Curated cybersecurity news and trends from the industry’s leading bloggers and news outlets, for you from SonicWall.

It’s the beginning of May, which brings warm weather, rain showers and Star Wars jokes. Happy “Revenge of the Fifth” to all of our Sith Lords and Ladies. SonicWall channeled the force in the media this week with GovInfoSecurity quoting SonicWall CEO Bob VanKirk on SMBs and ChannelPro, CRN and Channel Futures spreading the news of SonicWall’s new channel chief for North America, Michelle Ragusa-McBain.

In industry news, Dark Reading covered a new tool to help companies keep their data safe from AI. Bleeping Computer provided details on operation “SpecTor” and Google’s takedown of CryptBot. TechCrunch had the lowdown on the City of Dallas’ ransomware attack.

Remember to keep your passwords close and your eyes peeled – cybersecurity is everyone’s responsibility.

SonicWall News

Key Cybersecurity Threats to Watch For

Risk Management, SonicWall News: Cybercriminals monetize their activities via ransomware, and the tactic, which blocks access to systems or data until a ransom is paid, is being used against companies of all sizes. In 2022, there were nearly 500 million ransomware attacks worldwide, according to SonicWall.

The Most Pressing Security Needs of the SMB and Midmarket

GovInfoSecurity, SonicWall News: Bob VanKirk, president and CEO, SonicWall, highlighted the need for SMBs to have access to the right set of tools and resources to defend their companies and protect their brands. In order to ensure cybersecurity, VanKirk said, organizations must have all the threat data at their fingertips, whether it be a firewall, endpoint or remote access, and have analytics across all those areas.

SonicWall Names North American Channel Chief

ChannelPro, SonicWall News: SonicWall has named Michelle Ragusa-McBain its new channel chief for North America. The hiring is one of several measures, along with the forthcoming introduction of a revamped partner program, aimed at expanding the company’s MSP channel, according to Jason Carter, SonicWall’s CRO.

SonicWall Hires Cisco Vet Michelle Ragusa-McBain as North America Channel Chief

CRN, SonicWall News: SonicWall has hired Cisco Systems veteran Michelle Ragusa-McBain to oversee its large North America channel, as the cybersecurity vendor looks to “reimagine” its business with the help of partners, she said in an interview with CRN.

Cisco Vet Joins SonicWall Channel Team as North America Leader

ChannelFutures, SonicWall News: Ragusa-McBain’s goal is to enable partners to grow and profit with the “boundless shift to cybersecurity.” SonicWall announced her appointment at this week’s Channel Partners Conference & Expo, co-located with MSP Summit.

CIA 2023: Top Solution Providers

Channel Daily News, SonicWall News: It helps customers by delivering integrated technology solutions and services that include security, cloud, data centre, networking, collaboration and digital transformation. This year it singled out HPE, Cisco, Veeam and SonicWall as its partners of the year.

SonicWall Partner Program Updates Coming

Channel Futures (Slide 4), SonicWall News: “We’ll be updating our partner program,” VanKirk said. “We’ve seen incredible growth out of what we have called our MSSP program in the past. We’re redoing that program altogether so that it will allow a much broader set of partners to participate and take advantage of, for example, monthly billing and if the number of users goes up or down, you’re only paying for that number. So we’re expanding that program, allowing a lot more partners in. We’ll be expanding that offering. It was just a few solutions. Now what we’re doing with all the changes, it used to be OK after the products were out, hey, what can we send through the MSSP program and service provider program. Now at the front end before a product even is going into the life cycle development, the PMs have to justify why or where is that going to fit in the partner program and the service provider program, which is a whole different approach that contributes to our seeing so much strength there.”

Malware attacks on the rise in higher ed

EdScoop, SonicWall News: Malware attacks against higher education institutions rose by 26% last year, according to SonicWall’s 2023 Cyber Threat Report. The report, published earlier this month, found that while malware attacks rose, ransomware attacks targeting higher education institutions declined 29% last year.

SD Worx pauses HR operations after cyberattack

Unleashed, SonicWall News: SonicWall warned recently that “new tactics are being developed with breathtaking speed. For the past two years, ransomware has been on a tear, increasing 62% year over year in 2020 and another 105% in 2021,” a 2023 SonicWall report said. “During this time, ransomware-as-a-service took off, compromised credentials became cheaper and more plentiful than ever, and the number of vulnerabilities continued hitting record highs.

FBI warning: Don’t use public phone charging stations

San Francisco Examiner, SonicWall News: SonicWall warned recently that “new tactics are being developed with breathtaking speed. For the past two years, ransomware has been on a tear, increasing 62% year over year in 2020 and another 105% in 2021,” a 2023 SonicWall report said. “During this time, ransomware-as-a-service took off, compromised credentials became cheaper and more plentiful than ever, and the number of vulnerabilities continued hitting record highs.

UAE residents can insure phones, other gadgets against cyberattacks, economic losses

Zawya (UAE), SonicWall News: According to the latest figures from cybersecurity leader SonicWall reveal, the UAE recorded a 14 percent drop in total malware attacks in 2022 but the number of attacks in 2022 in the UAE (71 million) was more than the combined total in 2019 and 2020 (37.3 million and 19 million, respectively).

North Korea accelerates nuclear missile programme with ‘treasure sword’ — $1.7bn from crypto heists

DL News, SonicWall News: “As for individual crypto investors, they should be aware of the risks of having their assets in these exchanges,” said Chavoya. “North Korean crypto hacking is so important to the Kim regime that it is going to continue scaling despite tighter restrictions,” Chavoya said.

Industry News

International Effort Nabs 288 Dark Web Drug Dealers and Buyers

Hundreds of drug dealers and purchasers who were active on a Dark Web marketplace known as “Monopoly Market” were arrested following an international law enforcement effort. The operation was dubbed “SpecTor” and resulted in police seizing over $55 million in cash and cryptocurrency. According to Bleeping Computer, police seized the website in late 2021, but many users believed that this was an exit scam by the site creators. It was only confirmed this week that police had indeed actually seized the website. Operation “SpecTor” targeted high-volume sellers and purchasers specifically – many of the arrested individuals were also active on other Dark Web marketplaces, making this a significant bust.  Along with the cash and cryptocurrency, police also seized over 1,800 pounds of drugs and 117 firearms. A majority of those arrested resided in the United States, United Kingdom and Germany. The operation was headed by Europol and the Federal Bureau of Investigation, but it also included police from the UK, France, Poland, Germany, Austria, Brazil and Switzerland.

