Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how a total of 118 new ransomware families emerged in the first half of 2018, but only 47 new ones debuted in the first six months of this year, according to Trend Micro’s 2019 Mid-Year security report. Also, read on about how Trend Micro was once again named a Leader in Gartner’s 2019 Magic Quadrant.

Read on:

Trend Micro Named a Leader in 2019 Gartner Magic Quadrant for Endpoint Protection Platforms

Trend was named a Leader in Gartner, Inc.’s 2019 Magic Quadrant for Endpoint Protection Platforms in evaluation of its Apex One endpoint security solution. Trend has been named a Leader in every Gartner Magic Quadrant for this category since 2002.

Three Common Email Security Mistakes that MSPs Make

MSPs can generate recurring revenue by being proactive about educating customers about email threats and how to defeat them—if they avoid three common mistakes: failing to educate customers, placing too much faith on end-user training and leaving service revenue on the table.

WannaCry Remains No. 1 Ransomware Weapon

According to Trend Micro’s 2019 mid-year security report, WannaCry remains the most commonly detected ransomware by far: about 10 times as many machines were found targeted by WannaCry in the first half of this year than all other ransomware variants combined. Bill Malik, vice president of infrastructure strategies at Trend Micro, discusses the prevalence of this ransomware and how it works.

TA505 at it Again: Variety is the Spice of ServHelper and FlawedAmmyy

TA505 continues to show that they intend to wreak as much havoc while maximizing potential profits. Just like in previous operations, this cybercriminal group continues to make small changes for each campaign such as targeting other countries, entities, or the combination of techniques used for deployment.

‘Heatstroke’ Campaign Uses Multistage Phishing Attack to Steal PayPal and Credit Card Information

Heatstroke demonstrates how far phishing techniques have evolved — from merely mimicking legitimate websites and using diversified social engineering tactics — with its use of more sophisticated techniques such as steganography. 

Hackers to Stress-Test Facebook Portal at Hacking Contest

Hackers will soon be able to stress-test the Facebook Portal at the annual Pwn2Own hacking contest, following the introduction of the social media giant’s debut hardware device last year. Introducing the Facebook Portal is part of a push by Trend Micro’s Zero Day Initiative, which runs the contest, to expand the range of home automation devices available to researchers in attendance.

Fortnite Players Targeted by Ransomware via Fake Cheat Tool

An open-source ransomware variant called “Syrk,” based on the source code of the Hidden-Cry ransomware, was found pretending to be a cheat tool that improves the accuracy of a player’s aim and provides visibility over other players’ location on the map. Upon infection, a ransom note will demand payment from victims in exchange for a decryption password.

Cybercriminal Group Silence Has Reportedly Stolen US$4.2 Million from Banks So Far

Contrary to their moniker, the Silence cybercriminal group has been reported to be actively targeting banks and financial institutions in more than 30 countries. Silence reportedly stole US$4.2 million from June 2016 to August 2019. 

US Cyberattack Damaged Iran’s Ability to Target Oil Tankers, Report Says

A database used by Iran’s paramilitary arm to devise attacks against oil tankers was wiped out by a US cyberattack in June, temporarily reducing Tehran’s means of targeting Persian Gulf shipping traffic.

Nemty Ransomware Possibly Spreads through Exposed Remote Desktop Connections

A new ransomware family dubbed “Nemty” for the extension it adds to encrypted files has recently surfaced. According to a report from Bleeping Computer, New York-based reverse engineer Vitali Kremez posits that Nemty is possibly delivered through exposed remote desktop connections.

Abuse of WS-Discovery Protocol Can Lead to Large-Scale DDoS Attacks

Security researchers have discovered that attackers can abuse the Web Services Dynamic Discovery (WS-Discovery) protocol to launch massive distributed denial of service (DDoS) campaigns. These researchers have issued a warning after seeing cybercriminals abuse the WS-Discovery protocol in different DDoS campaigns over the past few months.

Phishing Attack Tricks Instagram Users via Fake 2-Factor Authentication

Although 2FA remains a valid and highly useful tool, Instagram users should not be complacent and rely on it alone, especially when fake 2FA notifications can be used for malicious purposes. In this blog, Trend Micro recommends some best practices users can combine with their existing security tools to help protect against phishing.

Q&A: In a Cloud-Connected World, Cybersecurity is Key

Cloud computing is becoming a critical tool for business, in terms of storing an assessing data. With the increases use of the cloud comes greater security risks. Mark Nunnikhoven, vice president of cloud research at Trend Micro, assesses the solutions.

Will you be following Trend’s best protection practices when playing Fortnite or using Instagram? Share your thoughts in the comments below or follow me on Twitter to continue the conversation: @JonLClay.

The post This Week in Security News: Ransomware Campaigns Persist with WannaCry as Most Common appeared first on .

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how most respondents to a Trend Micro survey shared their concern for the risks in implementing DevOps. Also, read on about how Trend Micro uncovered a MyKings variant that had been hiding for roughly two years before it was discovered.

Read on:

How Do Threats Align with Detection and Solutions?

There are many different threats targeting many different areas of a corporate network. I built an interactive graphic to help others understand the full ecosystem of how security works across your network, how to detect threats and ultimately what solutions can be utilized in the different areas of networks to protect themselves and their systems and data.

XDR Is the Best Remedy as Attackers Increasingly Seek to Evade EDR

Greg Young, vice president of cybersecurity at Trend Micro, discusses how many enterprises don’t effectively manage their endpoints and how Trend Micro’s XDR solution is a more effective solution for endpoint management and dealing with evasive threats.

Nest Enrages Users by Removing Option to Disable Camera Status LEDs

Google just made good on one of the promises it made at I/O 2019 — it’s removing the option to disable camera status LEDs. Nest customers have responded with almost universal anger to the change. They’ll be able to dim the lights on Nest Cam, Dropcam, and Hello devices, but you won’t be allowed to turn them off while they’re recording.

The Sky Has Already Fallen (You Just Haven’t Seen the Alert Yet)

Rik Ferguson, vice president of security research at Trend Micro, discusses how the typical security operations center (SOC) of today is drowning in a volume of alerts. In the financial world, 60 percent of banks routinely deal with more than 100,000 alerts every day, with 17 percent of them reporting more than 300,000 security alerts, and this pattern is repeated across industry verticals.

Innovate or Die?

Bill Malik, vice president of infrastructure strategies at Trend Micro, discusses how a recent series of IT acquisitions and IPOs highlight a simple economic fact: companies that fail to keep up with the fast-paced innovation of technology can easily become targets for acquisition.

