SonicWall’s widely quoted threat reports (The Year of Ransomware and Mid-Year Update to the 2021 Cyber Threat Report) are still attracting US and European journalists and editors. This week, SonicWall scored another big hit with a report from Wall Street Journal. In industry news, the previously mentioned article in Wall Street Journal reports on the possible extradition of a Russian entrepreneur to the US. Meanwhile, US Government cybersecurity initiatives lean hard on partnerships with corporations and academia, banking regulators push hard on banks to report breaches quickly, the US House approves an additional $500 million for cybersecurity funding, and insurance companies run away.

SonicWall in the News

US Accuses Russian of Money Laundering for Ryuk Ransomware Gang

Wall Street Journal (US): A Moscow entrepreneur was detained during a vacation abroad this month and is now facing extradition to the US on charges that he helped a notorious Russian ransomware group launder payments. Denis Dubnikov, a Russian citizen, was expelled from Mexico and placed on a plane to Amsterdam, where Dutch police arrested him on Nov. 2 on a US charge of conspiracy to commit money laundering, according to his lawyer Arkady Bukh. Dubnikov, 29 years old, is being sought to stand trial as part of a Federal Bureau of Investigation investigation of Ryuk, which was linked to one-third of all US ransomware attacks in 2020, according to cybersecurity firm SonicWall.

Cryptojacking – A Poison For Latin America’s Digital Economy

Intelligent CIO (Brazil): Arley Brogiato, Sales Director, SonicWall Latin America, explains the risk of cryptojacking in the region. Like a pest that silently gnaws at corporate IT, cryptojacking does unnoticed, unconfronted and unresolved damage. This expression comes from the word ‘crypto,’ from cryptocurrencies and ‘jacking,’ which refers to something used illegally.

Sonicwall: ‘Largest Platform Evolution In Company History’ Unifies Cloud, Virtual & Hardware Portfolio

Scoop Sci-Tec (Singapore): SonicWall today announced the latest additions of its Generation 7 cybersecurity evolution, the largest in the company’s 30-year history. Driven by this innovation, SonicWall unifies cloud, virtual and hardware offerings across a single and fully integrated cloud-powered platform.

Toronto Transit Commission Still Recovering from Ransomware Attack

IT World (Canada): IT staff at the Toronto Transit Commission (TTC) are still dealing with the effects of a ransomware attack that was detected just as the weekend started. In a report released Friday, SonicWall said that it had logged 495 million ransomware attempts so far this year to date. At that rate, it said, 2021 will be the most costly and dangerous year on record.

Ransomware: How to Mitigate Attacks

ARN-IDG (US): Ransomware is a form of malicious software that encrypts a user’s sensitive data when deployed on a device. The victim is asked to pay a ransom to the attacker, usually in Bitcoin, to secure a decryption key or initiate a decryption process. Posted by Jeff Marshall, Country Manager & Regional Director.

Mitiga Releases Cloud Incident Readiness and Response Solution for Ransomware Attacks

CISION (US): Ransomware attacks are on the rise worldwide, increasing in complexity as cyberattackers adapt to defensive strategies. Recent research by SonicWall shows that ransomware attacks reached 304.7 million in the first half of 2021, exceeding the 304.6 million attacks logged in all of 2020.

Be Cyber Smart and Lock It Down

ELE Times: According to the widely quoted Mid-Year Update for the 2021 SonicWall Cyber Threat Report, ransomware attacks rose to 304.6 million in 2020, up 62% over 2019. The increase occurred as more of the US workforce started working from home due to the pandemic. There were also 226.3 million ransomware attacks through May of this year, up 116% year to date over last year. Author: Debasish Mukherjee: Vice President, Regional Sales APAC at SonicWall.

Industry News

NSA Director: Evolving Cyber Threats Require Deeper Public-Private Partnerships

Nextgov: The government has long leaned on partnerships with companies and academia to advance technology, but according to one top cybersecurity leader, the complexities of the modern conflict landscape warrant cross-sector collaboration that goes deeper than any before. “I do think that there is a realization that we can’t do this alone,” Gen. Paul Nakasone said Tuesday night at an Intelligence and National Security Alliance-hosted dinner in Virginia. “So, this partnership has to exist—and it’s got to get even more powerful.”

Banks Ordered to Promptly Flag Cybersecurity Incidents Under New US Rule

Reuters: US banking regulators on Thursday finalized a rule that directs banks to report any significant cybersecurity incidents to the government within 36 hours of discovery. Separately, the banking industry said it had completed a massive cross-industry cyber security drill that aims to ensure Wall Street knows how to respond in the event of a ransomware attack that threatens to disrupt a range of financial services.

More Than $500M For Cybersecurity Included in Sweeping House-Passed Package

The Hill: The House approved more than $500 million in cybersecurity funding on Friday as part of its version of President Biden’s roughly $2 trillion Build Back Better package. The social and climate spending bill, passed by a narrow vote of 220-213, would primarily funnel those funds to the Cybersecurity and Infrastructure Security Agency (CISA) to help address issues including cybersecurity workforce training and state and local government cybersecurity.