PrivateGPT Launches Redaction Tool to Reduce Risk of AI Data Exposure

There have been a lot of discussions lately about what information employees may be entering into AI tools like ChatGPT – many companies have asked employees to not enter any company information or data into the tools. Private AI has introduced a new platform called PrivateGPT that integrates with ChatGPT to automatically redact over 50 types of personally identifiable information. PrivateGPT acts as a middleman between users and the AI, removing sensitive information like birth dates, credit card numbers and much more. Many users of ChatGPT don’t seem to realize that all information they enter into ChatGPT is absorbed into OpenAI’s LLM data set that they use to train the AI. OpenAI notes in its user guide that users should not share personal or sensitive information with the AI because OpenAI cannot delete that information from a user’s history once it’s been entered. With AI rapidly advancing, tools like PrivateGPT may become necessary for both regular users and corporate entities to safely use the tool. For now, users should continue to be careful of what they share with AI.

City of Dallas Hit by Royal Ransomware Gang

The Royal ransomware gang took credit for an attack on the City of Dallas this week. The attack took down key services in the Dallas metropolitan area including 911 dispatch services and some systems at local courthouses – the courthouses were forced to close amid the chaos. A spokesperson for the Dallas Police Department (DPD) told TechCrunch that 911 dispatchers had to write down instructions for officers instead of entering them into their digital systems during the outage. DPD noted that the outage did not affect police response. City officials realized something was amiss when printers on the City of Dallas network began printing out ransom notes on Wednesday morning. The notes stated that Royal had stolen the city’s data and would release it on the Dark Web unless the group’s demands were met. The full scope of the attack is still unknown at this time, but city officials did say they are currently working to isolate and remove the ransomware from infected servers.

Google Takes on CryptBot Malware Operation, Sues Threat Actors

Google has sued some threat actors using the CryptBot malware to steal information from Google Chrome users. The court has now granted Google a restraining order, which allows Google to begin disrupting the CryptBot credential stealing operation. The lawsuit specifically targets the infrastructure and distribution network being used to spread the malware, which will slow the malware’s spread significantly. Google now has court-granted authority to take down domains that have been linked to the spread of the malware. According to Bleeping Computer, CryptBot is a Windows malware that is used to steal sensitive information from a user’s computer. The stolen data obtained by CryptBot can be used to steal identities, commit fraud and more. Google stated that recent versions of the malware have targeted Chrome specifically, which is why Google’s CyberCrime Investigation Group (CCIG) and Threat Analysis Group (TAG) got involved. With the courts backing their efforts, Google should be able to deal a serious blow to the CryptBot operation.

SonicWall Blog

The RSA Report: Boots on the Ground – Amber Wolff

The RSA Report – New Tactics, New Technologies – Amber Wolff

The RSA Report: Protecting Objective Truth in Cybersecurity – Amber Wolff

The RSA Report: The Road to RSA – Amber Wolff

RSA 2023: What “Stronger Together” Means With SonicWall – Amber Wolff

Cybersecurity: Preventing Disaster from Being Online – Ray Wyman Jr

SonicWall Earns 5-Star Rating in 2023 Partner Program Guide for the Seventh Straight Year – Bret Fitzgerald

Global Threat Data, Worldwide Coverage: The 2023 SonicWall Cyber Threat Report – Amber Wolff

U.S. National Cybersecurity Strategy Represents Paradigm Shift in IT Security – Darryl Jenkins

SonicWall Data Shows Attacks on Schools Skyrocketing – Amber Wolff

Today is National Reach As High As You Can Day, and SonicWall is still reaching high points in the headlines. Zawya (UAE) cited the 2023 Cyber Threat Report, noting a 14% drop in malware attacks for the UAE during 2022. The San Francisco Examiner and Unleashed included quotes from the threat report citing SonicWall ransomware data.

In industry news, TechCrunch has the lowdown on U.S. intelligence leaks from an Air National Guardsman. Dark Reading provided details on Microsoft’s uncovering of an Israel-based Private-Sector Offensive Actor (PSOA). The Yum! Brands breach was broached by Bleeping Computer. Hacker News covered the malware debacle at WordPress and a Russia-linked hacker gang carrying out a cyber espionage campaign.

Remember to keep your passwords close and your eyes peeled — cybersecurity is everyone’s responsibility.

SonicWall News

SD Worx pauses HR operations after cyberattack

Unleashed, SonicWall News: SonicWall warned recently that “new tactics are being developed with breathtaking speed. For the past two years, ransomware has been on a tear, increasing 62% year over year in 2020 and another 105% in 2021,” a 2023 SonicWall report said. “During this time, Ransomware-as-a-Service took off, compromised credentials became cheaper and more plentiful than ever, and the number of vulnerabilities continued hitting record highs.

FBI warning: Don’t use public phone charging stations

San Francisco Examiner, SonicWall News: SonicWall warned recently that “new tactics are being developed with breathtaking speed. For the past two years, ransomware has been on a tear, increasing 62% year over year in 2020 and another 105% in 2021,” a 2023 SonicWall report said. “During this time, Ransomware-as-a-Service took off, compromised credentials became cheaper and more plentiful than ever, and the number of vulnerabilities continued hitting record highs.

UAE residents can insure phones, other gadgets against cyberattacks, economic losses

Zawya (UAE), SonicWall News: According to the latest figures from cybersecurity leader SonicWall reveal, the UAE recorded a 14 percent drop in total malware attacks in 2022 but the number of attacks in 2022 in the UAE (71 million) was more than the combined total in 2019 and 2020 (37.3 million and 19 million, respectively).

North Korea accelerates nuclear missile programme with ‘treasure sword’ — $1.7bn from crypto heists

DL News, SonicWall News: “As for individual crypto investors, they should be aware of the risks of having their assets in these exchanges,” said Chavoya. “North Korean crypto hacking is so important to the Kim regime that it is going to continue scaling despite tighter restrictions,” Chavoya said.

Hackers Are Cashing in With Hijacked IP Addresses

TechNewsWorld, SonicWall News: These apps are often promoted via referral programs, with many notable “influencers” promoting them for passive income opportunities, said Immanuel Chavoya, the senior manager of product security at SonicWall, a network firewall maker in Milpitas, Calif.

