Hello and welcome to the latest GlobalSign cybersecurity news round-up.
It’s been another banner week for data breaches. News about recently announced breaches, or previous incidents, were very much in focus, including Mercedes-Benz, Bank of America and EasyJet.
In non-data breach news, Microsoft's issued an advisory warning organizations worldwide to deploy protections against a new strain of ransomware, PonyFinal, which has been active over the last few months.
Finally, in the very much needed good news department, US officials arrested another member of Fin7 hacking group. The Ukrainian national was part of a spear-phishing campaign that enabled hackers to gain unauthorized access to victims' systems. Chalk up another win for the good guys!
Check out all of the featured stories below. Thanks, and have a fantastic weekend.
Top Global Cybersecurity News
The Hill (May 28, 2020) Google rolls out program to combat coronavirus scams
"Google on Wednesday rolled out a new program to combat scams related to the COVID-19 pandemic as attempted cyberattacks and phishing scams have spiked during the crisis.
The new 'Scam Spotter' program, co-created with the Cybercrime Support Network, recommends a three-step process for individuals to consider before handing over personal information through a phone call or email.
The program also tests the ability of an individual to spot a scam, gives examples of common ones such as those pretending to be from a government agency or bank and provides resources to report any scams to the Federal Trade Commission."
ZDNet (May 27, 2020) Microsoft warns about attacks with the PonyFinal ransomware
"Microsoft's security team has issued an advisory today warning organizations around the globe to deploy protections against a new strain of ransomware that has been in the wild over the past two months.
'PonyFinal is a Java-based ransomware that is deployed in human-operated ransomware attacks,' Microsoft said in a series of tweets published today.
Human-operated ransomware is a subsection of the ransomware category. In human-operated ransomware attacks, hackers breach corporate networks and deploy the ransomware themselves."
Computing UK (May 27, 2020) US officials arrest another member of Fin7 hacking group
"US federal officials have arrested another Ukrainian national for his alleged involvement in cyber campaigns run by notorious hacking group Fin7.
As per court documents released last week, Denys Iarmak was arrested from Seattle following his extradition from Thailand. He has been charged with conspiracy to commit wire and bank fraud, conspiracy to commit computer hacking, access device fraud, intentional damage to a protected computer, accessing a protected computer to commit fraud, and aggravated identity theft.
The complaint further reveals that Iarmak was part of Fin7's spear-phishing campaign, which enabled hackers to gain unauthorised access to victim computers."
InfoSecurity (May 27, 2020) UK Public Backlash Could Scupper #COVID19 App
"The UK’s plans to ease its COVID-19 lockdown have been thrown into doubt after half the public said it does not trust the government to handle their data collected via a key contact tracing app.
The app is a crucial part of the best practice “test, track and trace” strategy being rolled out around the world to help businesses and society get back to normal after weeks of social distancing.
'The NHS COVID-19 app automates the process of contact tracing,” noted the NHS. “Its goal is to reduce the transmission of the virus by alerting people who may have been exposed to the infection so they can take action to protect themselves, the people they care about and the NHS.'"
PYMNTS (May 27, 2020) BoA Experiences Potential PPP Application Data Breach
"Bank of America notified principal owners of a potential data breach after the bank uploaded the loan applications of some customers to a “limited access, controlled” Small Business Administration (SBA) test application platform, according to a letter to customers made public by the California attorney general’s office.
Bank of America said the platform was meant to let authorized lenders experiment with the procedure for sending the Paycheck Protection Program (PPP) applications to the agency before the actual submission process.
A 'limited number of other lenders and their vendors authorized by the SBA to participate in the program' might have been able to see application data for a 'limited time,' according to the bank. It said in the letter that there is 'no indication that your information was viewed or misused by these lenders or their vendor.'”
The Hill (May 26, 2020) Canada to lead global effort to counter election interference
"The government of Canada, alongside Microsoft and the Alliance for Securing Democracy, will lead a global effort to counter the use of cyberattacks and disinformation campaigns to disrupt elections, officials announced Tuesday.
Dominic LeBlanc, president of the Queen’s Privy Council for Canada, said that his nation would become one of the leads on countering election interference as part of the 2018 Paris Call for Trust and Security in Cyberspace.
'Canada’s leadership in the Paris Call will help build global expertise and understanding about the best way to combat online disinformation and malicious cyber activities in the context of election interference,' LeBlanc said in a statement."
Other Industry News
EasyJet faces £18 billion class-action lawsuit over data breach
Mercedes-Benz Data Leak Lesson: Lock Down Code Repositories
UK Universities Facing “Gaps In IT Infrastructure”
Capital One must hand over incident report to plaintiffs in data breach litigation
Sens. Ask FBI, CISA How to Protect COVID-19 Medical Research Data
What IoT is telling us about the trucking industry during Covid-19
15% of law firms hacked - losing clients due to cybersecurity concerns recommendations
What ransomware attacks on vendors mean for banks
Like what you’re reading? Head to the Subscriber form in the sidebar to get insightful GlobalSign content delivered directly to your inbox.