Beware the Chinese Ransomware Attack with No Ransom

Bloomberg: A breach by Chinese hackers of almost a dozen targets in Taiwan looked, on the surface, like just another ransomware attack: infiltrate a network, encrypt a ton of files, lock the owners out of their systems, and wait to be paid. But this one was different for what it didn’t contain and portends a type of threat that could hinder attempts by corporate and government leaders to make their computer systems more secure. Companies like the semiconductor maker Powertech Technology Inc., communications provider Chunghwa Telecom Co., plastics conglomerate Formosa Petrochemical Corp. and state-run petroleum company CPC Corp. were among those hit in May 2020 by the Chinese Winnti group. Last year, seven members were indicted by the US for a series of attacks that allegedly affected more than 100 high-tech and online gaming companies globally.

North Korean Hacking Group Targets Diplomats, Forgoes Malware

Dark Reading: A North Korean cyber-operations group has increased its focus on cyber espionage and targeting diplomats and regional experts, using captured user credentials to fuel phishing attacks and only rarely using malware to persist in targeted organizations. A new report found that the North Korean group mainly targets individuals in the United States, Russia, and China, and usually attempts to quietly harvest credentials, siphon off information, and — like many attacks attributed to North Korea — turn compromises into financial gain.

Iran-Backed Hackers Exploited Microsoft, Pose Major Cyber Threat

Fox News: Law enforcement agencies in the U.S., Britain, and Australia have issued a joint statement labeling an Iran-sponsored group as a serious threat to cyber security. The Cybersecurity and Infrastructure Security Agency (CISA), FBI, Australian Cyber Security Center (ACSC), and British National Cyber Security Center (NCSC) released a joint cybersecurity advisory Wednesday that linked a group of hackers to the Iranian government.

Hackers Deploy Linux Malware, Web Skimmer on E-Commerce Servers

Bleeping Computer: Security researchers discovered that attackers are also deploying a Linux backdoor on compromised e-commerce servers after injecting a credit card skimmer into online shops’ websites. The PHP-coded web skimmer (a script designed to steal and exfiltrate customers’ payment and personal info) is added and camouflaged as JPG image files common folders. The attackers use this script to download and inject fake payment forms on checkout pages displayed to customers by the hacked online shop.

Businesses Worried About Cyberattacks During the Holidays

CBS News: After a year of headline-grabbing ransomware attacks, businesses say they’re worried about the possibility they’ll face cyber intrusions this holiday season, a time when many of their cybersecurity operations rely on skeleton staffing. A whopping 89% of the respondents from the US, U.K., France, Germany, Italy, Singapore, Spain, South Africa, and UAE indicated that they were concerned about a repeat cyber intrusion ahead of the holiday season. However, 36% said they had no “specific contingency plan in place to mount a response.”

Insurers Run from Ransomware Cover as Losses Mount

Reuters: Insurers have halved the amount of cyber cover they provide to customers after the pandemic, and shift toward work-at-home drove a surge in ransomware attacks that left them smarting from hefty payouts. Major European and US insurers and syndicates operating in the Lloyd’s of London market face increased demand. They have been able to charge higher premium rates to cover ransoms, repair hacked networks, business interruption losses, and even PR fees to mend reputational damage.

In Case You Missed It

• Frost & Sullivan Commend SonicWall for Security Excellence – Kayvon Sadeghi
• SonicWall Answers the Call with New NGFWs – Ajay Uggirala
• Illuminating Cybersecurity with Unified Insights – Suroop Chandran
• How Unified Cloud Simplifies Network Switch Management – Tiju Cherian
• Cyber Threat Alert: Ransomware Breaks Another Record – Ray Wyman
• Why Cybersecurity Must be First – Ray Wyman
• How to Protect Multi-Cloud Environments with a NSv Virtual Firewall – Tiju Cherian
• What’s driving job growth in cybersecurity? – Ray Wyman
• SonicWall Earns Its Third Perfect Score In A Row From ICSA Labs – Kayvon Sadeghi
• SonicWall Delivers Choice, Flexibility as Part of Cloud Evolution – Jayant Thakre
• Check Before You Click and Fight the Phish! – Ray Wyman
• The State of Cybersecurity Funding for State and Local Government – Ray Wyman
• CRN Recognizes Another Rising SonicWall Channel Star – Ray Wyman

SonicWall’s latest cybersecurity report titled The Year of Ransomware circulated through news outlets worldwide with the eye-catching headline: “148% surge in global ransomware attacks.” In industry news, the US offers a $10 million bounty on hacker groups responsible for the Colonial Pipeline attack. In contrast, nervous hackers apologize to Arab royal families for exposing private information and defend their “industry” after US investigators bring down REvil.

SonicWall in the News

Euro Police Swoop in on 12 Suspected Ransomware Gang Members

Infosecurity Magazine: Twelve threat actors were singled out by Europol last week in a significant ransomware operation targeting multiple organized crime groups. The unnamed suspects may have been involved in deploying LockerGoga, MegaCortex and Dharma malware. According to SonicWall data released last week, the number of ransomware attacks in the first three quarters of 2021 surged 148% year-on-year to reach 470 million.

SonicWall: ‘The Year of Ransomware’

Dark Reading: Citing SonicWall’s “The Year of Ransomware” report, there was a 148% surge in global ransomware attacks (495 million) year to date. The third-quarter surge makes 2021 the worst year SonicWall has ever recorded.