Behavior-Based Security Training to Stem Tide of Cybersecurity Breaches

American Security Today, SonicWall News: In the first half of 2022, SonicWall detected 270,228 never-before-seen malware variants. That’s an average of 1,500 new variants per day.

Silence gets you nowhere in a data breach

TechCrunch, SonicWall News: Attackers are increasingly targeting smaller businesses – as outlined in the 2023 SonicWall Cyber Threat Report — due to the fact they are seen as easier targets than large companies. This means that your startup is likely to get compromised at some point.

SonicWall CEO: Success will come from listening to partners

Microscope, SonicWall News: “I kind of flipped the sales team upside down to really make the team aligned with our partners,” he said. “Our partners are a force multiplier, one of our key differentiators. Not diminishing our product capabilities, but from the-go-to market standpoint, I really leaned into better aligning, and better listening to our channels where they were going with their businesses, requirements, needs and pain points.

Malware attacks on IoT and cryptojacking are growing in 2022

Computer Weekly (Spain), SonicWall News: Despite the 21% drop in ransomware globally, 2022 was the second year with the highest number of attack attempts with 493.3 million, SonicWall, which also reported a 2% increase in malware, 87% in IoT malware and 43% in cryptojacking.

DC Health Link Breach Exposes Private Information of Lawmakers

InformationWeek, SonicWall News: The healthcare industry is a popular target for breaches. Care providers and insurance companies safeguard valuable data. “Threat actors believe that healthcare providers and related organizations have no option but to pay the ransom, as restoring operations can mean the difference between life and death,” Immanuel Chavoya, threat detection and response strategist at cybersecurity company SonicWall, points out.

Ferrari in Italy targeted in cyber attack

MotorTrader, SonicWall News: In the UK, dealer groups Pendragon and Arnold have been targeted for cyber crime. According to the cyber security 2023 SonicWall Threat Report, the UK is the 2nd most attacked country in the world, after the US. It said ransomware attacks last year doubled.

Covert Cyberattacks on The Rise as Attackers Shift Tactics for Maximum Impact

HelpNetSecurity, SonicWall News: 2022 was the second-highest year on record for global ransomware attempts, as well as an 87% increase in IoT malware and a record number of cryptojacking attacks (139.3 million), according to SonicWall.

Industry News

US National Secrets Leaked by Air National Guardsman in Discord Server

A 21-year-old member of the Massachusetts Air National Guard has been identified as the person responsible for leaking classified government and military intelligence on a private Discord server. Attorney General Merrick Garland stated, “Today the Justice Department arrested Jack Douglas Teixeira in connection with an investigation into alleged unauthorized removal, retention and transmission of classified national defense information.” Teixeira originally leaked the documents solely to the private server, but the documents later appeared in several other Discord servers including a large Minecraft server with thousands of members. The intelligence included sensitive information about the war in Ukraine and much more. It was making the rounds on Discord for months before the proper authorities caught on. Teixeira will soon have his first court appearance in the U.S. District Court for the District of Massachusetts.

Microsoft Catches Israel-based Threat Group Selling Mobile Spyware

Threat intelligence researchers at Microsoft stated this week that a threat group they’ve been tracking as DEV-0196 is actually a Private-Sector Offensive Actor (PSOA) known as QuaDream. QuaDream, which is based in Israel, sells a malicious software suite called REIGN to governments around the world. REIGN consists of malware, exploits and a mobile data exfiltration tool. According to Dark Reading, the actions of the group have been in-line with another Israel-based threat group known as NSO group. NSO group has been blacklisted for peddling the Pegasus iOS spyware to hostile governments. Oddly, QuaDream does not have a website, but they have allegedly been active since 2016. A winter 2022 report from Meta claimed QuaDream was performing tests to exfiltrate data from both Android and iOS devices. The software QuaDream is selling utilizes zero-click exploits which can be difficult to protect against. The Microsoft researchers recommended following basic cyber hygiene practices to minimize risks.

Yum! Brands Discloses Data Breach

Fast food giant Yum! was the victim of a data breach in mid-January. The KFC, Pizza Hut and Taco Bell brand owner has started sending out notifications to some individuals whose personal information was stolen. The notifications disclosed that the names, driver’s license numbers and other ID numbers of some persons had been stolen by the attackers. According to Bleeping Computer, Yum! temporarily shut down approximately 300 restaurants in the United Kingdom as a result of the attack. No customer information was stolen during the attack. All of the stolen personal information belonged to employees of Yum! Brands. The total number of affected individuals is unknown at this time.

Russian Hacker Gang Linked to Espionage Effort

A Russia-linked hacker gang named Nobelium has been linked to attacks on foreign ministries and diplomatic entities in multiple NATO, European Union and African nations. The connection to Nobelium was made when Polish intelligence agencies noticed similarities between the group carrying out these attacks and the group that carried out a major attack on SolarWinds in 2020. The Polish agencies noted that Nobelium is using both new and old tools to carry out these attacks. Hacker News stated that the attacks typically begin with spear-phishing emails to diplomats disguised as invitations to meetings. If the victim opens the included booby-trapped PDF file, an HTML dropper is deployed and releases multiple previously unknown malware strains onto the victim’s device.

WordPress Hit by Balada Injector Malware Campaign

A malware campaign has infected more than a million WordPress websites with a malware that redirects visitors to scam sites. The campaign was designed to deploy a malicious program called Balada Injector. The malware targets vulnerabilities in outdated plugins and themes, and it’s been active on WordPress since 2017. The threat actors initiate the attacks, and once the attackers successfully infiltrate the sites, they then insert malicious JavaScript code that redirects visitors to fake tech support sites, fake CAPTCHA pages and more. Hacker News stated that the attacks usually come in waves once every few weeks. Researchers warned that the malware could expose visitors to more nefarious threats, such as identity theft and ransomware.  All WordPress site owners have been advised to update their themes and plugins to the latest versions.

