GPT Goes Evil: How Criminals Are Leveraging LLM’s

How GPT’s Evil Twin Could Be Used in BEC Attacks A black hat AI tool called Worm GPT is being used to improve the efficacy of phishing emails. This is particularly troubling because a recent survey shows that 1 in 5 people fall for the fake, AI-generated emails, according to cybersecurity researchers. Researchers at SlashNext recently assessed WormGPT, an evil twin of OpenAI’s GPT AI model designed specifically for malicious...

Read More

Iowa Reports 3rd Large Vendor Breach This Year

Latest Breach Affects 234,000 Individuals; Involves Recent MCNA Insurance Co. Hack The state government of Iowa reported to federal regulators a third major health data breach since April involving a third-party vendor. The breach stems from an incident at dental health insurer MCNA Insurance Co. The Iowa Department of Health and Human Services reported hackers had compromised the protected health information of nearly 234,000 Iowa residents in...

Read More

Check Fraud Increases As Criminals Evolve

Check fraud increased 84% between 2021 and 2022, to 680,000 reported cases, according to the U.S. Department of the Treasury. Part of this growth stems from the fact that check fraud has become easier and more accessible. Cybercrime groups are openly hawking fraudulent check schemes on the Telegram messaging app. Check fraud started rising during the COVID-19 pandemic partially due to stimulus programs. Criminals made easy money by stealing...

Read More

Duo Security/Cisco Security Study Highlights 5 Most-Impactful Security Activities

A third-party security study commissioned by Duo Security/Cisco highlights the five most-impactful security activities for an organization. This study builds on one that was previously commissioned in 2020. Broadly speaking, the study focuses on two key security areas: prevention and response. For prevention, the two most impactful areas were having a current tech stack, and having that tech stack integrated with your security systems. They...

Read More

Lawsuit Alleges Iowa Health Center Sent PHI to Facebook

Latest in a String of Similar Proposed Class Actions Across Healthcare Industry The University of Iowa Health Care is facing a proposed class action lawsuit alleging it used website tracking pixels to transmit patient data to Facebook. The claim is the latest in a string of legal actions against other healthcare centers that pasted Facebook Pixel and similar online behavior tracking codes into their patient portals. Concerns, and lawsuits, over...

Read More

Success of EMV Chip leads to changing fraud landscape.

The enhanced security provided by EMV chips has significantly impacted card fraud at retail locations. The continued presence of the magnetic stripe as a backup leads to continuing fraud losses. However, as always, where there’s a will, there’s a way, and criminals continue to use a variety of ways to obtain and exploit card information. Several of these ways continue to rely on the presence of the magnetic strip in order to either obtain...

Read More

Most Common Connected Devices That Pose Risk to Hospitals

Study: Unpatched Nurse Call Systems, Printers and IP Cameras Top the List   Globally, hospitals are expected to deploy over 7 million medical devices by 2026 — or more than 3,850 devices per hospital, according to a study conducted last year by research firm Juniper Research. Many IoT device makers and users have lagged in updating these products to patch vulnerabilities, said Scott Singer, managing director of the University of...

Read More

China Exploits Zero-Day Vulnerabilities

Chinese Hackers and Others Increasingly Favor Unpatched Vulnerabilities According to security researchers, last year was another bonanza in zero-days for Chinese state hackers. They’re also predicting a permanent uptick in nation-state exploitation of yet-unpatched vulnerabilities. Data taken from original research by cybersecurity firm Mandiant and open-source reporting suggests zero-day exploitation fluctuates from year to year but is...

Read More

2022 Reported US Data Breaches Near-Record Highs

After Surge in 2nd Half, 1,802 Breach Notifications Issued in 2022; Over 440 Million Individuals Affected After a slow start, likely due to geopolitical factors, 2022 was another bumper year for data breaches in the United States. U.S. organizations issued 1,802 data breach notifications in 2022, affecting more than 400 million individuals, the Identity Theft Resource Center reports. That figure is just 60 breaches shy of the 1,862 breaches in...

Read More

Ransomware Profits Dip as Fewer Victims Pay Extortion As Funding From Ransoms Goes Down, Gangs Embrace Re-Extortion, Researchers Warn

Bad news for ransomware groups: Experts find that getting a payday is harder as the world fortifies against the onslaught of criminal malware. The good news is that more would-be victims are getting robust defenses in place, including well-rehearsed incident response plans, which make executing a successful attack harder. Also good news, law enforcement agencies mobilize earlier to assist victims, and by doing so, they’re learning better...