SonicWall VP Discusses SASE And Zero Trust

Security Brief Asia: Announcing Techday’s 10 Minute IT “jam” for an in-depth discussion on insights into technology in the Asia-Pacific region. The video featured SonicWall Vice President of Products, Jayant Thakre, discussing firewalls, network security, cloud security and more.

Ransomware Soars 148% to Record-Breaking Levels in 2021

InfoSecurity: The volume of ransomware attacks over the first three quarters of 2021 reached 470 million, a 148% increase on the same period last year, making 2021 already the worst year on record, according to SonicWall.

500 million Attempted Ransomware Attacks (So Far)

MSSP Alert: SonicWall expects to record 714 million attempted ransomware attacks by the close of 2021, according to the company’s latest cybersecurity report titled “The Year of Ransomware.”

Ransomware Attacks Increased 148% In Q3 2021, Showing No Sign of Slowing

Help Net Security: SonicWall recorded a 148% increase in global ransomware attacks through the third quarter (Q3) of 2021. With 470 million ransomware attacks logged by the company this year, 2021 will be the most costly and dangerous year on record.

The Terrifying Truth About Ransomware

Security Boulevard: Headlines are screaming with ransomware attacks and the ever-increasing payout demands. According to SonicWall, ransomware attacks have risen 158% in North America and 62% worldwide between 2019 and 2020.

Industry News

$10 Million Reward for Information on DarkSide Ransomware Group

The Hacker News: Responding to the Colonial Pipeline attack earlier this year, the US government on Thursday announced a $10 million reward for information that may lead to the identification or location of the leaders of the DarkSide ransomware group. The bounty includes any of the DarkSide rebrands. Additionally, the US State Department offers rewards of up to $5 million for intel and tip-offs that could result in the arrest and conviction in any country of individuals who are conspiring or attempting to participate in intrusions affiliated with the transnational organized crime syndicate.

Washington Sets Record for Data Breaches And Ransomware Attacks

Seattle Times: So far, in 2021, the citizens of the State of Washington have seen 6.3 million notices of data breaches. According to State Attorney General Bob Ferguson, this is a record for the state with 280 data breaches reported, blowing past the previous record of 78 and last year’s total of 60. The report says that the previous record for breach notices was set in 2018, with 3.5 million messages sent.

US Cyber Command Carries Out A ‘Surge’ To Address Ransomware Attacks

CNN: US Cyber Command head and director of the National Security Agency Gen. Paul Nakasone said Wednesday that the US had “conducted a surge” over the past three months to address the problem of ransomware attacks on US interests. Nakasone said the US government had aimed at funding sources for ransomware operatives, many of whom are based in Russia and Eastern Europe and who have made millions extorting US companies.

Nintendo Switch Hacker Gary Bowser Pleads Guilty, Will Pay $4.5 Million

ScreenRant: Gary Bowser, nicknamed the Nintendo Switch hacker by the news media, has pled guilty to charges and will pay $4.5 million. The case related to Bowser’s hacking of Nintendo’s portable console called “Switch.” In 2020 Nintendo began pursuing groups of hackers illegally breaking into Nintendo Switch consoles and selling kits through the internet. In May 2020, Nintendo filed lawsuits against the Switch hackers, leading to a legal battle that lasted nearly a year.

Ukraine Charges 5 Hackers Allegedly Working for Russia

NC Advertiser: Ukraine has filed espionage charges and attempted state overthrow against five people who allegedly were part of a hackers group controlled by Russia. The Security Service of Ukraine said Friday that the hackers’ group known as “Armageddon” was responsible for some 5,000 cyberattacks on Ukrainian state agencies since 2014.

Hackers Gained Access to Mysa Gov Accounts, Including License and Rego Details

ZD Net: This week, South Australia’s Department for Infrastructure and Transport confirmed that mySA Gov accounts were compromised through a cyber-attack. mySA Gov is the South Australian government’s online platform and app that provides residents with single account access for the state’s services, such as checking into a venue or completing transactions for vehicle registration.

Hackers Apologize to Arab Royal Families for Leaking Their Data

Vice: In October, the infamous ransomware gang known as Conti released thousands of files stolen from the UK jewelry store Graff. Among the data Conti leaked, sensitive information belonging to celebrities like David Beckham, Oprah Winfrey, and Donald Trump. And, according to The Daily Mail, there was also information belonging to the UAE, Qatar, and Saudi royal families. Now, the hackers would like the world to know that they regret their decision, perhaps partly because they released files belonging to very powerful people. The quote of the day comes from Allan Liska, a cybersecurity researcher: “Bluntly, UAE sends assassination teams to deal with people they don’t like. Even ransomware groups are subject to political pressure.”

Ransomware Hackers Nervous, Allege Harassment from the US

NBC News: After US agents down REvil, a major ransomware group, nervous hackers try a little rational argument to defend their practice of holding computers for ransom. Several ransomware gangs posted lengthy anti-U.S. screeds, viewed by NBC News, on the dark web. In them, they defended their practice of hacking organizations and holding their computers for ransom. They appear prompted by the news, reported Thursday by Reuters that the FBI had successfully hacked and taken down another major ransomware group called REvil.