SonicWall Blog

RSA 2023: What “Stronger Together” Means With SonicWall – Amber Wolff

Cybersecurity: Preventing Disaster from Being Online – Ray Wyman Jr

SonicWall Earns 5-Star Rating in 2023 Partner Program Guide for the Seventh Straight Year – Bret Fitzgerald

Global Threat Data, Worldwide Coverage: The 2023 SonicWall Cyber Threat Report – Amber Wolff

U.S. National Cybersecurity Strategy Represents Paradigm Shift in IT Security – Darryl Jenkins

SonicWall Data Shows Attacks on Schools Skyrocketing – Amber Wolff

Recognizing Outstanding Partner and Distributor Performance in 2022 – Bob VanKirk

Latest Threat Intelligence Reveals Rising Tide of Cryptojacking – Amber Wolff

Latest Threat Intelligence Tracks Shifting Cyber Frontlines in 2022 – Amber Wolff

New SMA Release Updates OpenSSL Library, Includes Key Security Features – Jai Balasubramaniyan

SonicWall Recognizes Bill Conner for Transition of Business, Impact on Cybersecurity Industry – Bret Fitzgerald

SonicWall’s Jason Carter and Matt Brennan Earn 2023 CRN Channel Chief Recognition – Bret Fitzgerald

April Fools’ Day is fast-approaching, and you’d have to be a fool to not see all the good stuff happening at SonicWall this week. Microscope quoted SonicWall CEO Bob VanKirk on how he’s successfully aligned two key areas at SonicWall. TechCrunch and Computer Weekly cited data from the 2023 Cyber Threat Report.

In industry news, Data Breach Today covers a slew of tech leaders asking AI developers to slow down. Dark Reading has the lowdown on a new MacOS malware. TechCrunch has information on a supply chain attack on a major phone system. At Bleeping Computer, they discuss a security flaw in a common WiFi protocol that’s causing problems. Hacker News provides insight on OpenAI’s user data leak from last week.

Remember to keep your passwords close and your eyes peeled — cybersecurity is everyone’s responsibility.

SonicWall News

Silence gets you nowhere in a data breach

TechCrunch, SonicWall News: Attackers are increasingly targeting smaller businesses – as outlined in the 2023 SonicWall Cyber Threat Report – due to the fact they are seen as easier targets than large companies. This means that your startup is likely to get compromised at some point.

SonicWall CEO: Success will come from listening to partners

Microscope, SonicWall News: “I kind of flipped the sales team upside down to really make the team aligned with our partners,” he said. “Our partners are a force multiplier, one of our key differentiators. Not diminishing our product capabilities, but from the-go-to market standpoint, I really leaned into better aligning, and better listening to our channels where they were going with their businesses, requirements, needs and pain points.

Malware attacks on IoT and cryptojacking are growing in 2022

Computer Weekly (Spain), SonicWall News: Despite the 21% drop in ransomware globally, 2022 was the second year with the highest number of attack attempts with 493.3 million, SonicWall, which also reported a 2% increase in malware, 87% in IoT malware and 43% in cryptojacking.

DC Health Link Breach Exposes Private Information of Lawmakers

InformationWeek, SonicWall News: The healthcare industry is a popular target for breaches. Care providers and insurance companies safeguard valuable data. “Threat actors believe that healthcare providers and related organizations have no option but to pay the ransom, as restoring operations can mean the difference between life and death,” Immanuel Chavoya, threat detection and response strategist at cybersecurity company SonicWall, points out.

Ferrari in Italy targeted in cyber attack

MotorTrader, SonicWall News: In the UK, dealer groups Pendragon and Arnold have been targeted for cyber crime. According to the cyber security 2023 SonicWall Threat Report the UK is the 2nd most attacked country in the world, after the US. It said ransomware attacks last year doubled.

Covert Cyberattacks on The Rise as Attackers Shift Tactics for Maximum Impact

HelpNetSecurity, SonicWall News: 2022 was the second-highest year on record for global ransomware attempts, as well as an 87% increase in IoT malware and a record number of cryptojacking attacks (139.3 million), according to SonicWall.

2023 Could Be the Biggest Ever Year for Cybercrime

TechRadarPro, SonicWall News: 2023 could very well be the biggest year ever for cybercriminals, new figures have claimed. According to SonicWall’s latest figures, cybercrime is on the rise across the board, but trends are slowly shifting which is something IT security teams should keep in mind. More precisely, hackers are opting for a “slow and low” approach, keeping stealthy while trying to achieve financially-motivated goals.

Spikes In IoT Malware, Cryptojacking Offset Decline in Ransomware In 2022

MSSP Alert, SonicWall News: SonicWall researchers recorded the second-highest year on record for global ransomware attempts but it was an 87% increase in Internet of Things (IoT) malware and a record number of cryptojacking attacks (139.3 million) that signaled a shift in the overall threat landscape in 2022, the company said in a new report.

Cybercrime Spiked In 2022 — And This Year Could Be Worse

Digital Trends, SonicWall News: Last year saw a massive spike in cybercrime, with some types of malicious digital activity rising by as much as 87%. It doesn’t bode well — but there were a couple of relative bright spots. That information comes from a new report published by cybersecurity firm SonicWall. It makes for interesting reading, especially since one of the biggest rises came from an unusual source — and one of the most feared types of malware saw a hefty drop.

Ransomware Attacks Plunged 48 Percent in US Last Year: SonicWall

CRN, SonicWall News: In a major reversal from prior years, the volume of ransomware attacks globally dropped by 21 percent in 2022, year-over-year, with a 48-percent decline in the U.S., SonicWall said in a new report Tuesday. It’s encouraging that we’re seeing a decrease” in ransomware attacks, SonicWall CEO Bob VanKirk said in an interview with CRN. At the same time, “the number of attacks still is staggering,” VanKirk said.

Ransomware Threat Surges as Brits Suffer Millions of Attacks In 2022

Evening Standard, SonicWall News: The scale of the threat posed to companies and consumers by cyberattacks was laid bare today in a new report which reveals global ransomware attempts hit their second highest year on record in 2022.

Cyber intrusion attempts and malware attacks climbed 19% and 2% respectively, according to the Global Cyberattack Trends report by SonicWall, while crypto-theft attacks jumped 43% to reach a record high. The volume of ransomware attacks was especially severe in the UK, climbing a staggering 112% in 2022, the report found, despite a 21% decrease in attacks worldwide.

Experts Spot Half a Million Novel Malware Variants in 2022

InfoSecurity, SonicWall News: Global malware detections increased 2% year-on-year (YoY) in 2022 to hit 5.5 billion, with never-before-seen variants surging 5%, according to SonicWall. The security vendor captured threat intelligence from its global SonicWall Capture Threat network, including one million security sensors, in order to compile its 2023 SonicWall Cyber Threat Report.

