Ukraine appeared to blame Russia on Tuesday for a cyberattack, indicating the online networks of its defense ministry and two banks were overwhelmed in what is called a distributed denial-of-service.
An alert from CISA outlines how Russian state-sponsored cyber actors have targeted US defense contractors for information about weapons development, computer systems, intelligence-gathering technology, and a two-year campaign. The alert does not specify if classified information was obtained. Still, attackers have been able to “acquire sensitive, unclassified information, as well as CDC-proprietary and export-controlled technology,” the alert said, by focusing on “enterprise and cloud networks, prioritizing their efforts against the widely used Microsoft 365 (M365) environment.”
Google Cloud gave insight this week into Log4Shell – they are seeing 400,000 scans a day for vulnerable systems. The indication is that companies are “very much on top of this,” but this serves as a reminder that the vulnerability will remain a target.
In a survey conducted by Anchore during the Log4Shell breach, more than three in five companies were targeted by software supply chain attacks in 2021. The survey also found that more tech companies were significantly impacted by software supply chain attacks (15%) compared to other industries (3%).
Blackberry’s data says SMBs are the increased target, as small to medium-sized businesses (SMBs) face an average of 11 cyberthreats per day. According to the report, over 70% of SMBs have faced cyberattacks, and of those attacked, 60% are out of business within six months.
In the news for parents, video games too are space for hackers. Vice also digs into how scammers are within Roblox, hacking accounts and stealing virtual items for sale online. The term “beamed,” which is Roblox slang for getting hacked and your items stolen.
And in shifting tactics for business, the FBI has highlighted how virtual meeting platforms can be used to trick organizations into sending payments to the wrong account. One of three techniques outlined – using a virtual meeting where the criminal will insert a still picture of the CEO with no audio or “deep fake” audio and claim their video/audio is not properly working. They then instruct employees to initiate transfers of funds via the virtual meeting platform chat or in a follow-up email.
The headline feels like “global warfare conduct online, lock your doors” is appropriate. There’s a lot actionable here, from continued vigilance on Log4Shell to parents understanding their kid’s tech.
Let’s focus on one in particular – the use of deep fake technology to create virtual participants in meetings. There is where the process is going to be incredibly important. If one can’t trust even their online meetings, a lot starts to fail. Is the process specific to digital signatures? Identity verification to access corporate meetings? Distinct, non-email processes for approvals. The answer is yes….. and the solution involves clear design insight to make the tech work.