← Cybersecurity Headlines
Cybersecurity Headlines
Ransomware affiliate arrested, UK hospital hacked, Cloudflare's lost logs
00:07:24
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Monday, December 2, 2024. I'm Steve Prentice. Ransomware Affiliate Mikhail Mataev Arrested Russian police have announced the arrest of Mataev, known by a few aliases, including Waza Waka and who was also allegedly linked to Lockbit, Conti and Babuk operations. He was apprehended in Kaliningrad, a Russian province sandwiched between Poland and Lithuania. In addition to being pursued by Russian authorities, the FBI also had a $10 million bounty on its head. Mataev faces charges under Russian law for creating programs to destroy, block, modify or copy data or bypass computer security measures, and he also faces charges levied by the U.S. justice Department for his alleged role in multiple ransomware attacks. Another UK hospital system attacked Liverpool's Alder Hay Children's Hospital and Liverpool Heart and Chest Hospital NHS Foundation Trust have been attacked by the Inc Ransomware gang. This gang has already published a sample of the allegedly stolen data, which quote includes the full names and addresses of supposed patients and donors. The amount of money said donors have given to the hospital patients medical reports including unique hospital numbers and dates of birth and financial documents. The gang claims this data goes back to 2018 and runs right up to 2024. This attack is unrelated to the one on Wirral University Teaching Hospital that we reported on on Friday's newscast, even though the two hospital systems are physically located close to each other across the River Mersey. The Wirral attack, by the way, has been attributed to the Ransom Hub operation. Cloudflare says it lost 55% of logs pushed to customers for 3.5 hours. This story pertains to a bug that appeared on November 14 in the Internet security company's log collection service, one that allows its customers to monitor the traffic on their websites and filter it based on certain criteria. This data is also used to investigate security incidents, DDoS attacks, traffic patterns and to perform site optimizations. This is a big service, amounting to over 50 trillion customer event logs every day, of which around 4.5 trillion are sent to customers. The incident was caused by a misconfiguration in a log forwarder component in Cloudflare's pipeline. The pause then created a massive spike once the system tried to resolve itself. Cloudflare has now implemented several measures to prevent future occurrences, huge thanks to our sponsor Vanta. As third party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews with Vanta Questionnaire Automation, Security and Compliance teams can complete security reviews up to five times faster, giving you time back to focus on running your security and compliance programs. Over 8,000 global companies like Zoom Info, Smart Recruiters and NOIBU use Vanta to save time on security reviews. Visit vanta.com to learn more about questionnaire automation, I.e. v A N T A.com Italian soccer team Bologna FC suffers a cyberattack this attack included the theft of data, which the club says will likely be released soon. In the same statement, the club said that the attack targeted its internal systems and warned that anyone who gains possession of or distributes the material would be committing a criminal offense. Separately, the RansomHub ransomware gang claimed responsibility for the attack, stating it was in possession of 200 gigabytes of data, including financial documents, medical records of players, confidential data on customers and employees, as well as business plans. They also stated that the stolen information will show the club is violating European data protection laws as well as other regulations from football bodies like FIFA and wafa. South Dakota Politicians Pegged to have Bigger Roles on Cybersecurity the incoming presidential administration will see three prominent Republicans from South Dakota take on roles in the nation's cybersecurity portfolio. Governor Christy Noem is slated to lead the Homeland Security Department, Senator Mike Rounds will be in charge of a key cybersecurity subcommittee, and John Thune will become Senate Majority Leader. Rounds was the first senator to serve on the Senate Armed Services Subcommittee on Cybersecurity. Thune's past tenure as chairman of the Senate Commerce Committee gave him jurisdiction over and oversight of privacy and tech bills, making it a legislative focus for him. He was also part of the long stalled push to pass a data privacy measure and sponsored a bill on artificial intelligence standards. According to cyberscoop, Christi Noem stood alone in rejecting department cyber grants to state and local governments, but has signed cyber legislation into law and has promoted cybersecurity as her state's next big industry. Uganda's Central Bank Loses Millions in cyberattack this attack is being attributed to a threat actor group called Waste, who apparently made off with the equivalent of $16.8 million. The group, which appears to be based in Southeast Asia, transferred part of the stolen funds to Japan. However, Uganda's central bank, with help from UK authorities, was able to freeze and recover some of the Money. Phishing tool Rockstar2FA targets Microsoft365 CREDS Researchers at Trustwave are warning of a phishing as a Service toolkit named Rockstar 2fa, which apparently targets Microsoft 365 accounts and bypasses multi factor authentication via adversary in the middle Attacks this tool is an updated version of the dadsec phishing kit. The attacks involved theft of a victim's password and session cookie through the creation of a proxy server between a target user and the website the user wishes to visit, which itself is a phishing site. Trustwave points out a unique feature of this current campaign being websites whose common theme is cars. Remember to mark your calendar for Super Cyber Friday this week. We are tackling an emerging topic this week, spending an hour talking about hacking the AI supply chain. Often when we talk about securing AI, we're looking at how to control data going into them. But as these become increasingly integrated across SaaS platforms, we need to understand the broader supply chain to manage the risk. It all starts at 1pm Eastern 10am Pacific. Head on over to our events page@csoseries.com to register. I'm Steve Prentice reporting for the CSO series.
- [07:08]
A
Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.