Industry News

Tech Leaders Ask AI Developers to Slow Down Amid Fears

Artificial intelligence (AI) has been rapidly advancing over the past few years leading to a laundry list of exciting new features. While we’ve seen what AI can do with writing, artwork, memes and more, some top tech leaders have shared their concerns and actually asked AI developers to stop development for at least six months. The Future of Life Institute gathered over 1,000 signatures on a document asking to stop and consider developing safety protocols and more before continuing. The list of signatories includes notable names like Twitter CEO Elon Musk and former presidential candidate Andrew Yang along with Turing Prize-winner Yoshua Bengio and many others. The document asks pertinent questions about job automation, propaganda and even potentially losing control of our civilization as a whole. It remains to be seen whether the document will actually have an impact on the development of AI, but it would be prudent to stop and consider the possibilities of AI.

Apple Loses User Data to MacStealer Malware

MacOS users should be on the lookout as a new information-stealing malware, MacStealer, is making the rounds. The malware steals things like documents, browser cookies, passwords, iCloud keychain data and more. According to Dark Reading, the malware has been found on the Catalina version of MacOS as well as versions that use Intel’s M1 and M2 chipsets. The threat actors spreading this malware are doing so by getting users to install fake apps or download malicious files. Once users install the bogus software or download the malicious files, the malware prompts them to enter their login credentials which are then stored and sent off to the threat actors. Until a patch is released, MacOS users on the affected versions should continue to be wary when installing software or downloading files from suspicious sources.

New Supply Chain Attack Targets Major Phone System

A new supply chain attack targeting software-based phone developer 3CX has caused some concern amid multiple cybersecurity firms. Large companies like McDonald’s, American Express and BMW rely on the phone software for various services. It’s even used by the United Kingdom’s National Health Service. According to TechCrunch, 3CX claims to have over 12 million daily users. The attack has been compared to the SolarWinds attack and has been named “Smooth Operator.” The malware steals data and stored credentials from various internet browsers including Firefox, Brave, Microsoft Edge and Google Chrome. 3CX is aware of the issue and is asking customers to uninstall and reinstall the software on all devices.

Threat Actors Exploit WiFi Protocol Flaw to Commandeer Network Traffic

A security flaw that attackers can exploit to force access points to leak network frames has been uncovered in the IEEE 802.11 WiFi protocol. These network frames contain data such as MAC addresses and management data. The cybersecurity researchers who made the discovery found that the flaw could have widespread impact as it affects Linux, iOS, Android and FreeBSD. According to Bleeping Computer, Cisco has brought attention to the flaw and admitted that it could affect some Cisco products. There are currently no instances of the flaw being exploited in the wild.

OpenAI Gives Insight Into ChatGPT User Data Exposure Bug

ChatGPT’s developers, OpenAI, provided some answers this week about exactly what led to the glitches in their system last week that allowed some users to see descriptions of other users’ conversations as well as other users’ messages. OpenAI stated that the bug was found in the Redis open-source library. According to OpenAI’s statement, the bug in the Redis library caused connections to become corrupted and allowed for the chatbot to send users data from other users’ conversations. The company took ChatGPT down while addressing the glitch. Hacker News stated that the issue may have led to other issues where some users full names, email addresses, payment addresses and last four digits of their credit card numbers were revealed. The company emphasized that the full credit card numbers were not revealed in any instance. The issue has since been resolved, but time will surely tell the full impact this bug may have on ChatGPT and its users.

SonicWall Blog

Cybersecurity: Preventing Disaster from Being Online – Ray Wyman Jr

SonicWall Earns 5-Star Rating in 2023 Partner Program Guide for the Seventh Straight Year – Bret Fitzgerald

Global Threat Data, Worldwide Coverage: The 2023 SonicWall Cyber Threat Report – Amber Wolff

U.S. National Cybersecurity Strategy Represents Paradigm Shift in IT Security – Darryl Jenkins

SonicWall Data Shows Attacks on Schools Skyrocketing – Amber Wolff

Recognizing Outstanding Partner and Distributor Performance in 2022 – Bob VanKirk

Latest Threat Intelligence Reveals Rising Tide of Cryptojacking – Amber Wolff

Latest Threat Intelligence Tracks Shifting Cyber Frontlines in 2022 – Amber Wolff

New SMA Release Updates OpenSSL Library, Includes Key Security Features – Jai Balasubramaniyan

SonicWall Recognizes Bill Conner for Transition of Business, Impact on Cybersecurity Industry – Bret Fitzgerald

SonicWall’s Jason Carter and Matt Brennan Earn 2023 CRN Channel Chief Recognition – Bret Fitzgerald

Can You Catch All the Phish? Take Our New Phishing IQ Quiz and Find Out! – Ken Dang

Curated cybersecurity news and trends from the industry’s leading bloggers and news outlets, for you from SonicWall.

It’s St. Patrick’s Day today, so we hope you’re protecting yourself by wearing green. We also hope you’re protecting yourself from cybercriminals by staying up to date with the latest threat intelligence, such as the 2023 Cyber Threat Report.

In industry news, Hacker News has the lowdown on a new AiTM phishing campaign and a phony ChatGPT extension causing trouble for Chrome users. Bleeping Computer reported on a new attack developed for air-gapped computers. The folks at Dark Reading have the scoop on AI-created YouTube videos spreading malware. TechCrunch and Vice dive into details on a potential breach at video surveillance company Ring.

Remember to keep your passwords close and your eyes peeled — cybersecurity is everyone’s responsibility.

SonicWall News

Covert Cyberattacks on The Rise as Attackers Shift Tactics for Maximum Impact

HelpNetSecurity, SonicWall News: 2022 was the second-highest year on record for global ransomware attempts, as well as an 87% increase in IoT malware and a record number of cryptojacking attacks (139.3 million), according to SonicWall.

2023 Could Be the Biggest Ever Year for Cybercrime

TechRadarPro, SonicWall News: 2023 could very well be the biggest year ever for cybercriminals, new figures have claimed. According to SonicWall’s latest figures, cybercrime is on the rise across the board, but trends are slowly shifting which is something IT security teams should keep in mind. More precisely, hackers are opting for a “slow and low” approach, keeping stealthy while trying to achieve financially-motivated goals.