MoviePass Exposed Thousands of Unencrypted Customer Card Numbers

Movie ticket subscription service MoviePass has exposed tens of thousands of customer card numbers and personal credit cards because a critical server was not protected with a password. A massive, exposed database on one of the company’s many subdomains was found containing 161 million records at the time of writing and growing in real time.

The Path to Secure DevOps Initiatives: Bridging the Gap Between Security and DevOps

The growing demand for faster and more efficient software development brings DevOps to the fore, but not without disrupting the inner workings of production and security teams. In a survey commissioned by Trend Micro, majority of the respondents shared their concern for the risks in implementing DevOps.

FAKE APPS! Courtesy of Agent Smith

Early this month a new global Android malware campaign called Agent Smith was revealed to have compromised 25 million handsets across the globe including many in the U.S., serving as another reminder to users not to take mobile security for granted. Fortunately, users can make giant strides towards keeping the hackers at bay with a few easy steps.

Google Android Adware Warning Issued To 8 Million Play Store Users

Security researchers at Trend Micro have revealed that the Google Play Store hosted 85 apps ridden with adware. Worse still, these apps have netted more than 8 million downloads. The adware-ridden apps were posing as legitimate services focusing on gaming or photography. 

OVIC Finds PTV in Violation of Privacy and Data Protection Act 2014 in myki Records Disclosure

The Office of the Victorian Information Commissioner (OVIC) determined that the Public Transport Victoria (PTV) breached the Information Privacy Principle (IPP) under the Privacy and Data Protection Act 2014. The decision came after the PTV released data in 2018 that exposed more than 15 million myki cards’ “touch on” and “touch off” travel history data, which could be used to identify specific users.

BEC Scam Costing Almost US$11 Million Leads to FBI Arrest of Nigerian Businessman

The CEO of the Invictus Group of Companies, Obinwanne Okeke, has reportedly been arrested by the U.S. Federal Bureau of Investigation (FBI) after he was accused of conspiracy to commit computer and wire fraud. The FBI investigation into Okeke was initiated after a victim of a business email compromise (BEC) scam informed the FBI that it had been defrauded of nearly US$11 million.

22 Texas Towns Hit with Ransomware Attack In ‘New Front’ Of Cyberassault

State officials confirmed this week that computer systems in 22 municipalities have been infiltrated by hackers demanding a ransom. A mayor of one of those cities said the attackers are asking for $2.5 million to unlock the files. The Federal Bureau of Investigation and state cybersecurity experts are examining the ongoing breach, and officials have not disclosed which specific places are affected.

Uncovering a MyKings Variant with Bootloader Persistence via Managed Detection and Response

MyKings alone has already infected over 500,000 machines and mined an equivalent of US$2.3 million as of early 2018. The timing of the attack we recently found could indicate that it may have been part of the campaign we previously found in 2017.

Asruex Backdoor Variant Infects Word Documents and PDFs Through Old MS Office and Adobe Vulnerabilities

Since it first emerged in 2015, Asruex has been known for its backdoor capabilities and connection to the spyware DarkHotel. However, when we encountered Asruex in a PDF file, we found that a variant of the malware can also act as an infector, which inject code in Word and PDF files respectively.

They’re Attacking the Brain of Your Smart Home (or Office)

A smart device that turns your lights off when you leave or checks to see if you left any doors or windows unlocked may be convenient, but adding and connecting more smart items to your house can cause new and unexpected problems and let the bad guys in. Greg Young, Trend Micro’s vice president of cybersecurity, discusses various ways to protect smart homes from these kinds of cyber attacks.

Are you up to speed on how security works across your network, how to detect threats and what solutions can be utilized in different network areas to protect systems and data? Share your thoughts in the comments below or follow me on Twitter to continue the conversation: @JonLClay.

The post This Week in Security News: DevOps Implementation Concerns and Malware Variants appeared first on .

Leadership. It’s a weighty term, although frequently it is used too lightly and all too often it’s a self-declared position. We believe, leaders can come and go, and leadership can be fleeting depending on the factors for long term success.

It is for all these reasons, that we are proud, not only to be in a Leader’s position in the 2019 Gartner® Magic Quadrant for Endpoint Protection Platforms[1] (EPP), but to have been named a Leader by Gartner in this category since 2002[2].

We believe that true leadership is sustained leadership with a proven track record of consistent strength in vision and execution.

It has been a transformative period for the EPP market with waves of innovation along the way. We believe, the difference with Trend Micro as a Leader, is that new techniques and capabilities are additive to our solution value, they are not the sum of it.

We’ve been able to build out our endpoint offering by continuously adding to the wide range of threat detection & response capabilities, along with investigative features as an innate part of a single-agent solution, simplifying deployment and enabling integrated workflows. This provides a balanced and comprehensive approach to endpoint security, which is imperative given the diversity in the threat landscape.

Job one is detecting and blocking as many endpoint threats as possible without manual intervention. The more threats you automatically prevent or stop, the fewer you need to investigate and respond to. That point can’t be overlooked or undervalued, although it often is.

When threats get through, you need actionable insight and an investigative toolset for hunting and sweeping activities, patient zero identification, and root cause analysis covering the use cases most needed and most leveraged.

The market continues to be excited about Endpoint Detection and Response (EDR), and we are strongly committed to delivering an effective solution in this regard; however, we believe effectiveness is not just about deepening the capabilities (although we are doing that), but by also delivering more than what EDR alone is designed to do.

That is why we are committed to going beyond the endpoint, with XDR.

For example, we recently introduced the capability to combine email and endpoints in the investigation of a detection, enabling you to trace a root cause analysis back into email (#1 attack source) to understand who else received the email or has a malicious file in their Office365 or Gmail inbox. Containing the threat and stopping the spread gets easier when you are looking beyond the endpoint — something you can’t do with EDR alone.

Our broader XDR strategy provides customers a means to further integrate and extend their detection and response capabilities across email, endpoints, servers, cloud workloads, and networks in a single platform and/or via a managed service.  With XDR, you can clearly visualize the overall security posture and effectively hunt, detect, analyze and respond to threats across security layers. Leveraging our market-leading products like Apex One (endpoint) Deep Security (server/cloud workloads), Deep Discovery and TippingPoint (network) and Cloud App Security (messaging and collaboration), XDR offers expert security analytics for alert correlation, and consolidated visibility and investigation of events. The key value of XDR is that it can connect minor events from different security silos (like EDR) to detect more complex attacks that would have otherwise remained unnoticed. You can learn more about XDR here.

