Hello, and welcome to the July edition of NewsScam. Come on Barbie, we should know better than breaching companies but sadly the new highly-anticipated film has found itself in the center of a phishing scam. Meanwhile, email security is causing trouble for US Ambassadors, Microsoft are searching for answers on how an inactive signing key was used, the MOVEit hack continues to cause more trouble, and post-quantum poses a cybersecurity risk in Europe. Whereas, the Biden-Harris Administration is trying to set the stage for a very ambitious cybersecurity strategy as they announced the “U.S. Cyber Trust Mark” program this month.
Come on Barbie, Let's go…Breach a Company
Stepping right into a Barbie world where Barbie fans worldwide are being warned about what's been described as an “extremely dangerous” version of the movie. Scammers are using the new Barbie movie to target unsuspecting victims by inserting malware into seemingly innocent emails, where readers think they are going to view a short film clip.
The Sun says hackers are using phishing emails that will trick recipients into sharing sensitive information. These emails have a malicious link or attachment that – instead of a download of the movie – actually installs malware, viruses, and malicious ads. These are dangerous, of course, because the phishing techniques used by cyber criminals can, and do, lead to very costly data breaches. So, while you may be eager to watch a quick Barbie movie clip, everyone here at GlobalSign will be tickled pink (sorry, not sorry!) if you remain cautious and avoid those nasty hackers!
Chinese Hackers Allegedly Hacks U.S Ambassador's Email
A very big story broke out on July 20th in the Wall Street Journal, to reveal that the email accounts of two high ranking U.S. officials involved with China were hacked in June. Both the U.S. Ambassador to China, Nicholas Burns, and the Assistant State Secretary for East Asia, Daniel Kritenbrink, were hacked by cyber criminals linked to Beiing.
According to the Wall Street Journal, it is believed the incident was damaging enough so it has compromised “at least hundreds of thousands of U.S. government emails". The entire event was disclosed by Microsoft earlier in the month. At this time not much information is available while an investigation looks into how the attack occurred – and what the results may be.
Microsoft Looks for Answers on How an Inactive Signing Key was Used in a Breach
While Microsoft assists the government, the massive software provider has another very issue to be concerned about, which is that it still doesn't know how Chinese hackers stole an inactive Microsoft account (MSA) consumer signing key used to breach the Exchange Online and Azure AD accounts of two dozen organizations, including government agencies.
Like the email hack of the U.S. Ambassador to China, this incident also seems to be linked to China. The hack was reported by U.S. government officials after the discovery of unauthorized access to several government agencies' Exchange Online email services. The company began investigating the incident on June 16th and found that a Chinese cyber-espionage group it tracks as Storm-0558 breached the email accounts of roughly 25 organizations (reportedly including the U.S. State and Commerce Departments).
The U.S. Gets More Serious About Safeguarding Smart Devices with “U.S. Cyber Trust Mark” Program
The Biden-Harris Administration announced a cybersecurity certification and labeling program aimed at helping Americans more easily choose smart devices that are safer and less vulnerable to cyberattacks.
The new Federal Communications Commission (FCC)-backed “U.S. Cyber Trust Mark” program would require smart products to meet certain thresholds, including software security support, for products such as smart refrigerators, smart microwaves, smart televisions, smart climate control systems, smart fitness trackers, and more. Major manufacturers and retailers like Best Buy, LG Electronics USA, Amazon and others have already announced commitments to the program.
When will MOVEit Finally Stop “Moving"?
Step right up to the MOVEit roulette wheel everyone, where it will stop, nobody knows! One of the biggest and most impactful stories during July, and really the entire summer, is the MOVEit file attack. The list of victims has now reached 455 is not showing any signs of slowing down. Impacted organizations range from Estee Lauder, the BBC, Putnam Investments and British Airways to Shell, Schneider Electric and Siemens Energy.
But it's certainly a very good time for Cl0p, because it may have made a whopping $100m according to SC Magazine. The attack by the ransomware gang began back in May, when the MOVEit cloud-hosting and file-transfer services from Progress Software was breached. Since that time, the company has issued numerous patches, doing what it can to control the damage.
Top European Agency Sounds Post-Quantum Attack Alarm
A new discussion paper says the EU must prepare for the likelihood of quantum cyber-attacks. The paper written by Andrea G. Rodriguez, lead digital policy analyst at the European Policy Centre, warns that advances in quantum computing puts Europe's cybersecurity at risk by rendering current encryption systems obsolete, creating new cybersecurity challenges. Rodriguez also emphasizes the urgent need to create an action plan before what is known as “Q-Day” -- the time when quantum computers become powerful enough to break existing cryptographic algorithms.
The European Union (EU) must prepare for quantum cyberattacks and adopt a new coordinated action plan to ensure a harmonized transition to post-quantum encryption to tackle quantum cybersecurity threats of the future. Rodriguez noted that “only a few EU countries have made public plans to counter emerging quantum cybersecurity threats, and fewer have put in place strategies to deal with them.” She puts the blame for this squarely on the EU and its lack of a policy around the issue.
But Wait, There’s More
Dutch man receives American military email for years due to typo; "Risk is real"– NL Times
UK battles hacking wave as ransomware gang claims ‘biggest ever’ NHS breach – TechCrunch
Ransomware criminals are dumping kids’ private files online after school hacks – Associated Press
Seven new gadgets added to riskiest connected devices list – SC Magazine
CISA issues warning for cardiac device system vulnerability – The Record