Spikes In IoT Malware, Cryptojacking Offset Decline in Ransomware In 2022

MSSP Alert, SonicWall News: SonicWall researchers recorded the second-highest year on record for global ransomware attempts but it was an 87% increase in Internet of Things (IoT) malware and a record number of cryptojacking attacks (139.3 million) that signaled a shift in the overall threat landscape in 2022, the company said in a new report.

Cybercrime Spiked In 2022 — And This Year Could Be Worse

Digital Trends, SonicWall News: Last year saw a massive spike in cybercrime, with some types of malicious digital activity rising by as much as 87%. It doesn’t bode well — but there were a couple of relative bright spots. That information comes from a new report published by cybersecurity firm SonicWall. It makes for interesting reading, especially since one of the biggest rises came from an unusual source — and one of the most feared types of malware saw a hefty drop.

Ransomware Attacks Plunged 48 Percent in US Last Year: SonicWall

CRN, SonicWall News: In a major reversal from prior years, the volume of ransomware attacks globally dropped by 21 percent in 2022, year-over-year, with a 48-percent decline in the U.S., SonicWall said in a new report Tuesday. It’s encouraging that we’re seeing a decrease” in ransomware attacks, SonicWall CEO Bob VanKirk said in an interview with CRN. At the same time, “the number of attacks still is staggering,” VanKirk said.

Ransomware Threat Surges as Brits Suffer Millions of Attacks In 2022

Evening Standard, SonicWall News: The scale of the threat posed to companies and consumers by cyberattacks was laid bare today in a new report which reveals global ransomware attempts hit their second highest year on record in 2022.

Cyber intrusion attempts and malware attacks climbed 19% and 2% respectively, according to the Global Cyberattack Trends report by SonicWall, while crypto-theft attacks jumped 43% to reach a record high. The volume of ransomware attacks was especially severe in the UK, climbing a staggering 112% in 2022, the report found, despite a 21% decrease in attacks worldwide.

Experts Spot Half a Million Novel Malware Variants in 2022

InfoSecurity, SonicWall News: Global malware detections increased 2% year-on-year (YoY) in 2022 to hit 5.5 billion, with never-before-seen variants surging 5%, according to SonicWall. The security vendor captured threat intelligence from its global SonicWall Capture Threat network, including one million security sensors, in order to compile its 2023 SonicWall Cyber Threat Report.

Ransomware Threat Surges as Brits Suffer Millions of Attacks In 2022

MSN, SonicWall News: Bob Vankirk, CEO of SonicWall, said: “The past year reinforced the need for cybersecurity in every industry and every facet of business, as threat actors targeted anything and everything, from education to retail to finance. While organizations face an increasing number of real-world obstacles with macroeconomic pressures and continued geopolitical strife, threat actors are shifting attack strategies at an alarming rate.”

State-Sponsored Hackers Are Diversifying Tactics, Targeting Small Businesses

IT Pro, SonicWall News: State-sponsored threat actors are increasingly shifting their focus towards SMBs and smaller enterprises, according to new research. While large enterprises, public services, and critical national infrastructure have traditionally been key targets for state-sponsored threat actors, SonicWall’s 2023 Cyber Threat Report predicted that groups will ‘diversify’ their tactics in 2023 to target SMBs and a “broader set of victims.”

Cybersecurity Predictions for 2023 – Things You Should Know

Utah Pulse, SonicWall News: SonicWall reports a 328% YoY increase in healthcare ransomware attacks in 2022, and healthcare and education are expected to be among the most targeted sectors in 2023. The expanding IoT footprint in these sectors is predicted to make them more vulnerable to digital attacks, increasing the risk to critical infrastructure.

The 20 Coolest Network Security Companies Of 2023: The Security 100

CRN, SonicWall News: Key offer­ings from SonicWall in the realm of next-gener­ation firewalls include the SonicWall NSa 5700, which utilizes a scalable hardware architecture designed to fit in a single rack-mountable unit. The high port density of the NSa 5700 includes multiple 10-Gigabit Ether­net and 1-Gigabit Ethernet fiber and copper interfaces.

CEO Outlook 2023

CRN, SonicWall News: One of the biggest opportunities we will be tackling with our partners is providing a broader set of unified and cost-effective solutions that fully secure the evolving network perimeter. For many of our partners and customers, 2023 will represent a period of cautious and informed investment in IT and security – customers will demand more bang for their security buck.

Industry News

Ring Refuses to Reveal Truth About Russian Ransomware Rush

A Russian ransomware gang has claimed to have breached the Amazon-owned video security company Ring. The ransomware gang, known as ALPHV, has so far failed to provide evidence of the supposed breach, and Ring has remained tight-lipped concerning the matter. A Ring spokesperson did tell TechCrunch that they had no indications of a ransomware attack but declined to comment on whether or not they had the ability to see if data had been exfiltrated from their networks. Ring did tell Vice that they were aware of a potential incident with a third-party vendor, but they didn’t say the name of the vendor. Ring said the vendor did not have access to customer records.

Researchers Utilize Computer Speakers and Smartphone Microphone to Steal Data

At Korea University in Seoul, South Korea, researchers have recently discovered that a new channel attack called CASPER is capable of transferring data from air-gapped computers to a microphone through the air. An air-gapped computer is a computer that is not physically capable of connecting to an external network or device, so this development could be concerning for those using air-gapped computers to store their most sensitive data. The attack utilizes the computer’s internal speakers to emit a high-frequency soundwave that cannot be heard by human ears but can be detected by microphones – including a smartphones microphone – up to 1.5 meters away. The high-frequency audio transfers data using binary or morse code at a rate of 20 bits per second. Similar attacks have been seen previously, but those attacks utilized external speakers. Air-gapped computers typically don’t have external speakers, but they do usually still have internal speakers to emit sounds such as boot-up beeps or other information-conveying beeps. While this type of attack may seem far-fetched, Bleeping Computer states that such attacks have been successfully carried out in the past, such as the Stuxnet worm targeting Iran’s nuclear enrichment facility and others. The malware utilized in this attack can target specific files in the system from hardcoded lists, and it can exfiltrate the data from those files. The malware could also be used for keylogging. The university researchers did share ways to defend against such an attack, with the simplest method being to simply remove internal speakers from any air-gapped computers.