While the REvil takedown was the first of its kind made public, nobody expects that this one act will curb ransomware attacks. However, the reaction from fellow hackers is also notable. The Conti Group — which recently begged forgiveness for a previous hack that exposed prominent Arab royalty while they regularly lock down hospital computers and hold them for ransom — wrote that it would be undeterred by the US action and that hackers are the actual victims.

In Case You Missed It

• How Unified Cloud Simplifies Network Switch Management – Tiju Cherian
• Cyber Threat Alert: Ransomware Breaks Another Record – Ray Wyman
• Why Cybersecurity Must be First – Ray Wyman
• How to Protect Multi-Cloud Environments with a NSv Virtual Firewall – Tiju Cherian
• What’s driving job growth in cybersecurity? – Ray Wyman
• SonicWall Earns Its Third Perfect Score In A Row From ICSA Labs – Kayvon Sadeghi
• SonicWall Delivers Choice, Flexibility as Part of Cloud Evolution – Jayant Thakre
• Check Before You Click and Fight the Phish! – Ray Wyman
• The State of Cybersecurity Funding for State and Local Government – Ray Wyman
• CRN Recognizes Another Rising SonicWall Channel Star – Ray Wyman
• What is Cryptomining and how can it affect Cybersecurity? – Ray Wyman
• Living in the Wild West of the IoT – SonicWall Staff
• IoT Devices: If You Connect It, Protect It – Amber Wolff

The news outlets are back to quoting the Mid-Year Update to the 2021 SonicWall Cyber Threat Report, with a big hit in Germany in Handelsblatt, a major news outlet. In industry news, analysts debate the significance of “killware,” hackers are stealing telecom records, hosting admins sentenced with RICO charges, Dark Web goes darker, Macs are still safer, and beware of YouTube trojans.

SonicWall in the News

The invisible war – how global hacker gangs threaten our security and prosperity

Handelsblatt (Germany): An outstanding article in one of Germany’s most important daily newspapers mentions SonicWall as an expert in cybersecurity and quotes the 2021 Cyber Threat Report Mid-Year Update. The authors cite several vital stats from the report to explain the rise of various threats that have weakened cybersecurity throughout the world. The article appeared online and in the print issue of the publication.

SonicWall’ Returns Choice’ To Customers by Securing Different Network Environments

Security Brief (Asia): SonicWall has declared that organizations should no longer change how they operate to secure their networks, devices and people, prompting the company to bring ‘customer choice’ back into its range of cybersecurity solutions.

Protect any network combination

LANline (Germany): This article picked up SonicWall’s media alert on protecting virtual, hybrid, cloud-based and local systems with SonicWall.

SonicWall Webinar: Can small companies and branches survive the crisis?

Infopoint Security (Germany): This article promotes a SonicWall webinar that shows how small businesses can best protect themselves during the “crisis” of increased cyberattacks.

Could your company recover from a ransomware attack?

BizJournals (U.S.): Citing SonicWall’s mid-year update on the 2021 Cyber Threat Report, the author notes the sharp rise in ransomware attacks in North America as a reason for companies to create contingency plans.

How to Create a Relevant Cybersecurity Strategy

Accounting Web (U.S.): Using SonicWall’s Mid-Year Update on the 2021 Cyber Threat Report, the author illustrates the sharp rise in cybersecurity attacks. The article is mostly about how CPAs and other accounting professionals play a crucial role in protecting financial data. However, the author also provides an overview of the most common cyberattacks, such as malware and phishing, and offers tips on making sure your organization has the proper protections in place.

‘Clumsy’ BlackByte Malware Reuses Crypto Keys, Worms into Networks

Dark Reading (U.S.): A unique malware named “BlackByte” was discovered during a recent incident response engagement. The malware reportedly avoids Russian computers and uses a single symmetric key for encrypting every compromised system. Additionally, the report cites SonicWall’s “Cyber Threat Report: Mid-Year Update” and notes that the number of ransomware attacks in the first half of the year rose 150% to almost 305 million.

The Ransom Disclosure Act Proposed — Gives 48 Hours to Report Ransom Payments

LinkedIn Pulse: Citing Ransom Disclosure Act legislation proposed in the U.S. Senate, the author offers “hard-numbers perspective” of data from the Mid-Year Update on the 2021 SonicWall Cyber Threat Report, ransomware attacks surged a staggering 304.7 million attempted ransomware attacks within SonicWall Capture Labs’ Capture Threat Network, which monitors and collects information from global devices.

Industry News

DHS Secretary: “Killware” Malware Designed to Do Real-World Harm

CPO Magazine: This article opens with comments made by U.S. Department of Homeland Security Alejandro Mayorkas where he asserts that “killware is poised to be world’s next breakout cybersecurity threat.” The reference is on recent attacks on water treatment plants and hospitals where hackers could – in theory – trigger events that may harm or kill people. Mayorkas’ claim appears to be backed up by research from Gartner that projects that threat actors will be weaponizing operational environments to harm and kill people within the next four years. While the danger is real, other analysts believe that the “hype is bigger than the threat, for now.” While the attacks on SolarWinds and the Colonial Pipeline are very worrisome, and the recent attempted attack on a water treatment plant in Florida is alarming to the extreme, they are not necessarily harbingers of imminent danger. Since nearly all cybercrime is motivated by profit, we need to define… “exactly when a given cyberattack moves from being a purely criminal matter to a national security threat,” said one analyst. “If cyberattacks, especially those perpetrated across international boundaries, regularly cause bodily harm or loss of life, they will receive treatment as a threat to national security.”