The truth is that for many companies, the capabilities of the detection and response tools often exceed their capacity to use them due to time and resource limitations. Thus, a managed service is a great option. Trend Micro’s Managed XDR service can take the burden off of constrained teams, and also offers customers an opportunity to use the service for one or a multitude of security vectors – endpoint, network, servers & cloud workloads, email – for a single source of detection and response. The more sources to correlate, the better the insight – that’s the XDR advantage.

We believe XDR is another proof point of our deep-seated commitment to our ongoing evolution and innovation. This is how we’ve stayed current, relevant and effective over the years.

At the end of the day, the endpoint is extremely important to a company’s defenses and thus demands a strong solution. That’s why having confidence you are making a reliable choice for endpoint protection, now and over the long term, is imperative.  In a market that is changing, amid a vendor landscape that is noisy and confusing, that can be difficult. That’s why third-party evaluations like the Gartner Magic Quadrant are important, along with independent testing and POCs.

Get the full report here: https://ift.tt/1S5aJ97

Disclaimer:

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Gartner, Magic Quadrant for Endpoint Protection Platforms, 20 August 2019, Peter Firstbrook, Dionisio Zumerle, Prateek Bhajanka, Lawrence Pingree, Paul Webber

[1] Gartner “Magic Quadrant for Endpoint Protection Platforms,” by Peter Firstbrook, Lawrence Pingree, Dionisio Zumerle, Prateek Bhajanka, Paul Webber, August 2019

[1] Under the names of “Magic Quadrant for Endpoint Protection Platforms,” and previously, “Magic Quadrant for Enterprise Antivirus”

(Enterprise Antivirus 2Q02 MQ: Room for Improvement, Magic Quadrant for Enterprise Antivirus, 1H03, Magic Quadrant for Enterprise Antivirus, 2006,  “Magic Quadrant for Endpoint Protection Platforms” from 2007 onwards)

The post Trend Micro Named A Leader in 2019 Gartner Magic Quadrant for Endpoint Protection Platforms appeared first on .

As new mobile malware sweeps the globe, here’s how to keep your device secure.

We’re spending more and more of our lives online and for most of us the door to this digital world is our smartphone. It’s the first thing we look at when we wake up and the last thing we check at night. It’s where we do our banking and shopping, where we hang out with friends, play games to pass the time, post status updates and share photos. It’s where we watch TV, hail cabs and even consult our local doctor.

There’s just one problem: the bad guys know this and they’ve become highly skilled at making money off the back of our reliance on mobile devices. Early this month a new global Android malware campaign called Agent Smith was revealed to have compromised 25 million handsets across the globe including many in the US.

It should be another reminder to users not to take mobile security for granted. Fortunately, with a few easy steps you can make giant strides towards keeping the hackers at bay.

What is Agent Smith?

Remember the malignant agent/virus antagonist to Neo in The Matrix? Well, Agent Smith is the latest in a long line of malware campaigns designed to infect consumers’ mobile devices. It begins life embedded inside legitimate-looking applications like photo apps, gaming titles and/or adult-themed software. These are found more on popular third-party marketplaces such as 9Apps, rather than the official Google Play store, though it showed up there too.

Once a user installs one of these booby-trapped apps, the malware will get to work, exploiting vulnerabilities in the Android operating system. It extracts a list of all the legit apps that the user has installed on their phone and then sets about replacing them with identical-looking but malicious versions.

How does it affect me?

If you’re unlucky enough to have your device infected with Agent Smith, it will then go on to hijack your apps to show unwanted ads – thereby generating the hackers money. Although this doesn’t sound too catastrophic for the victim, there is the potential for the attack to get much worse. Researchers have claimed that the same malware could be used to steal sensitive information like online banking credentials from an infected device.

As of early July, Agent Smith had already infected over 302,000 mobile devices in the US. The number may be even higher today. It’s one of the biggest threats seen so far this year, but it’s by no means the only one. Attackers are always looking for ways to get malware onto consumers’ devices, and in so doing:

How do I stay safe?

Google is getting better at preventing apps loaded with hidden malware from being published on its official Play Store, but there are still occasions when some sneak through. The hackers behind Agent Smith were found to have hidden malware elements on 11 apps listed on Google Play. Two of them had already reached 10 million downloads by the time Google was notified and they were withdrawn.

App downloads are also only one of several avenues where your mobile device could be at risk of attack. Others include via malicious text or IM messages, public Wi-Fi networks that you might be sharing with hackers, and even lost or stolen devices.

Here’s a quick rundown of some key steps to stay safe:

How can Trend Micro help?

The last recommendation is non-trivial. Trend Micro offers customers comprehensive anti-malware capabilities via Trend Micro Mobile Security (TMMS), which provides protection from malicious apps via the Mobile App Reputation Service (MARS).

With Agent Smith, there are two malicious parts: the Agent Smith malware itself and the doppelganger apps that it creates on victim devices to replace the legitimate ones. MARS/TMMS detects both. On Google Play, the MARS/TMMS pre-install scan will detect Agent Smith before it installs. (This same function will prevent you from downloading other malicious apps to your device.) Otherwise, both Agent Smith (installed from a 3^rd-party store) or the doppelganger apps it creates will trigger the real-time scan in MARS/TMMS and warn you the apps are not safe, so you can delete them from your device.

Among its other features, Trend Micro Mobile Security also:

Used in conjunction with Trend Micro Password Manager, for securing and managing your passwords, and Trend Micro WiFi Protection, for keeping you save on public WiFi, Trend Micro Mobile Security can help keep your mobile device—both you and your identity—safe from threats like Agent Smith and countless others.

The post FAKE APPS!—courtesy of Agent Smith appeared first on .

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about ever-increasing amounts of phishing campaigns and how Trend Micro caught 2.4 million attacks of this type — a 59% increase from 1.5 million in the second half of 2018. Also, read millions of sensitive biometric records were found exposed in a massive data breach involving a major biometric security platform.

Read on:

August Patch Tuesday: Update Fixes ‘Wormable’ Flaws in Remote Desktop Services, VBScript Gets Disabled by Default

Microsoft released updates to patch 93 CVEs, along with two advisories, in this month’s Patch Tuesday. The bulletin patches issues in Azure DevOps Server, Internet Explorer, Microsoft Office, Microsoft Windows, Visual Studio and more. The patches address 29 vulnerabilities rated Critical and 64 that were rated Important, and a total of 21 CVEs were disclosed through the Zero Day Initiative (ZDI) program.