Microsoft Alerts Users to Millions of Phishing Emails Being Sent Out Daily

An increasing amount of cybercriminals are using an adversary-in-the-middle (AiTM) phishing kit to steal the passwords and cookies of users around the world. In an AiTM phishing attack, threat actors usually place a proxy server between the user and the website, and the proxy server is where the theft takes place. According to Hacker News, these attacks can be more effective because they’re able to get around things like multi-factor authentication (MFA) and time-based one-time passwords (TOTPs). The Microsoft Threat Intelligence team is monitoring the situation and tracking the cybercriminals who are orchestrating the attack. The threat actors developing the phishing kit are known as DEV-1101, and they are responsible for multiple phishing kits on the dark market. Microsoft has seen millions of phishing emails per day from the threat actors who have purchased the kit from DEV-1101. Organizations should consider phishing-resistant authentication methods to help thwart this type of attack.

Phony ChatGPT Chrome Extension Steals Facebook Accounts

A fake ChatGPT browser extension is making its way around Chrome, and it has the ability to take over Facebook accounts and even create administrator accounts. The goal of the extension is apparently to hijack high-profile Facebook business accounts and then run paid advertisements on the dime of the businesses. Google pulled the extension, named “Quick access to ChatGPT”, on March 9, 2023, but it amassed 2,000 installations per day in its short time on the Chrome Web Store. According to Hacker News, the viral success of OpenAI’s ChatGPT has led threat actors to capitalize by creating fraudulent apps and extensions. Users must be wary of the sources of the extensions and apps they choose to install.

YouTube Videos Created by AI Fake Tutorials, Spread Malware

Artificial intelligence is being used to create YouTube videos that use an infostealer malware to find users personal data on their devices. These videos are posed as tutorials for programs like Photoshop, AutoCAD, Premier Pro and more. Dark Reading states that security researchers have determined that cybercriminals are using programs like Synthesia and D-ID to produce phony personas that are intended to exude a sense of trustworthiness with users all around the world. It’s currently unclear how large of an impact these videos are having on cybercrime as a whole, but it’s yet another example of artificial intelligence being used in a nefarious way.

SonicWall Blog

SonicWall Data Shows Attacks on Schools Skyrocketing – Amber Wolff

Recognizing Outstanding Partner and Distributor Performance in 2022 – Bob VanKirk

Latest Threat Intelligence Reveals Rising Tide of Cryptojacking – Amber Wolff

Latest Threat Intelligence Tracks Shifting Cyber Frontlines in 2022 – Amber Wolff

New SMA Release Updates OpenSSL Library, Includes Key Security Features – Jai Balasubramaniyan

SonicWall Recognizes Bill Conner for Transition of Business, Impact on Cybersecurity Industry – Bret Fitzgerald

SonicWall’s Jason Carter and Matt Brennan Earn 2023 CRN Channel Chief Recognition – Bret Fitzgerald

Can You Catch All the Phish? Take Our New Phishing IQ Quiz and Find Out! – Ken Dang

Celebrating 2023 With Expanded “3 & Free” – Matt Brennan

The Art of Cyber War: Sun Tzu and Cybersecurity – Ray Wyman

Talking Boundless Cybersecurity at the Schoolscape IT 2022 Conference – Mohamed Abdallah

SonicWall Included on the Acclaimed CRN Edge Computing 100 List for 2022 – Bret Fitzgerald

Curated cybersecurity news and trends from the industry’s leading bloggers and news outlets, for you from SonicWall.

It’s the first week of March, and the 2023 SonicWall Cyber Threat Report was released this week! SonicWall has been dominating the news cycle following its release. MSN quoted our CEO, Bob VanKirk, about the great need for cybersecurity among all businesses. ITPro cited data from the 2023 Threat Report. CRN quoted Bob VanKirk as well about 2022 ransomware numbers. Evening Standard cited the 2023 Threat Report’s cryptojacking data. The 2023 Cyber Threat Report has made a huge splash in the media and will continue to do so all year.

In industry news, TechCrunch had the lowdown on the major ransomware attack at Dish Network. Dark Reading shared details of the follow-up attack at LastPass. Hacker News had the scoop on the first UEFI bootkit to bypass Windows 11 Secure Boot, and Bleeping Computer reported on the Russian government banning use of certain foreign communication apps.

Remember to keep your passwords close and your eyes peeled — cybersecurity is everyone’s responsibility.

SonicWall News

Covert Cyberattacks on The Rise as Attackers Shift Tactics for Maximum Impact

HelpNetSecurity, SonicWall News: 2022 was the second-highest year on record for global ransomware attempts, as well as an 87% increase in IoT malware and a record number of cryptojacking attacks (139.3 million), according to SonicWall.

2023 Could Be the Biggest Ever Year for Cybercrime

TechRadarPro, SonicWall News: 2023 could very well be the biggest year ever for cybercriminals, new figures have claimed. According to SonicWall’s latest figures, cybercrime is on the rise across the board, but trends are slowly shifting which is something IT security teams should keep in mind. More precisely, hackers are opting for a “slow and low” approach, keeping stealthy while trying to achieve financially-motivated goals.

Spikes In IoT Malware, Cryptojacking Offset Decline in Ransomware In 2022

MSSP Alert, SonicWall News: SonicWall researchers recorded the second-highest year on record for global ransomware attempts but it was an 87% increase in Internet of Things (IoT) malware and a record number of cryptojacking attacks (139.3 million) that signaled a shift in the overall threat landscape in 2022, the company said in a new report.

Cybercrime Spiked In 2022 — And This Year Could Be Worse

Digital Trends, SonicWall News: Last year saw a massive spike in cybercrime, with some types of malicious digital activity rising by as much as 87%. It doesn’t bode well — but there were a couple of relative bright spots. That information comes from a new report published by cybersecurity firm SonicWall. It makes for interesting reading, especially since one of the biggest rises came from an unusual source — and one of the most feared types of malware saw a hefty drop.

Ransomware Attacks Plunged 48 Percent in US Last Year: SonicWall

CRN, SonicWall News: In a major reversal from prior years, the volume of ransomware attacks globally dropped by 21 percent in 2022, year-over-year, with a 48-percent decline in the U.S., SonicWall said in a new report Tuesday. It’s encouraging that we’re seeing a decrease” in ransomware attacks, SonicWall CEO Bob VanKirk said in an interview with CRN. At the same time, “the number of attacks still is staggering,” VanKirk said.

Ransomware Threat Surges as Brits Suffer Millions of Attacks In 2022

Evening Standard, SonicWall News: The scale of the threat posed to companies and consumers by cyberattacks was laid bare today in a new report which reveals global ransomware attempts hit their second highest year on record in 2022.