Read More

New Threats: BlackCat, Royal Among Most Worrisome Threats to Healthcare

Both Ransomware Groups Pose Serious Concerns to Sector, Warns HHS HC3 The U.S. government is warning that Healthcare entities should be on high alert for signs of the new BlackCat and Royal ransomware-as-a-service groups. On January 12th, the Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center issued a threat brief that warns that BlackCat conducts triple extortion, meaning it doesn’t just...

Read More

Android Banking Trojan Steals Through Mimicry

Trojan Impersonates More Than 400 Financial and Crypto Exchange Apps The Godfather banking Trojan is causing serious issues in the financial sector due to its ability to mimic the appearance of more than 400 applications, including leading financial and crypto exchange applications. So far, it has targeted institutions in 16 countries. Research from security intelligence firm Group-IB says the Godfather Trojan reappeared in September with...

Read More

Three Essential Defenses for Combating Ransomware

The number of successful ransomware attacks has doubled in the last 4 years. But there are concrete steps a healthcare organization can take to avoid costly — and potentially deadly — downtime and better protect themselves against an attack. 1. Move from on-premises servers and backups to the cloud. Doing so outsources availability, uptime, and security to the SaaS vendor and also facilitates better backup and recovery if something does happen....

Read More

Black Basta Using QBot Banking Trojan Malware to Target US-Based Companies

QBot Backdoor Opens Systems to Loading Cobalt Strike, Ransomware and Other Malware Researchers say the Black Basta group is dropping QBot malware — also called QakBot — in a widespread ransomware campaign targeting mostly U.S.-based companies. QBot malware is a banking Trojan primarily designed to steal banking data, including browser information, keystrokes and credentials. Its previous targets include JPMorgan Chase, Citibank, Bank of...

Read More

Healthcare Data Breaches Doubled in 3 Years

Targeting of Providers, Plans and Partners Since 2009, healthcare breaches have affected the personal information of 370 million people. Quick math says that’s more than the entire U.S. population, and that’s only counting the major breaches affecting 500 people or more. The situation is growing worse. In just the last three years, the volume and frequency of breaches have nearly doubled, from 368 in 2018 to 715 in 2021. And the nation is on...

Read More

Feds Warn Healthcare Over Cobalt Strike Infections

Red-Teaming Tool Poses Ongoing Risks When Used by Hackers, HHS Warns The Department of Health and Human Services’ Office of Information Security’s HC3 unit says attackers are weaponizing legitimate security tools. Russian hackers deployed Cobalt Strike’s command-and-control function during their attack against SolarWinds’ network management software. Hackers who earlier this year got into Cisco corporate IT...

Read More

Hackers Adopt APT-Like Capabilities

Cyberweapon-Grade Hacking Tools Pose Danger for Financial Sector Cyberthieves traditionally on the lower rung of hacking abilities now have access to nation-state-class malicious software, warn close observers of the criminal dark web. The appearance on criminal forums of tools capable of infecting a computer’s boot firmware or malware that evades antivirus detection is a consequence of years of state-sponsored development of cyber...

Read More

FBI Warns Healthcare Sector of Payment Scam Surge

Use of Social Engineering, Phishing to Divert Payments Cybercriminals are stealing multimillion-dollar payouts from healthcare payment processors by compromising user login credentials, the FBI warns the healthcare industry. In a recent alert, federal agents say they’ve received multiple reports of cybercriminals redirecting healthcare payments into their pockets. According to the FBI, cybercriminals used employees’ publicly...

Read More

Morgan Stanley’s Hard Drive Destruction Investment Failure

$155 Million in fines and settlements. While physical data breaches have declined substantially in the last 10 years, they still can happen without proper diligence. That lack of diligence and vendor oversight has led to a $35M fine for Morgan Stanley from the SEC and a class-action settlement of $60M over the same breach. This is in addition to a $60M fine from the Comptroller of the Currency in 2020. All for improperly decommissioning server...

Read More

Latest US Health Data Breaches Continue Ransomware Trend

Some 60 breaches affecting about 2.5 million individuals were added in July to the federal tally of major health data breaches. Those incidents continued a trend playing out in 2022: Large hacking incidents predominately involving ransomware attacks against providers, vendors, or both are responsible for an overwhelming amount of data theft. About 80% of the major breaches reported were related to hacking/IT incidents, and these breaches...

Read More