Cybercrime Group Hacking Telecoms to Steal Phone Records

Gizmodo: A new report shows that a particular hacker group, believed to be based in China, has been targeting telecommunication companies all over the world. The report, which goes into a significant amount of detail, shows that the hackers behind the campaign have managed to infiltrate 13 different global telecoms in the span of just two years. Reuters reports that this has included exfiltrating “calling records and text messages” directly from carriers.

Hosting Administrators Sentenced for Helping Cybercrime Gangs

Bleeping Computer: Two Eastern European men were sentenced to prison on Racketeer Influenced Corrupt Organization (RICO) charges for bulletproof hosting services used by multiple cybercrime operations to target U.S. organizations. They provided cybercrime-affiliated clients with the infrastructure needed to host exploit kits and run malicious campaigns distributing spam emails and malware for roughly seven years, between 2008 and 2015.

The Dark Web Goes Darker and Busier

TechSpot News: Cybercrime services cost less than $500, and stolen data now spreads 11 times faster than it did six years ago, according to a recent study by BitGlass. Why this matters: The dark web is not only alive and kicking, and it’s growing more dangerous than ever.

Cybersecurity Offers Jobs, High Wages — If Enough People Can Be Trained

Argus Leader: As people consider careers or new options in work, high-paying jobs in traditional fields like health may come to mind, but one industry is prospering from protecting the data of others. Cybersecurity, the protection of computer systems and networks, is emerging as a promising industry with more than enough jobs. The issue? There aren’t enough faculty to train people to fill that work.

Macs Still Targeted Mostly with Adware, Less with Malware

Dark Reading: For people who rely on Macs, the news is a little better. An ongoing study of vulnerabilities, the top 10 categories of digital threats on macOS are all adware programs, with only a sliver of the share of victims affected by actual malware. Apple Macs are not immune to malicious attacks. Still, outside of some significant nation-state efforts, new research shows that bad actors continue to use adware as the method of choice to make money from infecting the macOS operating system.

Massive Campaign Uses YouTube to Push Password-Stealing Malware

Tech Times: Widespread malware campaigns are creating YouTube videos to distribute password-stealing trojans to unsuspecting viewers. Initially reported by Bleeping Computer, video descriptions may contain links that lead to password-stealing trojan malware. These infections quietly run on a computer while stealing passwords, screenshots of active windows, cookies, credit cards stored in browsers, FTP credentials, and arbitrary files decided by the threat actors. When installed, the malware will communicate with a Command & Control server, where it waits for commands to execute by the attacker, which could entail the running of additional malware. According to this report, the best way to avoid the attack is not to click links in the video description.

In Case You Missed It

• How to Protect Multi-Cloud Environments with a NSv Virtual Firewall – Tiju Cherian
• What’s driving job growth in cybersecurity? – Ray Wyman
• SonicWall Earns Its Third Perfect Score In A Row From ICSA Labs – Kayvon Sadeghi
• SonicWall Delivers Choice, Flexibility as Part of Cloud Evolution – Jayant Thakre
• Check Before You Click and Fight the Phish! – Ray Wyman
• The State of Cybersecurity Funding for State and Local Government – Ray Wyman
• CRN Recognizes Another Rising SonicWall Channel Star – Ray Wyman
• What is Cryptomining and how can it affect Cybersecurity? – Ray Wyman
• Living in the Wild West of the IoT – SonicWall Staff
• IoT Devices: If You Connect It, Protect It – Amber Wolff
• The Halfway Point: How Cybercrime Has Impacted Government in 2021 – Amber Wolff
• Elevating SonicWall to the Cloud – Jayant Thakre
• How Cybercrime Impacted Education in 2021 – Amber Wolff

It been a big news week as conversations about the Mid-Year Update to the 2021 SonicWall Cyber Threat Report, the Boundless Cybersecurity Model, and the 30th Anniversary filled up pages. SonicWall got a big boost from a story about a new ransom disclosure bill when the co-sponsoring senators (Warren and Ross) mentioned data from the Threat Report in their press releases. In industry news, MIT designs a cybersecurity fire drill, “urgently needed rules” fail to impress and Facebook is crystal clear: outage was not a hack.

SonicWall in the News

New Bill Would Require Ransom Disclosure Within 48 Hours

U.S. Senators Warren and Ross have introduced legislation requiring ransomware victims to report payments within 48 hours of the transaction. Warren and Ross cited figures from SonicWall’s Mid-Year Update to the 2021 SonicWall Cyber Threat Report noting that ransomware attacks rose 62% worldwide between 2019 and 2020 and 158% in North America.

Warren Drafts’ Ransom Disclosure Act’ as Ransomware Attacks Increase

Be In Crypto (USA): The legislation proposes that victims of ransomware attacks in the U.S. file an incident report within 48 hours of payment. The bill’s co-sponsors used data from the Mid-Year Update to the SonicWall 2021 Cyber Threat Report.