Over 27.8M Records Exposed in BioStar 2 Data Breach

About 23 GB worth of data consisting of 27.8 million sensitive biometric records were found exposed in a massive data breach involving biometric security platform BioStar 2, which provides thousands of companies with biometrics security in order to restrict access to buildings and other private areas.

New Tech: Trend Micro Inserts ‘X’ Factor Into ‘EDR’ – Endpoint Detection and Response

While endpoint detection and response (EDR) is one of the most significant advancements made by endpoint security vendors in the past six years, enterprises need more. Trend’s COO Kevin Simzer discusses these needs and Trend Micro’s new solution to meet them: XDR.

Report: Huge Increase in Ransomware Attacks on Businesses

According to a report by Malwarebytes, there has been a 363% year-over-year increase in the first half of the year. Aside from businesses, there has also been a greater number of ransomware attacks targeting different public sectors and local governments since the start of 2019.

Customer Perspective: Catching the Thief Lurking in the Shadows with EDR and MDR

Organizations want more visibility, enriched by data, into every nook and cranny of their IT infrastructure. The industry is decidedly moving towards XDR, a form of data-powered defense that provides omnipresent, nuanced visibility into attacks.

Hackers Can Turn Everyday Weapons into Acoustic Cyberweapons

A researcher found that writing custom malware that can induce embedded speakers to emit inaudible frequencies at high intensity or blast out audible sounds at high volume. Those aural barrages can potentially harm human hearing, cause tinnitus or have psychological effects and highlight the potential for acoustic malware to be distributed and controlled through remote access attacks.

Cyberattack Lateral Movement Explained

Trend’ VP of Cloud Research, Mark Nunnikhoven, explains the concept of lateral movement, which

refers to the techniques cyber attackers use to progressively move through a network post-breach as they search for the key data and assets that are ultimately the target of their attack campaigns.

Cloud Atlas Group Updates Infection Chain with Polymorphic Malware to Evade Detection

Recently observed by security researchers, this malware campaign uses a polymorphic HTML application (HTA) and a polymorphic backdoor to evade detection. As in its previous iteration, the threat routine begins with phishing emails to high-value targets.

BGP Hijackings Take on New Meaning in Cybersecurity Climate

The Border Gateway Protocol is vulnerable to malicious actors — and as of right now, little can be done about it from a security perspective, although there have been attempts to make it more reliable. Trend Micro’s Mark Nunnikhoven, VP of cloud research, discusses BGP’s reliability and threat risk.

The Rising Tide of Credential Phishing: 2.4 Million Attacks Blocked by Trend Micro Cloud App Security in 2019 1H

Credential phishing continues to be a bane for organizations. In the first half of 2019, the Trend Micro Cloud App Security solution caught 2.4 million attacks of this type — a 59% increase from 1.5 million in the second half of 2018.

Securing the Industrial Internet of Things: Protecting Energy, Water and Oil Infrastructures

Given the expected expansion of industrial internet of things (IIoT), this guide discusses the possible security risks, threats, and scenarios that cybercriminals can abuse to compromise the energy, water, and oil industries. Also included are recommendations on how to defend against these attacks based on Trend Micro (TM) research.

Anatomy of an Attack: How Coinbase was Targeted with Emails Booby-Trapped with Firefox Zero-Days

Coinbase’s chief information security officer published an incident report covering the recent attack on the cryptocurrency exchange, revealing a phishing campaign of surprising sophistication. The thwarted attack began with email messages on May 30 to more than a dozen Coinbase employees that appeared to be from Gregory Harris, a research grant administrator at the University of Cambridge in the UK.

Back-to-Back Campaigns: Neko, Mirai, and Bashlite Malware Variants Use Various Exploits to Target Several Routers, Devices

Within a span of three weeks, our telemetry uncovered three notable malware variants of Neko, Mirai, and Bashlite. These malware variants enlist infected routers to botnets that are capable of launching distributed denial of service (DDoS) attacks.

Analysis: New Remcos RAT Arrives Via Phishing Email

In July, our researchers came across a phishing email purporting to be a new order notification, which contained a malicious attachment that leads to the remote access tool Remcos RAT. This attack delivers Remcos using an AutoIt wrapper that incorporates various obfuscation and anti-debugging techniques to evade detection, which is a common method for distributing known malware.

Are you up to speed on our recommendations to avoid possible security risks, threats, and scenarios that cybercriminals can abuse to compromise the energy, water, and oil industries? Share your thoughts in the comments below or follow me on Twitter to continue the conversation: @JonLClay.

The post This Week in Security News: Phishing Campaigns and a Biometric Data Breach appeared first on .

There are many different threats targeting many different areas of a corporate network. Have you ever wondered how those threats are stopped? What threats impact which areas of a network? What technology detects and blocks those threats? I wanted to build an interactive graphic to answer those questions.

This interactive infographic can help you understand the full ecosystem of how security works across your network, because just learning about the different threats is not enough. People need to also understand how to detect these threats and ultimately what solutions they can utilize in the different areas of their network to protect themselves and their systems and data. Now you can do all of this in one graphic that will lead you through the whole journey of discovery.

As you can see in the above graphic, the user can select different areas of their network and within each area, you can dive into the different threats targeting that area. Each threat links to our Glossary of Terms with a definition. Below you see the different threats targeting email.

As you select each threat, a pop-up window will show you all the different technologies used to detect this threat. For each technology, you can mouse over the link and a pop-up will explain how that technology works.

Finally, you will also have links to the different Trend Micro solutions that use these technologies to protect your organization from specific threats. This interactive graphic can give you a nice way to link threats to detection/protection technologies to solutions and hopefully will help you better understand the extensive breadth of capabilities to protect your organization. Go ahead and spend some time using this interactive infographic and feel free to share with your friends and colleagues.

The post How Do Threats Align With Detection And Solutions? appeared first on .

Real enterprises are messy places. One messy reality is that enterprises don’t manage all their endpoints. A smart colleague turned me onto using the % of endpoints and servers managed as a prime security metric.

On one end of the spectrum are places like universities that maybe manage 10% of the endpoints on their network. On the other end are places like some large banking and R&D companies that can manage about 98 or 99%. A financial services company that was spending millions of dollars on getting from 96% to achieving 98%, using the very good reasoning that they were “cutting their biggest security problem in half” rather than “2%, meh.” So even the very best enterprises can have unmanaged endpoints that can be more easily exploited than ones with a security agent deployed on them. A lot of the advanced security we’ve been delivering on the last few years has been focused on this problem.