Cyber intrusion attempts and malware attacks climbed 19% and 2% respectively, according to the Global Cyberattack Trends report by SonicWall, while crypto-theft attacks jumped 43% to reach a record high. The volume of ransomware attacks was especially severe in the UK, climbing a staggering 112% in 2022, the report found, despite a 21% decrease in attacks worldwide.

Experts Spot Half a Million Novel Malware Variants in 2022

InfoSecurity, SonicWall News: Global malware detections increased 2% year-on-year (YoY) in 2022 to hit 5.5 billion, with never-before-seen variants surging 5%, according to SonicWall. The security vendor captured threat intelligence from its global SonicWall Capture Threat network, including one million security sensors, in order to compile its 2023 SonicWall Cyber Threat Report.

Ransomware Threat Surges as Brits Suffer Millions of Attacks In 2022

MSN, SonicWall News: Bob Vankirk, CEO of SonicWall, said: “The past year reinforced the need for cybersecurity in every industry and every facet of business, as threat actors targeted anything and everything, from education to retail to finance. While organizations face an increasing number of real-world obstacles with macroeconomic pressures and continued geopolitical strife, threat actors are shifting attack strategies at an alarming rate.”

State-Sponsored Hackers Are Diversifying Tactics, Targeting Small Businesses

IT Pro, SonicWall News: State-sponsored threat actors are increasingly shifting their focus towards SMBs and smaller enterprises, according to new research. While large enterprises, public services, and critical national infrastructure have traditionally been key targets for state-sponsored threat actors, SonicWall’s 2023 Cyber Threat Report predicted that groups will ‘diversify’ their tactics in 2023 to target SMBs and a “broader set of victims.”

Cybersecurity Predictions for 2023 – Things You Should Know

Utah Pulse, SonicWall News: SonicWall reports a 328% YoY increase in healthcare ransomware attacks in 2022, and healthcare and education are expected to be among the most targeted sectors in 2023. The expanding IoT footprint in these sectors is predicted to make them more vulnerable to digital attacks, increasing the risk to critical infrastructure.

The 20 Coolest Network Security Companies Of 2023: The Security 100

CRN, SonicWall News: Key offer­ings from SonicWall in the realm of next-gener­ation firewalls include the SonicWall NSa 5700, which utilizes a scalable hardware architecture designed to fit in a single rack-mountable unit. The high port density of the NSa 5700 includes multiple 10-Gigabit Ether­net and 1-Gigabit Ethernet fiber and copper interfaces.

CEO Outlook 2023

CRN, SonicWall News: One of the biggest opportunities we will be tackling with our partners is providing a broader set of unified and cost-effective solutions that fully secure the evolving network perimeter. For many of our partners and customers, 2023 will represent a period of cautious and informed investment in IT and security – customers will demand more bang for their security buck.

Industry News

Personal Data Stolen in Dish Network Ransomware Attack

Dish Network is experiencing a prolonged outage on its website, apps and customer support services following a ransomware attack last week. In a public filing, Dish said that the threat actors had successfully exfiltrated data from their servers that may contain personal information. TechCrunch spoke with several Dish Network customers who said they have not had TV service since last Thursday. No attackers have yet taken credit for the breach, but it’s suspected that the Black Basta ransomware gang is responsible.

LastPass Vault Data Lost in Follow-up Attack

LastPass has experienced another breach from the same threat actors that infiltrated their development environment in August 2022. According to Dark Reading, LastPass lost the decryption keys for a large amount of customer and encrypted vault data. The threat actors accessed the data by infiltrating the home computer of a LastPass DevOps engineer who had the data. The attack utilized a vulnerable media player on the engineer’s home computer. LastPass did make a statement reminding end users that their master passwords are not known or stored by LastPass, so they were not stolen in the breach.

BlackLotus UEFI Bootkit Malware Bypasses Windows 11 Secure Boot

In a first for Windows 11, a Unified Extensible Firmware Interface (UEFI) bootkit has bypassed Secure Boot. The UEFI bootkit is called BlackLotus, and is the first UEFI bootkit to pull off such a feat which makes it a danger to any system running Windows 11. BlackLotus was first sold in October 2022 and the seller did claim it was capable of bypassing Secure Boot. The seller also claimed it could disable security software. At a price of only $5,000, it’s a much more accessible tool for a broader range of cyber criminals. According to Hacker News, exploiting the Secure Boot vulnerability allows the attacker to execute arbitrary code during early boot phases which allows the attacker to wreak havoc on a user’s system. It’s not yet known exactly how the bootkit is deployed, but Microsoft will surely want to patch this vulnerability quickly and thoroughly.

Foreign Communication Apps Banned in Russian Government Organizations

Laws banning foreign messaging applications in the Russian government have started being enforced this week. Roskomnadzor, Russia’s internet control agency, announced the new restrictions this week. The services banned by the Russian government include Discord, Microsoft Teams, Skype for business, Snapchat, Telegram, Threema, Viber, WhatsApp and WeChat. As of now, the ban only applies to Russian government and state agencies. Russian citizens can still use the communication apps. According to Bleeping Computer, Roskomnadzor did not ban Zoom or the encrypted messaging app Signal.

SonicWall Blog

Latest Threat Intelligence Tracks Shifting Cyber Frontlines in 2022 – Amber Wolff

New SMA Release Updates OpenSSL Library, Includes Key Security Features – Jai Balasubramaniyan

SonicWall Recognizes Bill Conner for Transition of Business, Impact on Cybersecurity Industry – Bret Fitzgerald

SonicWall’s Jason Carter and Matt Brennan Earn 2023 CRN Channel Chief Recognition – Bret Fitzgerald

Can You Catch All the Phish? Take Our New Phishing IQ Quiz and Find Out! – Ken Dang

Celebrating 2023 With Expanded “3 & Free” – Matt Brennan

The Art of Cyber War: Sun Tzu and Cybersecurity – Ray Wyman

Talking Boundless Cybersecurity at the Schoolscape IT 2022 Conference – Mohamed Abdallah

SonicWall Included on the Acclaimed CRN Edge Computing 100 List for 2022 – Bret Fitzgerald

A New Era of Partnering to Win – Robert (Bob) VanKirk

Multiply Your Security with Multifactor Authentication – Amber Wolff