In The Face of More Lethal Attacks, A New Cyberdefense.

BYTE (Spain): The article notes that 2021 has already been a record year for cybercrime, and there is still a quarter to go. The article describes the cybercrime landscape by citing data from SonicWall’s Mid-Year Update to the 2021 SonicWall Cyber Threat Report.

Egnyte Expands Ransomware Protection and Adds Ransomware Recovery

ChannelProNetwork (Blog): Citing 304.7 million ransomware attacks in the first half of 2021 as reported by the Mid-Year Update to the 2021 SonicWall Cyber Threat Report. The author describes methods for recovery from ransomware attacks.

SonicWall Is Geared Up with the Boundless Cybersecurity Model to Address the New Business Normal

VARIndia (India): The article includes commentary from SonicWall’s Debasish Mukherjee, VP Regional Sales, APAC, about SonicWall’s role in helping companies and organizations transition. Debasish comments that the current era of the ‘anytime, anywhere business’ is forever changing the shape of the I.T. and business landscape.

5 Key Cybersecurity Trends to Know, for 2021

The Clinton Courier: The author describes significant trends for cybersecurity this year based on Mid-Year Update to the 2021 SonicWall Cyber Threat Report.

Celebrating 30 years, SONICWALL, the leader in CYBERSECURITY

TechFeedThai (Thailand): SonicWall Solution Provider Cybersecurity for SMBs and Large Enterprises Celebrates 30 years since its inception in August 1991. The story also announces an offer by a regional SonicWall product distributor to perform threat assessments for local businesses.

Why Email is Your Biggest Cybersecurity Threat

ACE IT (blog): According to SonicWall, email remains a primary way people share information, with over 320 emails sent per day. In addition, the blog notes that through the massive shift to work-from-home, email became “the most extensive channel for all forms of phishing and ransomware attacks.”

MSPs: Ransomware Is Your Wake-Up Call to Deliver Non-Negotiable and Comprehensive Security

MSP Insights: Noting that ransomware attacks are only becoming more prevalent, more dangerous, and more costly, the report cites ransomware attacks increased 158% in North America last year, from the Mid-Year Update to the 2021 SonicWall Cyber Threat Report.

Cybersecurity Report: Record 304.7 million Ransomware Attacks

vTechio Blog: Quoting SonicWall’s Mid-Year Update to the 2021 SonicWall Cyber Threat Report: the number of attacks eclipses 2020 global totals in just six months. With this data, the writers explain, it’s clear that cybercrime has reached a new and unsettling paradigm.

Cybersecurity – Attack and Defense Strategies

Packt: Promoting the Second Edition of a book, the publisher notes “32.7 million IoT attacks” from the Mid-Year Update to the 2021 SonicWall Cyber Threat Report as an example of the current threat landscape. They also note that malware leveraged during an IoT-related attack infects routers and can facilitate data theft.

Industry News

What Happened to Facebook, Instagram, & WhatsApp?

Krebbs on Security: Earlier this week, Facebook (with Instagram, WhatsApp) suffered a massive outage that lasted almost seven hours. While many news organizations speculated that attackers hacked Facebook, Krebbs Report suggested “something inside Facebook” triggered a company-wide revocation of vital digital records that point computers and other devices to Facebook’s assigned resources. Reportedly, during the early part of the outage, employees on-premises could not use passcodes and electronic I.D. badges. Krebbs also speculated that the company’s Border Gateway Protocol (BGP) was affected. The BGP is a chunk of code that Internet Service Providers worldwide share for routing traffic through the complex array of Internet Protocol addresses. On Wednesday, details about the outage appeared to confirm reporting from Krebbs. Also, in the face of rising concerns about cybersecurity, Facebook is crystal clear that the hours-long outage had nothing to do with hackers.

Cyberattack Fire Drills: Is Your Company Prepared?

Harvard Business Review: Preparing for the unexpected is much easier said than done. In the case of cyberattacks, many companies have vulnerabilities that they don’t know about. Many organizations can benefit from instituting fire drills and exercises that test a company’s response plan for a cybersecurity catastrophe. Drills can reveal gaps in security, response plans, and employees’ familiarity with their roles. Research for this article was supported by the Cybersecurity at MIT Sloan consortium and Boston Consulting Group.

Cybersecurity Budgets for Industrial Control Systems and Operational Tech Increasing

ZDNet: Nozomi Networks and the SANS Institute released a survey that revealed companies had invested more in cybersecurity to protect industrial control systems (ICS). Of 480 responses, 47% reported that their cybersecurity budgets increased over the past two years, 32% said there had been no change, and 15% said they had at least one cybersecurity event in the last 12 months. 

Senators Introduce Bill to Strengthen Federal Cybersecurity After Attacks

The Hill: A bipartisan bill was introduced in the U.S. Senate last Monday stipulating overhaul and improvement for federal cybersecurity policy. The legislation aims at the Federal Information Security Modernization Act, signed into law in 2014, and clarifies reporting requirements for federal agencies if hackers successfully target them.

