This week, the U.S. government brought up cybersecurity legislation, while the U.S. judicial system handed down cybercriminal incarceration.

SonicWall Spotlight

Hackers used ransomware to take over parts of UC San Francisco’s network and extorted $1.14million in exchange for returning access to their files — Daily Mail

• UC San Francisco hasn’t said what files were affected nor how the ransomware entered the system, but the FBI has opened an investigation into the incident.

Sonicwall Lands In Ireland, Expands Channel Partner Strategy — SonicWall Press Release

• SonicWall today announced that it has appointed Tristan Bateup as country manager for Ireland.

UCSF pays $1 million ransom to recover medical school data from hackers — The Mercury News

• The UCSF School of Medicine was the third targeted by cyberattacks in the past two months, but a spokesperson said the attack did not affect patient care or ongoing COVID-19 research.

Cybersecurity News

Russian Criminal Group Finds New Target: Americans Working at Home — The New York Times

• A hacking group calling itself Evil Corp., indicted in December, has shown up in corporate networks with sophisticated ransomware. American officials worry election infrastructure could be next.

How COVID-19 changed Cyber Command’s ‘Cyber Flag’ exercise — Cyberscoop

• This year, U.S. Cyber Command convened with allied countries for what appeared to be a straightforward simulation of an attack against a European airbase — but then a global pandemic changed all the rules.

Russian cybercriminal gets 9 years for online fraud website — The Washington Times

• A Russian computer hacker who facilitated $20 million in credit card fraud and ran a sophisticated clearinghouse for international cybercriminals was sentenced Friday to nine years in prison.

Lawmakers introduce legislation to establish national cybersecurity director — The Hill

• A bipartisan group of lawmakers has introduced legislation in the House that would establish a national cybersecurity director to lead government efforts on cybersecurity.

DDoS botnet coder gets 13 months in prison — ZDNet

• Kenneth Schuchman, known as Nexus Zeta, created multiple DDoS botnets, including Satori, Okiru, Masuta, and Fbot/Tsunami.

An embattled group of leakers picks up the WikiLeaks mantle — Ars Technica

• DDoSecrets was banned from Twitter after releasing what they claim is the largest-ever cache of hacked U.S. police data, a leak some say positions the group as the heir apparent of WikiLeaks’ early, idealistic mission.

Senators move to boost state and local cybersecurity as part of annual defense bill — The Hill

• A group of Senate Democrats on Monday introduced as part of the annual National Defense Authorization Act (NDAA) a measure that would strengthen cybersecurity protections for states vulnerable to malicious cyberattacks.

U.S. FCC issues final orders declaring Huawei, ZTE national security threats — Reuters

• The FCC has formally designated China’s Huawei Technologies Co and ZTE Corp as posing threats to national security, barring U.S. firms from tapping an $8.3 billion government fund to purchase equipment from the companies.

Schools Already Struggled With Cybersecurity. Then Came Covid-19 — Wired

• A lack of dedicated funding and resources made it hard to keep data secure — and that was before classes moved almost entirely online.

Things that happen every four years: Olympic Games, presidential elections, and now new Mac ransomware — The Register

• Known as EvilQuest, the brand-new strain of Mac ransomware was spotted spreading via Russian piracy and torrent sites.

DDoS Attacks Jump 542% from Q4 2019 to Q1 2020 — Dark Reading

• The shift to remote work and heavy reliance on online services has driven an increase in attacks intended to overwhelm ISPs.

Tax software used by Chinese bank clients installs GoldenSpy backdoor — SC Magazine

• A tax software program installed by business clients of an unidentified Chinese bank was trojanized with malware that installs a backdoor granting attackers system-level privileges, researchers warn.

In Case You Missed It

• ‘3 & Free’ Promotion: The Easiest Way to Upgrade Your SonicWall Firewall for Free — Robert (Bob) VanKirk
• SonicWall EMEA 2020 Virtual Partner Events — Terry Greer-King
• COVID-19 Ushers in a New Era of Cybersecurity for Higher Ed — Bill Conner
• A Brief History of COVID-19 Related Attacks, Pt. 1 — Dmitriy Ayrapetov
• SonicWall’s Online Community Connects Cybersecurity Professionals — Micah Vorst

This week, SonicWall’s new Switches and Secure SD-Branch made waves, hackers made a stronger Qbot, and attacks on AWS made history.

SonicWall Spotlight

ChannelPro 5 Minute Roundup — ChannelPro Network

• Erick and Rich of ChannelPro explore the far-reaching implications of SonicWall’s new branch office networking solution, which they say arrived at a great time for businesses.

SonicWall Launches New Network Switches — Enterprise Times

• SonicWall has announced a range of new products, including new multi-gigabit switches and an SD-Branch solution.