EDR s an example of how stealthy or evasive attackers can be better uncovered than with traditional endpoint protection. EDR is great for endpoints they are on. Ian Lee of NTUC gives a killer example of uncovering stealthy attacks using EDR and MDR here.

But most of EDR’s capabilities are for endpoints they are on: ones they manage. Sure there’s some herd-immunity with EDR that the greater number of managed endpoints the harder it is for an attacker to move laterally or deeper. But more capable, patient, and stealthy attackers are getting better at being evasive, knowing that EDR may be or is deployed. Mark Nunnikhoven does a great job in this post talking about lateral movement.

EDR can only go so far on its own to help spot attacks that are exceptionally low and slow, and/or using unmanaged endpoints. Endpoint security needs to step outside the endpoint silo to keep step with advanced attackers. An attack using many hops could see movement between managed endpoints, IoT, email, network components, containers and cloud-based servers over the course of many months. The delivery and reconnaissance could involve multiple protocols, emails, payloads, files, and credentials. Pulling together the tenuous and ephemeral threads of such an intentional attack needs more modern tools, rather than hoping we stumble on a supply of highly advanced threat hunters.

Pulling together deep security information from across your enterprise is what is needed to face off against such advanced and intentionally evasive attacks. XDR is intended to be that security data lake of deeper enterprise infrastructure and security information than we’ve previously gathered in a single addressable pool and designed to be useful for threat hunters and analysts. In these posts here and here we talk about what XDR is and how it brings in more sources, such as network data.

In the game of measure-countermeasure that is cybersecurity today and tomorrow, XDR is the next evolutionary step in dealing with more evasive threats.

The post XDR Is The Best Remedy As Attackers Increasingly Seek To Evade EDR appeared first on .

The recent series of IT acquisitions and IPOs highlight a simple economic fact: companies that fail to keep up with the fast-paced innovation of technology can easily become targets for acquisition.

Mark Twain put it this way: History doesn’t repeat itself, but it rhymes. As a former Gartner analyst, I find it irresistible to comment when our industry versifies.

During the 1970s and 1980s, Computer Associates executed a sound business model. They acquired mainframe software companies following a careful economic analysis. When a potential target company achieved more than half its revenues from maintenance contracts, when its stock price dropped as investors felt that long-term growth was slowing, and when the company had a significant cash hoard, CA would make its bid. Usually the acquisition would succeed. Following the takeover, CA would use the cash to repay the loan used to fund the acquisition. They would liquidate assets and cut expenses in research and development, sales, support, training, administration, marketing, and channel support. The resulting shell would improve the unit’s financial performance. The maintenance revenue stream would fund the next round of acquisitions.

During my time with Gartner, I worked with financial analysts at our sister company, Soundview Associates. They developed a spreadsheet incorporating the CA model, and used it to spot potential acquisitions. The same model guided Oracle during its acquisitions in the 1990s and 2000s. Now, a similar pattern seems to be guiding Broadcom.

Information security is a highly dynamic industry sector. As a non-functional strategy, information security typically gains less focus and resources than core new product functionality. As new capabilities enter the market, they introduce new attack surfaces and invite new attack vectors. Any viable information security vendor must sustain relevance in this volatile technology landscape. Without extensible products, a vendor cannot maintain a leadership position in the field. While start-ups proliferate, these offer a solitary point product to address a specific new vulnerability. This leaves the enterprise customer with an unpleasant set of options.

Most enterprise customers already have dozens of information security products in their portfolio. The option of adding yet another solution to the mix is unappealing. A clever start-up may have an insightful approach to tackling a novel vulnerability. Most prospective customers also weigh the additional complexity in their operations, the burden of training scarce staff on another product, the additional stream of alerts into their SEIM or SOC, and the discipline of managing a small vendor with problematic financial viability.

A second option is to wait for a larger information security vendor to acquire a start-up, and integrate the new technology into their existing portfolio. Integrating new products into an existing portfolio is vastly more complex than most customers appreciate. Typically, the process takes these steps. First, the new tool gets a new name. Then, its alerts flow into whichever SEIM or SOC the existing suite exploits. Next, the product’s agents (if any) are built into any pre-existing agents, minimizing the customer’s installation complexity. Later, product engineering merges the new back-end data store into the suite’s data store, possibly driving a re-engineering of that back-end store to handle the new information’s structure and analytical tools. Finally, the product engineering team has to bring the combined capabilities to par for both on-site installed customers and cloud-based SaaS customers. That step must include appropriate APIs for integration to MSPs, as most enterprise customers do not want to run complex SOCs and prefer to outsource specialists for diagnosis, support, and remediation.

Note that this stream of investment takes years. It draws down cash as the vendor invests in the “plumbing.” The financially successful strategy of “acquire – strip cost – monetize maintenance” discussed above prohibits costly investment in that plumbing, meaning most acquisitions never achieve much more than re-branding.

Consider mainframe job schedulers acquired by CA over the decades: CA-7 (once UCC-7), CA-AutoSys (formerly Paragon Global Technology via Platinum Technologies), CA-Workload Control Center (formerly Cybermation), and other offerings from Boole and Babbage and Legent. None of these products were integrated beyond branding: the cost would have rendered the acquisition unprofitable. (See https://www.itjungle.com/2007/04/10/fhs041007-story04/ for background on CA’s integration strategy in 2007.) Firms chasing the financially driven acquisition model cannot make long-term investments in their acquisitions.

The third customer choice is to invest heavily in a start-up. This mitigates the financial viability question. The customer/partner will drive product development. This guarantees the vendor addresses the customer’s needs quickly, but it does potentially distract the customer’s IT team from their primary mission, which is not running a start-up but handling the customer’s business problems.

The final customer choice is to find a vendor what invests in product integration at a deep level, for the long term, and delivers on that strategy. This necessitates the vendor prioritize product enhancement over short-term financial results. This business strategy is not a flashy as others, but it is deliberate, measured, and generates durable results. The vendors in this camp acquire companies not for their maintenance revenue stream or their cash and real estate holdings, not for their customer list, not for their geographical presence, not to monopolize a market, thwart a deal, nullify a competitor, and not for their patent portfolio. These vendors acquire companies for their current and future technology. They focus on technical capabilities and cultural fit – if the people don’t stay, the future of the product is lost.

