Content by Doug Olenick

Nation-State Actor Linked to Pulse Secure Attacks

Doug Olenick  •  April 20, 2021

The U.S. Cybersecurity and Infrastructure Security Agency, Ivanti and FireEye report that federal agencies and other entities have been compromised by two attack groups, with one possibly acting on behalf of the Chinese government. The groups are exploiting vulnerabilities in Ivanti's Pulse Connect Secure.

Microsoft Patches 4 Additional Exchange Flaws

Doug Olenick  •  April 13, 2021

Microsoft issued patches for its on-premises Exchange Server software, addressing four new critical vulnerabilities discovered by the National Security Agency. A zero-day vulnerability in Desktop Window Manager was also disclosed and patched.

Cofense and StrikeForce Announce Acquisitions

Doug Olenick  •  April 10, 2021

Email security provider Cofense and data security firm StrikeForce Technologies both have announced acquisitions. Meanwhile, data protection firm OneTrust received additional funding.

Visa Describes New Skimming Attack Tactics

Doug Olenick  •  April 9, 2021

Visa's Payment Fraud Disruption team reports that cybercriminals are increasingly using web shells to establish command and control over a retailers' servers during payment card skimming attacks.

600,000 Payment Cards Stolen From Swarmshop Darknet Market

Doug Olenick  •  April 8, 2021

For the second time in two years, the contents of the darknet payment card marketplace Swarmshop have been removed and posted to a competing underground forum, Group-IB reports. The content includes data on more than 600,000 payment cards as well as administrator, seller and buyer information.

Attackers Using Malicious Doc Builder Called 'EtterSilent'

Doug Olenick  •  April 8, 2021

Researchers at the security firm Intel 471 report cybercriminal gangs are using a newly uncovered malicious document builder called "EtterSilent" to create differentiated, hard-to-discover, malicious documents that can be deployed in phishing attacks.

533 Million Facebook Account Records Posted to Forum

Doug Olenick  •  April 4, 2021

A security researcher found more than 500 million Facebook records being offered for free on the darknet, exposing basic user information, including any phone numbers associated with the accounts. Facebook says this is “old data” previously reported as exposed.

Ubiquiti Acknowledges Extortion Attempt

Doug Olenick  •  April 2, 2021

IoT device manufacturer Ubiquiti revealed in a security notice that an attacker had attempted to extort money from the company following a December 2020 cyber incident - a fact not mentioned in the company's earlier notice about the attack.

IoT Vendor Sierra Wireless Reports Ransomware Attack

Doug Olenick  •  March 23, 2021

Canadian IoT device manufacturer Sierra Wireless reported Tuesday it had suffered a ransomware attack over the weekend, forcing it to halt production. The attack has disrupted its website and some internal operations.

Florida Teen Pleads Guilty in 2020 Twitter Hack

Doug Olenick  •  March 17, 2021

The Florida teen whom prosecutors call the mastermind behind last year's hack of 130 high-profile Twitter accounts to wage a cryptocurrency scam pleaded guilty Tuesday and was sentenced to serve three years in a juvenile facility.

Federal Privacy Bill Reintroduced in Congress

Doug Olenick  •  March 15, 2021

U.S. Rep. Suzan DelBene, D-Wash, has reintroduced a bill that would create a national-wide data privacy standard that in its latest incarnation makes an attempt to placate Republicans. The bill, if passed, would replace a patchwork of current state laws.

Supermicro and PulseSecure Issue Advisories on Trickboot

Doug Olenick  •  March 6, 2021

Supermicro and Pulse Secure have each issued advisories warning users that some of their products are vulnerable to an updated version of Trickbot malware that features a bootkit module, nicknamed Trickboot, which can search for UEFI/BIOS firmware vulnerabilities.

Lazarus Hits Defense Firms With ThreatNeedle Malware

Doug Olenick  •  February 25, 2021

Lazarus, the North Korean-backed advanced persistent threat group, has been conducting a campaign striking defense industry targets in more than a dozen countries using a backdoor called ThreatNeedle that moves laterally through networks and can overcome network segmentation, according to researchers at Kaspersky.

Federal Reserve's Money Transfer Services Suffer Outage

Doug Olenick  •  February 24, 2021

The Federal Reserve's online money transfer system, including Fedwire Funds and FedCash, suffered an outage for more than three hours Wednesday afternoon, with the Fed citing technical issues as the cause and not a cyber incident. Systems were restored by late afternoon.

Senators Grill Cybersecurity Execs on SolarWinds Attack

Doug Olenick  •  February 23, 2021

The CEOs of SolarWinds, Microsoft, FireEye and CrowdStrike rolled out a series of cybersecurity recommendations to a U.S. Senate panel Tuesday while detailing how foreign actors gained access into their firms' systems as a result of the SolarWinds supply chain attack.