White House Urges Business Leaders to Lower Ransomware Risks

FBI says REvil was behind JBS meat processing attack, FireEye to become Mandiant again, Massachusets ferry service under attack while NY MTA reveals April hack, Norton will mine cryptocurrency, more

Jun 3

Consider signing up for a premium subscription to Metacurity to gain access to our archives and premium content. Thank you.

Anne Neuberger, the cybersecurity adviser at the National Security Council, sent a letter to America’s corporate executives and leaders urging them to take “a small number of highly impactful steps to help you focus and make rapid progress on driving down risk” associated with ransomware.

Among the basic hygiene steps that Neuberger recommends are implementing best practices outlined in President Biden’s recent executive order, concluding sufficient backups, upgrading and patching systems, and more. (Reuters)

Kevin Collier @kevincollier

Here's the open letter Anne Neuberger sent to the business world yesterday on behalf of the WH, warning about ransomware and telling them how to take basic cyber hygiene steps.

In an official statement, the FBI said that the REvil operation, aka Sodinokibi, is behind the ransomware attack targeting JBS, the world's largest meat producer.

REvil, like the DarkSide group, which was behind the Colonial Pipeline ransomware attack, and the Conti Group, which recently took out Ireland’s healthcare system’s IT network, operates out of Russia with the tacit permission of the Russian government. Press Secretary Jen Psaki said that President Biden would be discussing these attacks with Russian President Vladimir Putin at the June 16th Geneva summit. (Lawrence Abrams / Bleeping Computer)

Cybersecurity leader FireEye announced that it would sell its products group to private equity company Symphony Technology Group for $1.2 billion but retain assets acquired from Mandiant Inc. in a $1 billion stock-and-cash deal in 2014.

Publicly traded FireEye will become Mandiant Inc. under the deal, as the Mandiant assets not acquired will take over the traded FireEye listed stock. (Duncan Riley / Silicon Angle)

FireEye @FireEye

We have entered into a definitive agreement to sell the FireEye Products business, including the FireEye name, to Symphony Technology Group. This will separate FireEye’s products suite from @Mandiant Solutions’ controls-agnostic software and services.

FireEye Announces Sale of FireEye Products Business to Symphony Technology Group for $1.2 Billion | FireEyeFireEye has announced it has entered into a definitive agreement to sell the FireEye Products business, including the FireEye name, to a consortium led by Symphony Technology Group (STG).feye.io

Chris Bing @Bing_Chris

reuters.com/technology/fir… “With the separation, you get simplicity, you get focus. Together we’re in a lot of markets,” Mandia said in an interview with Reuters about the sale. "A lot of it really was resource constraint." "FireEye can’t do everything," he added.FireEye to sell products business for $1.2 bln to Symphony-led investor groupU.S. cybersecurity firm FireEye Inc <a href=“https://www.reuters.com/companies/FEYE.O” target=“_blank”>(FEYE.O)</a> said on Wednesday it would sell its products business, including the FireEye name, to a consortium led by private-equity firm Symphony Technology Group for $1.2 billion in cash.reuters.com

A ransomware attack by a group with alleged ties to China disrupted ferry services in Massachusetts yesterday. At the same time, New York’s Metropolitan Transportation Authority revealed Wednesday that it had been hacked in April in an attack that did not disrupt operations.

The Massachusetts attack disrupted bookings at the Steamship Authority, the largest ferry operator linking passengers and freight from the mainland to Martha’s Vineyard and Nantucket islands. In the New York MTA attack, hackers accessed three of 18 computer systems used by the transit agency. However, according to MTA officials, the breach had no impact on riders, employees, or contractors. (Robert McMillan, Joseph De Avila, and Jacob Bunge / Wall Street Journal)

Antivirus and cybersecurity company NortonLifelock has added a new feature called Norton Crypto, which gives antivirus users the ability to mine Ethereum cryptocurrency directly within its Norton 360 antivirus program to "protect" users from malicious mining software.

Norton Crypto will use the device's graphics card (GPU) to mine for Ethereum, which will then be transferred into a Norton wallet hosted in the cloud. (Lawrence Abrams / Bleeping Computer)

Photo by Executium on Unsplash