Summary Bullets:

• In new research from telco operator Lumen, the provider posits that cybercriminals are taking advantage of the increase in connected home devices to use them to build out bot networks for DDoS and other application attacks.

• For the first time, banking was the most targeted sector for DDoS attacks, largely because a single day in September 2023 when Lumen helped one institution stave off 230 separate attacks.

In research Lumen released this week based on DDoS and application threat data captured on its mitigation platform, the operator observed interesting trends in the way hackers are applying more sophisticated, and in some cases, relentless tactics to flood targeted enterprise servers with malicious traffic and steal data. Threat actors are tapping connected consumer devices to launch denial of services incidents.

Summary Bullets:

• The recent rash of synthetic AI-driven deepfakes have business and government entities alarmed about potential security implications.

• The US National Security Agency (NSA) has issued guidance on how to detect images designed for malevolent purposes and what steps they can take to minimize damage from deepfakes.

Advances in generative artificial intelligence (AI) are offering promising use cases. But the technology can also be applied for more nefarious purposes. Cyber criminals can harness synthetic AI to spread misinformation, cause harm to organizations, and potentially to profit from their attacks. In one of the most recent high-profile cases, the actor Tom Hanks criticized a dental plan advertisement that used an AI-generated image of him without his consent. In a separate case, the “CBS Mornings” host Gayle King said a deepfake video using her likeness and voice to hawk a weight loss product was created and distributed without her permission. The synthetic AI video was built using a sanctioned post publicizing King’s radio show.

Summary Bullets:

• Reports surfaced that both MGM Resorts international and Caesars Entertainment had been hit with ransomware demands earlier this month.

• This comes in a year when both the frequency and cost associated with ransomware demands have skyrocketed.

Earlier this month both MGM Resorts International and Caesars Entertainment were targets of ransom demands. Caesars disclosed that it quietly paid off $15 million to hackers who had breached its customer loyalty database, negotiated down from the initial $30 million demand. MGM went the opposite route, refusing to pay hackers who took over its Okta authentication servers. The result was a multi-system outage that affected everything from reservation systems and digital room key processes to casino floor operations for at least ten days.

Continue reading “As Ransomware Attacks Accelerate in Frequency and Severity, How to Respond is Just One of the Questions” →

Summary Bullets:

• On September 10th, casino giant MGM Resorts International was hit with a cybersecurity “issue” that impacted its hotel booking and restaurant reservation systems, as well as digital keys and corporate applications including its web site.

• The company acknowledged the incident in a Securities and Exchange (SEC) filing on September 12th which affected properties in several states including Maryland, Massachusetts, Michigan, Mississippi, New Jersey, New York, and Ohio.

On September 10th, an incident came to light that affected multiple MGM casino and hotel properties in a number of US states. The company issued a press release on September 12th and also filed an 8-K report with the SEC. An 8-K filing is a notification of an event that might have a material financial impact on a publicly-traded company.

Continue reading “MGM Under Fire After a “Cybersecurity Issue”” →

Summary Bullets:

• The SEC released new rules on the expediency and response detail required of public companies in reporting cybersecurity incidents after a comment period.

• The rules were met with a mix of concern and criticism, including from two SEC commissioners who expressed dissenting opinions, raising red flags around the reporting requirements potentially revealing key elements of the breached organization’s defenses that could put them at risk of another attack and going beyond the agency’s authority.

In an intensifying threat environment, the US SEC posted new rules requiring how and when public companies will report security incidents that have a material impact on their operations. The new SEC rules oblige organizations to disclose a cybersecurity incident within four days of determining that the event had a material impact on the business. The guidelines state breached organizations are also compelled to outline their practices for detecting, assessing, and managing material risks from cybersecurity threats. The breached organization will need to also reveal prior incidents. The SEC is holding foreign companies conducting business in the US to the same standard. The rules do allow disclosure to be postponed if the US attorney general decides that immediate posting of the incident would put national security or public safety at risk.

Continue reading “New SEC Cybersecurity Disclosure Rules Raise Questions and Criticism” →

Summary Bullets:

• The Verizon Data Breach Investigations report (DBIR) revealed a sizeable jump in pretexting while ransomware continues unabated.

• While actors external to the breached organizations are responsible for most incidents, 19% of the either intentional or accidental security events are perpetrated by internal staff.

With contributions from dozens of organizations including law enforcement agencies like the US Federal Bureau of Investigation (FBI), Verizon’s 2023 DBIR offers insight into the nature of current threat landscape through the analysis of more than 16,000 security incidents, 5,199 of which were confirmed data breaches. What the report reveals is an environment dominated by profit-motivated bad actors who continue to advance techniques in areas like social engineering that exploit human susceptibilities.