Please note that I am a technology analyst, not a financial analyst. But I am proud to work for a company like Trend Micro. This timeline shows our history of innovation and integration: www.trendmicro.com/en_us/about/history-vision-values.html?modal=s4a-btn-see-infographic-06c573

Let me know what you think! Either comment below or @WilliamMalikTM

The post Innovate or Die? appeared first on .

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about ever-increasing amounts of phishing campaigns and how Trend Micro caught 2.4 million attacks of this type — a 59% increase from 1.5 million in the second half of 2018. Also, read millions of sensitive biometric records were found exposed in a massive data breach involving a major biometric security platform.

Read on:

August Patch Tuesday: Update Fixes ‘Wormable’ Flaws in Remote Desktop Services, VBScript Gets Disabled by Default

Microsoft released updates to patch 93 CVEs, along with two advisories, in this month’s Patch Tuesday. The bulletin patches issues in Azure DevOps Server, Internet Explorer, Microsoft Office, Microsoft Windows, Visual Studio and more. The patches address 29 vulnerabilities rated Critical and 64 that were rated Important, and a total of 21 CVEs were disclosed through the Zero Day Initiative (ZDI) program.

Over 27.8M Records Exposed in BioStar 2 Data Breach

About 23 GB worth of data consisting of 27.8 million sensitive biometric records were found exposed in a massive data breach involving biometric security platform BioStar 2, which provides thousands of companies with biometrics security in order to restrict access to buildings and other private areas.

New Tech: Trend Micro Inserts ‘X’ Factor Into ‘EDR’ – Endpoint Detection and Response

While endpoint detection and response (EDR) is one of the most significant advancements made by endpoint security vendors in the past six years, enterprises need more. Trend’s COO Kevin Simzer discusses these needs and Trend Micro’s new solution to meet them: XDR.

Report: Huge Increase in Ransomware Attacks on Businesses

According to a report by Malwarebytes, there has been a 363% year-over-year increase in the first half of the year. Aside from businesses, there has also been a greater number of ransomware attacks targeting different public sectors and local governments since the start of 2019.

Hackers Can Turn Everyday Weapons into Acoustic Cyberweapons

A researcher found that writing custom malware that can induce embedded speakers to emit inaudible frequencies at high intensity or blast out audible sounds at high volume. Those aural barrages can potentially harm human hearing, cause tinnitus or have psychological effects and highlight the potential for acoustic malware to be distributed and controlled through remote access attacks.

Cyberattack Lateral Movement Explained

Trend Micro’s VP of Cloud Research, Mark Nunnikhoven, explains the concept of lateral movement, which refers to the techniques cyber attackers use to progressively move through a network post-breach as they search for the key data and assets that are ultimately the target of their attack campaigns.

Cloud Atlas Group Updates Infection Chain with Polymorphic Malware to Evade Detection

Recently observed by security researchers, this malware campaign uses a polymorphic HTML application (HTA) and a polymorphic backdoor to evade detection. As in its previous iteration, the threat routine begins with phishing emails to high-value targets.

BGP Hijackings Take on New Meaning in Cybersecurity Climate

The Border Gateway Protocol is vulnerable to malicious actors — and as of right now, little can be done about it from a security perspective, although there have been attempts to make it more reliable. Trend Micro’s Mark Nunnikhoven, VP of cloud research, discusses BGP’s reliability and threat risk.

The Rising Tide of Credential Phishing: 2.4 Million Attacks Blocked by Trend Micro Cloud App Security in 2019 1H

Credential phishing continues to be a bane for organizations. In the first half of 2019, the Trend Micro Cloud App Security solution caught 2.4 million attacks of this type — a 59% increase from 1.5 million in the second half of 2018.

Securing the Industrial Internet of Things: Protecting Energy, Water and Oil Infrastructures

Given the expected expansion of industrial internet of things (IIoT), this guide discusses the possible security risks, threats, and scenarios that cybercriminals can abuse to compromise the energy, water, and oil industries. Also included are recommendations on how to defend against these attacks based on Trend Micro (TM) research.

Anatomy of an Attack: How Coinbase was Targeted with Emails Booby-Trapped with Firefox Zero-Days

Coinbase’s chief information security officer published an incident report covering the recent attack on the cryptocurrency exchange, revealing a phishing campaign of surprising sophistication. The thwarted attack began with email messages on May 30 to more than a dozen Coinbase employees that appeared to be from Gregory Harris, a research grant administrator at the University of Cambridge in the UK.

Back-to-Back Campaigns: Neko, Mirai, and Bashlite Malware Variants Use Various Exploits to Target Several Routers, Devices

Within a span of three weeks, our telemetry uncovered three notable malware variants of Neko, Mirai, and Bashlite. These malware variants enlist infected routers to botnets that are capable of launching distributed denial of service (DDoS) attacks.

Analysis: New Remcos RAT Arrives Via Phishing Email

In July, our researchers came across a phishing email purporting to be a new order notification, which contained a malicious attachment that leads to the remote access tool Remcos RAT. This attack delivers Remcos using an AutoIt wrapper that incorporates various obfuscation and anti-debugging techniques to evade detection, which is a common method for distributing known malware.

Are you up to speed on our recommendations to avoid possible security risks, threats, and scenarios that cybercriminals can abuse to compromise the energy, water, and oil industries? Share your thoughts in the comments below or follow me on Twitter to continue the conversation: @JonLClay.

The post This Week in Security News: Phishing Campaigns and a Biometric Data Breach appeared first on .

[Lightly edited transcript of the video above]

Hi there, Mark Nunnikhoven from Trend Micro Research, I want to talk to you about the concept of lateral movement.

And the reason why I want to tackle this today is because I’ve had some conversations in the last few days that have really kind of hit that idea bulb that people don’t truly understand how cybercriminals get away with their crimes in the organization. Specifically how they launch their attacks.

Now don’t get me wrong, this isn’t to blame on defenders. This isn’t to blame of the general public. I’m going to go with Hollywood’s to blame a little bit here, because we’re watching movies in Hollywood inevitably…you know the hackers in their dark hat and with no lighting, underground, Lord knows where they find these places to hack from and they are attacking directly through.

You see a bunch of text go across the screen and they penetrate through the first firewall, through the second firewall in into the data. That’s not how it works at all.

That’s ridiculous. It’s absurd.

[00:59]

It makes for interesting cinema, just like the red code/green code in CSI Cyber, but it’s not a reflection of reality and that’s a real challenge. Because a lot of people don’t have the experience of working with cybersecurity, working in cybersecurity, so their only perception is what they see either through media—you know TV, movies, books—or if they happen to run into somebody at in the industry. So there is an overwhelming amount of sort of information or misinformation.

