Concerns

Chris Riotta • November 28, 2023

General Electric says it is aware of claims made by "a bad actor" about gaining unauthorized access to its sensitive data and taking "appropriate measures to help protect the integrity of our systems" after a hacker known as IntelBroker advertised access to its networks and data.

Fraud Management & Cybercrime

Thanksgiving Day Attack on Ardent Health Serving Leftovers

Marianne Kolbasuk McGee • November 28, 2023

Patient services - including emergency care and telehealth appointments - are still affected at dozens of hospitals and other care facilities in several states operated by Ardent Health Services as the Tennessee-based organization continues to respond to a Thanksgiving Day ransomware attack.

Cybercrime

DP World Says Australian Employee Data Stolen in Attack

Mihir Bagwe • November 28, 2023

A cyber incident that incapacitated four major Australian ports for days also resulted in the theft by hackers of employee data, the port operator said Tuesday. Hackers obtained personal information of current and former employees of DP World Australia in an incident first detected on Nov. 10.

Email Security & Protection

Proofpoint Snags Former VMware President Sumit Dhawan as CEO

Michael Novinson • November 28, 2023

Proofpoint landed top VMware lieutenant Sumit Dhawan as its new chief executive just days after the cloud and virtualization giant was acquired by Broadcom. The Silicon Valley-based email security firm said it liked Dhawan's track record of building security, cloud and end-user computing businesses.

Business Continuity Management / Disaster Recovery

Insights From Israel: Guy Shafir, WideOps

Tom Field • November 28, 2023

DDoS and other cyberattacks against media outlets and critical services are what Guy Shafir, CTO of Israeli tech vendor WideOps, has been dealing with since the start of the terrorist attacks in Israel on Oct. 7. Shafir shared details about the response to these intense attacks.

Active Directory

Mapping Access - and Attack - Paths in Active Directory

Steve King • November 28, 2023

A directory service should be a "source of truth," said Justin Kohler, vice president of products at Spector Ops. But when users are overprivileged or misconfigurations occur, that creates attack hubs. Kohler discusses BloodHound, a solution he says is like Google Maps for Active Directory.

Data Loss Prevention (DLP)

Zscaler Taps Generative AI to Measure Risk, Predict Breaches

Michael Novinson • November 27, 2023

Zscaler infused generative AI features into its data protection bundles and is introducing AI-powered products that quantify risk and predict breaches, said CEO Jay Chaudhry. The cloud security firm enhanced its data protection policies for AI/ML apps and tools to lower the likelihood of data loss.

Fraud Management & Cybercrime

Hospital Chain Hit With Ransomware Attack

Marianne Kolbasuk McGee • November 27, 2023

Tennessee-based Ardent Health Services, which operates dozens of hospitals and other healthcare facilities in several states, said on Monday that it is dealing with a ransomware attack that has forced the entity to divert some patients and cancel or reschedule certain procedures.

Artificial Intelligence & Machine Learning

US, UK Cyber Agencies Spearhead Global AI Security Guidance

Akshaya Asokan , Chris Riotta • November 27, 2023

Nearly two dozen national cybersecurity organizations on Sunday urged AI developers to embrace "secure by design" and other preventive measures aimed at keeping hackers out from the mushrooming world of AI systems. The United Kingdom and United States spearheaded its development.