New’ Urgently Needed’ Cybersecurity Rules for Pipelines Draw Mixed Reviews

Last July, the U.S. Transportation Security Administration issued “urgently needed” emergency rules to strengthen the cybersecurity of the nation’s most essential energy pipelines. The effort followed the Colonial Pipeline shut down earlier this year sparked massive fuel shortages and gasoline panic-buying. The regulations recognize that voluntary compliance is not working. However, according to industry officials and some analysts, TSA administrators wrote the new rules in such a way that implementing them could hamper pipeline reliability.

Why Today’s Cybersecurity Threats Are More Dangerous

With greater complexity and interdependence among networked digital systems, attackers have even more opportunities to conduct widespread damage. The report identifies unsecured Internet of Things (IoT) devices as the “big hairy monster under the bed” while noting that, in many cases, the barriers to cybercrime are low.

In Case You Missed It

• The State of Cybersecurity Funding for State and Local Government – Ray Wyman
• CRN Recognizes Another Rising SonicWall Channel Star – Ray Wyman
• What is Cryptomining and how can it affect Cybersecurity? – Ray Wyman
• Living in the Wild West of the IoT – SonicWall Staff
• IoT Devices: If You Connect It, Protect It – Amber Wolff
• The Halfway Point: How Cybercrime Has Impacted Government in 2021 – Amber Wolff
• Elevating SonicWall to the Cloud – Jayant Thakre
• How Cybercrime Impacted Education in 2021 – Amber Wolff
• From Sonic Systems to SonicWall: 30 Years of Cybersecurity Evolution – Amber Wolff
• The Top 12 Cybersecurity Books – Recommendations from SonicWall Leadership and Employees – Ray Wyman
• SonicWall Earns Another Perfect Score from ICSA Labs for Q2 — Amber Wolff
• SonicWall President and CEO Bill Conner Recognized on CRN’s 2021 Top 100 Executives List — SonicWall Staff

SonicWall is in the news in Europe this week, with announcements about a support center in Romania and SonicWall’s country manager, Sergio Martinez, participating in regional discussions about cybersecurity. The FBI reportedly held onto a vital encryption key for three weeks before handing it to victims tops our industry news list. Plus, recent research reveals that multi-party breaches cause 26-times more damage than single-party breaches, SUEX is sanctioned, Biden and hackers debate “critical,” seven countries are being spoofed, and TinyTurla weighs in for big damage. 

SonicWall in the News

SonicWall to open customer support centre in Romania

• Telecompaper (NL): US cyber-security specialist SonicWall is in the process of opening a technical support centre in Romania, writes local paper Ziarul Financiar citing SonicWall sales director for Southeast Europe, Cosmin Vilcu. According to the news outlet, the operation has already recruited staff and begun regional marketing activities.

European recovery funds: a good way to improve corporate cybersecurity

• Dealer World (Spain): Sergio Martínez, our country manager, participated in a special issue about the European recovery funds: “The rain comes, the European rain in the form of millions. Millions that will allow many companies to improve deficit aspects to be more competitive. Will cybersecurity be one of them?

SonicWall continues to expand its offering to combat cyberattacks

• Director TIC.es (Spain): In an interview with Sergio Martínez, SonicWall’s country manager, the publication discusses the layered security promoted by SonicWall based on a comprehensive portfolio of solutions. Martinez explains the latest developments in SonicWall’s offer, including its new generation of firewalls and solutions for secure access and protecting credentials.

IBM Launches New Lto-9 Tape Drives with More Density, Performance And Resiliency

• TiBahia (Portugal): IBM is launching tape drives that give systems more resilience to cyberattack. Additionally, the company has repeatedly cited the Mid-Year Update to the 2021 SonicWall Cyber Threat Report as an example of the marketplace’s need for such products. In this release, they cite the Threat Report, noting ransomware is one of the costlier types of breaches, with an average cost of $4.62M per breach and one of the most common.

Industry News

FBI Held Back Ransomware Decryption Key from Businesses to Run Operation Targeting Hackers

• Washington Post: After a devastating ransomware attack this summer, the FBI’s investigations uncovered the digital key needed to unlock maliciously encrypted computer systems. However, the FBI held onto the digital key for almost three weeks, knowing that the attack hobbled the computers of hundreds of businesses and institutions. According to the report, investigators discovered the digital key through access to servers operated by the Russia-based cybercrime gang behind the attack. Deploying the digital key immediately could have helped the victims, including schools and hospitals, avoid what analysts estimate was millions of dollars in recovery costs.

Multi-party breaches cause 26-times the financial damage of the worst single-party breach

• ZDNet: The researchers found that when a ripple event triggers a loss of income, it can lead to losses of $36 million per event. RiskRecon, a Mastercard company, and the Cyentia Institute released a study on Tuesday showing that some multi-party data breaches cause 26-times the financial damage of the worst single-party breach. The researchers used Advisen Cyber Loss Database to investigate cybersecurity incidents since 2008. They report that nearly 900 multi-party breach incidents have been recorded in the database, with 147 newly uncovered “ripple incidents” across the entire data set, with 108 occurring within the last three years.

US Sanctions Crypto Exchange Accused of Catering to Ransomware Criminals

• Wall Street Journal: The Biden administration blacklisted a Russian-owned cryptocurrency exchange – SUEX OTC – for allegedly helping launder ransomware payments. This is a genuinely unprecedented action meant to deter future cyber-extortion attacks by disrupting their primary means of profit. By targeting a digital currency platform, the Treasury Department is also renewing its warning to the private sector that businesses risk high penalties and fines for paying ransoms and – more importantly – that the Department is watching.

