Security News
Jeremiah Grossman's Bit Discovery has banked another $4 million in venture capital funding to compete in the crowded attack surface management space. Bit Discovery has raised a total of $6.6 million to build and sell an attack surface management tool to help security programs to identify and manage Internet-connected assets.
COVID-19's disruption has stretched risk management infrastructures to the brink, forcing banks to recalibrate their data, models and processes for stress testing, impact assessments, scenario analyses and more. A global risk management survey by SAS and Longitude examines how banks are adapting their risk frameworks in response.
Nuclear-armed North Korea is advancing on the front lines of cyberwarfare, analysts say, stealing billions of dollars and presenting a clearer and more present danger than its banned weapons programmes. Pyongyang is under multiple international sanctions over its atomic bomb and ballistic missile programmes, which have seen rapid progress under North Korean leader Kim Jong Un. But while the world's diplomatic focus has been on its nuclear ambitions, the North has been quietly and steadily building up its cyber capabilities, and analysts say its army of thousands of well-trained hackers are proving to be just as dangerous.
A former governor of the People's Bank of China has given a speech in which he suggested that China's Digital Yuan is not intended to increase China's influence over global financial systems. An unauthorised translation of the speech by Chinese journalist Zichen Wang reports that Zhou said China's digital currency "Is mainly targeted on the modernization of the domestic payment system, keeping pace with the digital economy and the Internet era, improving efficiency, and reducing costs, especially for the retail payment system".
A banking trojan named Bizarro that originates from Brazil has crossed the borders and started to target customers of 70 banks in Europe and South America. Bizarro is under constant development as its author keeps expanding the list of supporting banks and they modify it to improve anti-analysis protections.
A financially motivated cybercrime gang has unleashed a previously undocumented banking trojan, which can steal credentials from customers of 70 banks located in various European and South American countries. The campaign consists of multiple moving parts, chief among them being the ability to trick users into entering two-factor authentication codes in fake pop-up windows that are then sent to the attackers, as well as its reliance on social engineering lures to convince visitors of banking websites into downloading a malicious smartphone app.
Threat actors impersonated Truist, the sixth-largest US bank holding company, in a spear-phishing campaign attempting to infect recipients with what looks like remote access trojan malware. In one of the attacks targeting a renewable energy company in February 2021, the phishing emails instructed the target to download a malicious Windows app mimicking the legitimate Truist Financial SecureBank App and supposedly needed to complete the process behind a $62 million loan.
Researchers have discovered an Android trojan that can steal victims' SMS messages and credentials and completely take over devices. Once installed on a victim's device, attackers can use the trojan to obtain a live streaming of the device screen on demand and also interact with it via Accessibility Services, according to a report posted online by online fraud-management firm Cleafy about the trojan, which is also tracked by the name "Anatsa."
In emails sent by NatWest and seen by BleepingComputer, the system malfunction meant that the standing orders set up by banking customers over a period of 11 months did not correctly record the number of automated payments that were to be debited, or on what dates should the debits stop. This means automated payments could have continued to be made from the customer accounts, even after a standing order had expired, costing customers money.
In emails sent by NatWest and seen by BleepingComputer, the system malfunction meant that the standing orders set up by banking customers over a period of 11 months did not correctly record the number of automated payments that were to be debited, or on what dates should the debits stop. This means automated payments could have continued to be made from the customer accounts, even after a standing order had expired, costing customers money.