Not even misinformation, just storytelling that tries to make it far more dramatic than it is. The reality is that cybercriminals are out for profit.

We know this time and time again—yes a bunch of nation-state stuff does happen but the vast majority of you are unaffected by it same with there’s

a massive amount of script-kiddie just sort of scanning random people with random tools that are just seeing what they can get away with that and

if you have solid, automated defenses that doesn’t really impact you.

What does impact you is the vast majority of organized cybercriminals who are out to make a profit. Trend Micro had a great  series and continues to have a great series on the Underground, the Digital Underground that shows just how deep these profit motivations go.

This is very much a dark industry. And with that in mind we come back to the concept of lateral movement.

[02:22]

If an attacker breaches into your systems, whether they come in like a fourth of all attacks do via email whether they come in directly through a server compromise, which is about half of all breaches according to the Verizon data breach investigation report or one of the other methods that is commonly used…then they start to move around within your network.

That’s lateral movement.

We talk about north/south traffic with the network, which is basically inside the network to outside of the network, so out to the the internet and back. East/west is within the network itself. Most defenses, traditional defenses worry about that north/south traffic.

Not enough worry about the east/west and it’s breaking down finally. We are getting rid of this hard perimeter. “It’s mine, I defend everything inside” …and realizing that this is actually how cybercriminals work. Once they’re inside they move around. So we need to defend in-depth and have really great monitoring and protection tools within our networks because of this challenge of lateral movement.

[03:23]

Let me give you a little easier to digest analogy. Most of us in a home have a grocery list and maybe once a week—maybe twice–we head to the grocery store and we try to get everything we want off the list and then we come back. That just makes sense.

That’s how we do it. Right? You would never think of going, “Okay. Number one of the list is ketchup. I’m going to drive to the store to get ketchup. I’m going to buy it and I’m going to come back home.

I’m going to look at item number two. I need a loaf of bread. I’m going to drive back to the store. I’m going to buy a loaf of bread and I’m going to come back and we can go to item 3, and I’m going to go and I’m going to come back. I’m going to…” That’s just ridiculous, right? That’s absolutely absurd and cybercrimals agree.

Once they’ve driven to the store. They’re going to buy everything that they need and everything that they see as an opportunity, right? They are really susceptible to those end caps and impulse buys… and then they’re going to leave.

This is how they attack our organizations.

We know that, because of the average time to detect a breach is around 197 days right now and that stat has fluctuated maybe plus or minus 15 days for the last decade.

We also know that it takes almost three…it takes two and a half to three months actually contain a breach once you discover it and the reason for all of this is lateral movement.

Once you’re in as a cybercriminal, once you’ve made headway, once you gained a beachhead or a foothold within that network you’re going to do everything you can to expand it because it’s going to make you the most amount of money.

[04:55]

What do you think? Let us know in the comments below, hit us up on social @TrendMicro or you can reach me directly @marknca.

How are you handling lateral movement? How are you trying to reduce it? How are you looking for visibility across all of your systems?

Let’s continue this conversation because when we talk we all get better and more secure online.

The post Cyberattack Lateral Movement Explained appeared first on .

A guest blog by Ian Loe, Senior Vice President, Cybersecurity, NTUC Enterprise Co-operative Limited

News flash: aided by time, persistence and smarts, advanced cybersecurity felons are leapfrogging traditional security systems to compromise confidential data. Realising this, we at NTUC Enterprise have been looking into new security technologies that help address these rising concerns. One of the key areas we have identified is how to better protect our endpoints and increase our visibility into what goes on within these devices.

Visibility, sharpened

With over 20,000 endpoints across PCs and IoT devices under the group to secure, and the potential to grow to 30,000 in the near future, we realise that incident detection and response is becoming critical. With so much at stake, we need a solution that provides constant surveillance – like a CCTV camera – to identify suspicious activities undertaken by a criminal.

Enter endpoint detection and response (EDR) technologies that can record and store queries, behaviors, and events on the endpoints. Picture this: a CCTV camera has the ability to capture movement across every corner and point of entry of a building. If someone surreptitiously breaks the lock of a door, disables the security alarm, or trespasses on commercial property, security personnel will get alerted by footage on these surveillance cameras.

Now let’s put that in the context of EDR. IT teams are able to go beyond just indicators of compromise and achieve high visibility into the nitty-gritty that’s going on. EDR also helps them to understand the multitude of different threats and attack types, allowing teams to correlate information and respond in a timely and effective manner.

For instance, EDR can help teams pinpoint how many devices in the organisation are using a particular piece of vulnerable software, or have accessed a bad domain. EDR stores these events in its memory repository and can identify the exact starting point of a criminal’s footprint to reconstruct the whole attack.

Swiftly detecting and removing a threat from an endpoint, or isolating an endpoint in a large network, can potentially thwart a large-scale infection down the line. This is what has drawn me to EDR in the beginning. By working with Trend Micro, my team can now understand the source, impact, and spread of advanced threats.

But technology is only part of the answer to the overarching situation.

Where are the cybersecurity personnel?

In the cyber world, detection and response is a set of processes that requires specialized skills and years of experience to handle. I think we can all agree on the fact that there is only one predictable thing about a cybersecurity professional’s day – its unpredictability.

Most of us in our field never have the same day twice, having to put on the hats of both defender and attacker. No security offering is complete without skilled intelligence to support it. In fact, an ESG survey reveals that 83 percent of organisations agree that using EDR effectively demands advanced security analytics skills. A lack of qualified candidates to fill these positions means that even if an organisation could justify the full-time staff, it is difficult to find them.

Put simply, the abundance of vulnerable businesses along with a lack of skilled cybersecurity personnel translates to more open doors for attackers to slip through – easily.

Managed detection and response (MDR) then comes into the picture to help organisations like ours ease the skills gap by providing 24/7 alert monitoring and threat-hunting capabilities from experienced cybersecurity professionals – powered by big data and AI technologies to detect anomalies faster.

For an organisation the size of NTUC Enterprise, the imperative is to achieve an effective security control posture, ensure compliance, and close known security gaps. By offloading the task to Trend Micro’s skilled MDR team, my team is able to focus on security projects that are important for the business and overcome staffing challenges.

For instance, I’m able to create custom alerts for significant assets within my environment when malicious or suspicious activity happens. Monitoring would be done via a follow-the-sun model within the region and in the US regardless of time zones, increasing responsiveness and reducing delays.