SonicWall Advances Network Edge Security, Adds Multi-gigabit Switch Series and New SD-Branch Capabilities — TMCnet

• TMCnet highlights SonicWall’s momentum over the past quarter, including the release of new and enhanced MSSP offerings and the launch of its SD-Branch capabilities.

SonicWall takes threat protection to the branch level — MicroScope

• This article covers the  latest SD-Branch offering as a major shift and a milestone in its corporate history, with it set to have a major impact on the security player’s channel.

Cybersecurity News

Researchers Expose a New Vulnerability in Intel’s CPUs — Wired

• Modern CPUs — particularly those made by Intel — have been under siege in recent years by an unending series of attacks. Now, two separate academic teams disclosed two new and distinctive exploits that pierce Intel’s Software Guard eXtension, by far the most sensitive region of the company’s processors.

Google Sees Increase in COVID-19 Phishing in Brazil, India, UK — Security Week

• Cyberthreats taking advantage of the COVID-19 pandemic are evolving, and Google is seeing an increase in related phishing attempts in some countries.

Attackers impersonate secure messaging site to steal bitcoins — Bleeping Computer

• In what can be described as the case of both cybersquatting and phishing, threat actors have created a site that imitates the legitimate secure note sharing service privnote.com to steal bitcoins.

Coder-Turned-Kingpin Paul Le Roux Gets His Comeuppance — Wired

• Paul Le Roux, 47 — who faced up to a life sentence after pleading guilty to crimes ranging from methamphetamine trafficking to selling weapons technology to Iran — has been sentenced to 25 years in federal prison.

Targeting U.S. banks, Qbot trojan evolves with new evasion techniques — SC Magazine 

• By malware standards, the banking trojan Qbot is long in the tooth, but it still has some bite, according to researchers who say it has added some detection and research evasion techniques to its arsenal.

Hackers Trigger Far-Reaching Disruption by Targeting Low-Profile Firm — The Wall Street Journal

• Small and midsize companies are fighting a rising tide of cyberattacks largely out of public view, posing an underappreciated risk for the bigger companies and institutions that use their services.

Google Alerts catches fake data breach notes pushing malware — Bleeping Computer

• Fraudsters have begun pushing fake data breach notifications using big company names to distribute malware and scams. They’re mixing black SEO, Google Sites, and spam pages to direct users to dangerous locations.

Exclusive: Massive spying on users of Google’s Chrome shows new security weakness — Bloomberg

• A newly discovered spyware effort attacked users through 32 million downloads of extensions to Google’s Chrome web browser, highlighting the tech industry’s failure to protect browsers despite their increasing use for email, payroll and other sensitive functions.

AWS said it mitigated a 2.3 Tbps DDoS attack, the largest ever — ZDNet

• The previous record for the largest DDoS attack ever recorded was of 1.7 Tbps, recorded in March 2018.

In Case You Missed It

• Beat the Managed Services Blues with SonicWall and ConnectWise — Suroop Chandran
• SonicWall’s New SD-Branch Solution, Multi-gigabit Switch Line Secure Dispersed Businesses, Branch Locations — Jayant Thakre
• SonicWall Reinvents Branch Connectivity with Secure SD-Branch and Switches — Srudi Dineshan
• A Message from our CEO: Listening, Learning and Standing Together — SonicWall Staff
• Custom Build your Security Strategy with the SonicWall Boundless Cybersecurity Bundle — Amber Wolff

This week, cybercriminals took a more hands-on approach, a new breed of ransomware bided its time, and computers got too hot to handle.

SonicWall Spotlight

Test Platform Leaks Bank Of America Clients’ Covid-19 PPP Loan Applications — SC Magazine

• Bank of America has disclosed that its third-party test platform briefly exposed Paycheck Protection Program applications to outside parties. According to SonicWall’s Dmitriy Ayrapetov, the leak was due to a rushed effort by the bank to finish the data platform, resulting in holes in its security.

Boundless Cybersecurity For The New Work Reality — SC Magazine

• The adoption of work-from-home has moved us into a hyper-distributed IT landscape. With 100-percent-remote employees conducting online meetings and connecting via email, mobile and cloud, the perimeter has vanished into a multitude of endpoints spread across the globe.

Cybersecurity News

New Tycoon ransomware targets both Windows and Linux systems — Bleeping Computer

• A new human-operated ransomware strain is being deployed in highly targeted attacks on small- to medium-size organizations in the software and education industries.

Large-scale attack tries to steal configuration files from WordPress sites — ZDNet

• In an attempt to steal database credentials, attackers tried to download configuration files from WordPress via old vulnerabilities in unpatched plugins.

‘Scorching-hot hacked computer burned my hand’ — BBC

• At least a dozen supercomputers across Europe had to be shut down last week due to cryptojacking attacks. One individual found out the hard way that his was one of them.