Biden Cybersecurity Leaders Back Incident Reporting Legislation As ‘Absolutely Critical’

• Senior Biden administration officials are backing congressional efforts to enact new cyber incident reporting requirements for critical infrastructure operators and other companies, as well as other measures to entrench further the Cybersecurity and Infrastructure Security Agency (CISA) at the center of the civilian executive branch’s digital security apparatus. CISA Director Jen Easterly said that incident reporting is “absolutely critical” and called CISA’s “superpower” its ability to share cyberthreat information across agencies and critical infrastructure sectors.

After Biden Warning, Hackers Define ‘Critical’ as They See Fit

• Bloomberg: After a furious run of ransomware attacks in the first half of the year, President Joe Biden in July warned his Russian counterpart, Vladimir Putin, that Russia-based hacking groups should steer clear of 16 critical sectors of the US economy. But if a recent attack on a grain cooperative in Iowa is any indication, apparently hackers will define what should be considered “critical.”

Alaskan health department still struggling to recover after ‘nation-state sponsored’ cyberattack

• CNN: Alaska is still dealing with the fallout of a hack. Many of their systems are offline after foreign government-backed hackers breached the department in May, a spokesperson told CNN on Monday. As the department continued to warn Alaskans that hackers might have stolen their personal data, the department’s spokesperson declined to comment on which foreign government was behind the intrusions or their motives. However, Alaskan officials now say that hackers exploited a vulnerability in the health department’s website to access department data. The hackers may have accessed Alaskans’ Social Security numbers and health and financial information.

Republican Governors Association email server breached by state hackers

•  Bleeping Computer: The Republican Governors Association (RGA) revealed in data breach notification letters sent last week that its servers were breached during an extensive Microsoft Exchange hacking campaign that hit organizations worldwide in March 2021. This attack follows a breach on Synnex back in July, a network management contractor for the Republican National Committee (RNC).

BlackMatter Ransomware Has Infected Marketron’s Marketing Services

• Cyber Intel: The BlackMatter ransomware group targeted Marketron, a cloud-based revenue and traffic management tools supplier. The company has a customer base of over 6,000 and reportedly manages about $5 billion in advertising revenue per year. This was the second ransomware attack by BlackMatter in so many days. Another one involved a ransom of $5.9 million when this group attacked the NEW Cooperative United States Farmers organization.

Epik data breach impacts 15 million users, including non-customers

• Ars Technica: Epik has now confirmed that an “unauthorized intrusion” did, in fact, occur into its systems. The announcement follows last week’s incident of hacktivist collective Anonymous leaking 180 GB of data stolen from online service provider Epik. To mock the company’s initial response to the data breach claims, Anonymous had altered Epik’s official knowledge base, as reported by Ars.

TinyTurla: New Malware by Russian Turla

• Cyware: According to Cisco Talos, TinyTurla is a previously unknown malware backdoor from the Turla APT group, in use since at least 2020. The malware got the attention of researchers when it targeted Afghanistan before the Taliban’s recent takeover of the government. Now, it is suspected in recent attacks against the U.S., Germany, and other countries.

Ongoing Phishing Campaign Targets APAC, EMEA Governments

•  Security Week: Government departments in at least seven countries in the Asia-Pacific (APAC) and Europe, the Middle East and Africa (EMEA) regions have been targeted in a phishing campaign that has been ongoing since spring 2020. The attacks appear to be focused on credential harvesting. During the first half of 2020, operators transferred the phishing domains used as part of the campaign to their current host. In addition, investigators have found at least 15 active “spoofing” pages, posing as various ministries within the targeted country’s governments, including energy, finance, and foreign affairs departments. The spoofed pages target Belarus, Georgia, Kyrgyzstan, Pakistan, Turkmenistan, Ukraine, and Uzbekistan. Other pages posed as the Pakistan Navy, the Main Intelligence Directorate of Ukraine, and the Mail.ru email service.

In Case You Missed It

• Living in the Wild West of the IoT – SonicWall Staff
• IoT Devices: If You Connect It, Protect It – Amber Wolff
• The Halfway Point: How Cybercrime Has Impacted Government in 2021 – Amber Wolff
• Elevating SonicWall to the Cloud – Jayant Thakre
• How Cybercrime Impacted Education in 2021 – Amber Wolff
• From Sonic Systems to SonicWall: 30 Years of Cybersecurity Evolution – Amber Wolff
• The Top 12 Cybersecurity Books – Recommendations from SonicWall Leadership and Employees – Ray Wyman
• SonicWall Earns Another Perfect Score from ICSA Labs for Q2 — Amber Wolff
• SonicWall President and CEO Bill Conner Recognized on CRN’s 2021 Top 100 Executives List — SonicWall Staff
• Latest Cyber Threat Intelligence Shows Ransomware Skyrocketing – Amber Wolff
• SonicWall Fortifies Cloud Edge Secure Access with Device Compliance Check and Network Traffic Control – SonicWall Staff
• New SonicWall NSsp 13700 Firewall: Security for Large Enterprises – Ajay Uggirala