I’m also powered with insights from endpoint data that serves as the basis for root cause analysis – illuminating the path where the threat originally entered the endpoint (e.g. email, web, USB, application), and how it was executed.

Data – the brains behind visibility

By the end of the day, organisations want more visibility into every nook and cranny of their IT infrastructure. And what enriches visibility? Data. The industry is decidedly moving towards XDR, a form of data-powered defense that provides omnipresent, nuanced visibility into attacks.

We are more likely to be a victim of a cyber crime than any other criminal offence – let’s be prepared!

The post Customer Perspective: Catching the thief lurking in the shadows with EDR and MDR appeared first on .

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about continuing cybersecurity attacks targeting small governments. Also, read how XDR, Trend Micro’s newest solution, is more comprehensive than EDR and helps better meets the security needs of IT departments.

Read on:

 Why XDR Is A Big Deal, and is Different from SIEM and Platforms

Greg Young, vice president of cybersecurity at Trend Micro, explains the benefits of XDR’s data lake regarding SIEM (security information and even management) and platforms and how XDR is EDR for more than endpoint alone as it covers the entire IT stack of an organization.

Digital Skimmers: What Are They and How Can I Keep My Card Details Safe Online?

British Airways was recently hit with a whopping $228m regulatory fine after global customers had their card data stolen through a “digital skimming” attack. Trend Micro discusses what we need to know about digital skimmers and ways to stay safe.

Capital One Breach Raises Questions About Security and Cloud-First Strategies

As Capital One faces intense scrutiny from its recent data breach, its cloud provider Amazon Web Services is also facing regulator pressure on its security protocols. Trend Micro’s Mark Nunnikhoven discusses configuration and data leaks regarding S3, Amazon’s Simple Storage Service.

US$1.7 Million Stolen From North Carolina County After BEC Scammers Posed as Contractor

Cabarrus County, North Carolina, announced that it lost US$1.7 million after a series of email exchanges that began in November 2018. The public sector, particularly smaller government institutions, is becoming a frequent target of cybercriminals for business email compromise (BEC). 

California City Confirms Phone Line and Financial Data System Disruptions Caused by Ransomware

The ransomware was disguised as an invoice attachment in an email to city staff that, when opened, spread to the city’s network of computers, rendering several critical phone lines out of service and affecting the city’s payment and financial systems. The cybercriminals behind the attack demanded 75 bitcoins (approximately US$400,000 at the time) to return the city’s systems back to normal.

Russian Hackers Spy on Companies with Insecure Office Devices

In April, the hackers compromised VoIP phones, office printers, and video decoders across multiple corporations. Evidence of the attack includes a simple computer script installed on the affected IoT devices, which allowed the hackers to persist on the affected product. 

Flawed Office Printers Are a Silent but Serious Target for Hackers

In the course of three months, researchers found and reported 45 separate vulnerabilities from six of the largest printer makers — HP, Lexmark, Brother, Xerox, Ricoh and Kyocera — which could have allowed attackers to, among other things, siphon off copies of print jobs to an attacker-controlled server.

ENTSCRYPT aka GermanWiper, SYRK, and STOP Ransomware Variants Usher in August

Incidents of ENTSCRYPT aka GermanWiper, a fileless ransomware and wiper that makes file retrieval from an infected machine impossible, were reported two days before August began. Subsequently, incidents of SYRK and STOP, ransomware variants encrypting files on infected machines, were reported in the first few days of August.

Lord Exploit Kit Rises, Delivers njRAT and Eris Ransomware

NjRAT is a known information stealer and backdoor whose capabilities are constantly reworked or updated, given how it’s readily shared in the cybercriminal underground. The Eris ransomware was first seen in May being distributed through a malvertising campaign that employed the Rig exploit kit. 

AT&T Workers Took $1 Million in Bribes to Unlock 2 Million Phones, DOJ Says

According to the US Department of Justice, Muhammad Fahd bribed AT&T call-center employees to install malware and unauthorized hardware as part of a scheme to fraudulently unlock cell phones. Three former AT&T customer service reps in Bothell, Washington already pleaded guilty and agreed to pay the money back to AT&T.

Cybercrime Costs Continue to Soar More for Financial Firms than Other Companies

According to a report by Accenture and the Ponemon Institute, on the average, financial organizations with 5,000+ employees each lose US$18.5 million in direct cybercrime costs. This massive amount towers over the rest of the annual average of around $13 million (per industry) for all other industries.

Many Local Governments Face a Cybersecurity Awareness Gap (requires a device with Apple News)
According to a report from the International City Management Association, one in three local governments are oblivious about how often their information systems are attacked by would-be cybercriminals.

A Machine Learning Model for Detecting Malware Outbreaks Using Only a Single Malware Sample

Malware outbreaks pose a challenge for machine learning in security since samples are scarce during the critical first hours. Trend Micro recently conducted a collaborative study on how machine learning performs dynamic malware detection given a case where only a single malware sample is available.

5G is Here—and Still Vulnerable to Stingray Surveillance

Rollout of high-speed 5G mobile data networks has begun in some US cities. As researchers comb through the 5G standard to see if it delivers on lightning speeds and improved security, they’re finding that flaws meant to thwart surveillance devices, known as “stingrays,” need to be addressed.

Mirai Spawn Echobot Found Using Over 50 Different Exploits

A variant of the Echobot botnet was found using over 50 exploits that lead to remote code execution (RCE), arbitrary command execution, and command injection in internet of things (IoT) devices. The malware dropper was reportedly hosted on an open server.

Phishing: Watch Out for this New Version of Trojan Malware that Spreads through Malicious Word Documents

A new version of Ursnif is being pushed via malicious Word documents with the aim of stealing bank information and other credentials. Ursnif has become incredibly popular with cyber criminals in recent years, due to the source code being leaked online, enabling attackers to take advantage of it for free.

XDR Needs Network Data and Here’s Why

In one of my blogs this week, I explain how XDR is a better way to detect attacks within a network compared to EDR, since it is able to coordinate and collaborate threat intelligence and data across multiple threat vectors including endpoint (including mobile and IIoT), server, network, messaging, web, and cloud.

Are you keeping an eye out for malicious spam emails containing fake job applications to avoid a GermanWiper attack? Share your thoughts in the comments below or follow me on Twitter to continue the conversation: @JonLClay.

The post This Week in Security News: Ransomware Campaigns and Cryptocurrency Miners appeared first on .