USBCulprit malware targets air-gapped systems to steal govt info — Bleeping Computer

• The newly revealed USBCulprit malware is designed for compromising air-gapped devices via USB.

Cybersecurity warning: Hackers are targeting your smartphone as way into the company network — ZDNet

• Campaigns targeting smartphones have risen by a third in just a few months, many with the end goal of opening a portal to corporate networks.

Denial of service attacks against advocacy groups skyrocket — Cyberscoop

• A new report suggests that advocacy sites are being targeted at a rate more than four times that of U.S. government websites such as police and military organizations.

Ransomware gang says it breached one of NASA’s IT contractors — ZDNet

• DopplePaymer ransomware gang claims to have breached DMI, a major U.S. IT and cybersecurity provider and a NASA IT contractor.

Anonymous, aiming for relevance, spins old data as new hacks — Cyberscoop

• The group is trying to use the nationwide protests to draw attention to data that was stolen years ago.

Apple fixes bug that could have given hackers full access to user accounts — Ars Technica

• Sign In With Apple — a privacy-enhancing tool that lets users log in to third-party apps without revealing their email addresses — just fixed a bug that made it possible for attackers to gain unauthorized access to those same accounts.

Suspected Hacker Faces Money Laundering, Conspiracy Charges — Bank Info Security

• According to the U.S. Department of Justice, a New York City man is facing federal charges after being arrested at John F. Kennedy Airport with a PC allegedly containing thousands of stolen credit card numbers.

An advanced and unconventional hack is targeting industrial firms — Ars Technica

• Attackers are putting considerable skill and effort into penetrating industrial companies in multiple countries, with hacks that use multiple evasion mechanisms, an innovative encryption scheme, and exploits that are customized for each target.

PonyFinal Ransomware Targets Enterprise Servers Then Bides Its Time — Threat Post

• Microsoft has warned of a new breed of “patient” ransomware that lurks in networks for weeks before striking.

In Case You Missed It

• Custom Build your Security Strategy with the SonicWall Boundless Cybersecurity Bundle — Amber Wolff
• Why Securing Remote Work is Crucial To Ensuring Business Continuity — Agasthiamani Sankaran
• Securing Telecommuters with Expanded Endpoint Visibility and Control — Suroop Chandran
• ‘Boundless Cybersecurity’ Protects Organizations Mobilizing for the New Business Normal — Geoff Blaine
• The New Front in Hospitals’ Battle Against COVID-19: Ransomware — Amber Wolff
• SonicWall Unveils Partner Program Designed for MSSPs — Lindsey Lockheart

This week, cybersecurity news was thrust into the fray, with clashes between scammers and vigilante hackers, between conspiracy theorists and cell-phone towers, and between REvil and a number of high-profile celebrities.

SonicWall Spotlight

DeskFlix: SonicWall channel director on COVID-19 cybersecurity challenges — CRN UK

• Mike Awford discusses the ways SonicWall has supported partners through the migration to remote working.

EasyJet Hack: Passenger Data Could be Sold on Dark Web After Major Cyber Attack, Experts Warn — The Independent

• Based on similar attacks in the past, SonicWall’s VP EMEA Terry Greer-King discusses what could happen to customers’ data once it hits the Dark Web.

SonicWall Capture Labs Threat Research Teams Uncovers New Variant of Raccoon Stealer — CXO Today

• SonicWall has reported a new variant of Raccoon stealer malware, version 1.5, which has been used in a malicious COVID-19 campaign.

Cybersecurity News

ShinyHunters Is a Hacking Group on a Data Breach Spree — Wired

• In May, ShinyHunters began selling 200 million stolen records from over a dozen companies … and they claim this is just Stage 1.

Beware of phishing emails urging for a LogMeIn security update — Help-Net Security

• The email appears to be legitimate correspondence from LogMeIn, including company logo, spoofed sender identity and a link that appears legitimate.

Vigilante hackers target scammers with ransomware, DDoS attacks — Bleeping Computer

• A hacker has been taking justice into their own hands by targeting “scam” companies with ransomware and denial of service attacks.

Tech Chiefs Press Cloud Suppliers for Consistency on Security Data — The Wall Street Journal

• Each cloud company offers its own process on cybersecurity and governance, creating added work for customers.

Cell-tower attacks by idiots who claim 5G spreads COVID-19 reportedly hit US — Ars Technica

• Wireless telecom providers are being warned to boost security as 5G conspiracy theorists ramp up attacks on cell towers and telecommunications workers.

Microsoft warns of ‘massive’ phishing attack pushing legit RAT — Bleeping Computer

• Microsoft is warning of an ongoing COVID-19 themed phishing campaign that spreads via malicious Excel attachments.

Supercomputers hacked across Europe to mine cryptocurrency — ZDNet

• Multiple supercomputers across Europe have been shut down to investigate cryptocurrency mining malware infections.

Microsoft opens up coronavirus threat data to the public — Cyberscoop

• Microsoft has announced plans to make threat intelligence it collected on COVID-19-related hacking campaigns public.

NetWalker adjusts ransomware operation to only target enterprise — Bleeping Computer

• NetWalker ransomware group is moving away from phishing for malware distribution and has adopted a network-intrusion model focusing on huge businesses only.

REvil Ransomware found buyer for Trump data, now targeting Madonna — Bleeping Computer

• After breaching a prominent law firm, the REvil ransomware group is holding the personal information of high-profile celebrities for ransom.

In Case You Missed It

• Why Securing Remote Work is Crucial To Ensuring Business Continuity — Agasthiamani Sankaran
• Securing Telecommuters with Expanded Endpoint Visibility and Control — Suroop Chandran
• ‘Boundless Cybersecurity’ Protects Organizations Mobilizing for the New Business Normal — Geoff Blaine
• The New Front in Hospitals’ Battle Against COVID-19: Ransomware — Amber Wolff
• SonicWall Unveils Partner Program Designed for MSSPs — Lindsey Lockheart

This week, healthcare continues to be in the crosshairs and ransomware-for-hire continues to mean big paydays for cybercriminals.

SonicWall Spotlight

Hackers Are Calling In The Raccoons — Fudzilla

• Hackers are exploiting anxiety around Covid-19 to create new hooks for their malware, such as the new Raccoon Stealer variant uncovered by SonicWall’s Threat Research team

SonicWall Called Upon by Health Giant GNC to Rapidly Provide Protection of Remote, Mobile Workforce — CXOToday

• SonicWall and GNC Holdings (GNC), a leading global health and wellness brand, are working closely to increase capacity of the company’s existing Secure Mobile Access (SMA) deployment to connect and secure the company’s growing volume of work-from-home employees.

Web-applications Attacks, Including SQL Injection Attacks, More Than Doubled In 2019, According To Data From Sonicwall — Security Boulevard

• What is an SQL injection attack? How common are they? And why are they so devastating? Security Boulevard weighs in on these nefarious attacks, and gives tips on how to prevent them.

Cybersecurity News

It Has Been 20 Years Since Cybercrime Woke Up To Social Engineering With An Intriguing Little Email Titled ‘ILOVEYOU’ — The Register

• Two decades have passed since cybercrooks demonstrated the role exploiting human psychology could play in spreading malware.

10 Questions With Tech Data Security Guru Alex Ryals On Security Trends And Training In Isolation — CRN

• Learning about cybersecurity has never been more important — but with an abundance of styles and modules to choose from, it’s also never been easier.

Cyber-spies seek coronavirus vaccine secrets — BBC

• The U.S. has seen foreign spy agencies carry out reconnaissance of research into a coronavirus vaccine, a senior U.S. intelligence official told the BBC — and similar reports have come from the UK as well.

Healthcare Targeted By More Attacks But Less Sophistication — Dark Reading

• An increase in attacks targeting healthcare organizations suggests that perhaps new cybercriminals are getting into the game.

Sodinokibi, Ryuk ransomware drive up average ransom to $111,000 — Bleeping Computer

• The first quarter of the year saw a 33% increase of the average amount ransomware operators demand from their victims compared to the previous quarter.

LockBit, the new ransomware for hire: a sad and cautionary tale — Ars Technica

• A ransomware infection involving a recent strain called LockBit ransacked one company’s poorly secured network in a matter of hours, leaving leaders no viable choice other than to pay the ransom.

New Kaiji Botnet Targets IoT, Linux Devices — Threat Post

• The botnet uses SSH brute-force attacks to infect devices and a custom implant written in the Go Language.

Phishing Attacks Against Banks Jump With Pandemic Used as Lure — Bloomberg

• Cyber-attacks trying to trick bank employees into clicking on malicious links jumped in the first quarter, with criminals attempting to take advantage of fear and confusion caused by the coronavirus pandemic, Bloomberg reports.

SilverTerrier BEC scammers target US govt healthcare agencies — Bleeping Computer

• Government healthcare agencies, COVID-19 response organizations, and medical research facilities from across the globe were the targets of Business Email Compromise (BEC) phishing campaigns coordinated by multiple Nigerian BEC actors during the last three months.

In Case You Missed It

• Why Securing Remote Work is Crucial To Ensuring Business Continuity — Agasthiamani Sankaran
• Securing Telecommuters with Expanded Endpoint Visibility and Control — Suroop Chandran
• ‘Boundless Cybersecurity’ Protects Organizations Mobilizing for the New Business Normal — Geoff Blaine
• The New Front in Hospitals’ Battle Against COVID-19: Ransomware — Amber Wolff
• SonicWall Unveils Partner Program Designed for MSSPs — Lindsey Lockheart