US Formally Attributes SolarWinds Attack to Russian Intelligence Agency… | Biden Rushes to Protect Power Grid as Hacking Threats Grow… | Russia launched over a million cyber attacks in three months… | Federal Reserve Chairman Says Cyber-Risk a Top Threat to National Economy… | No password required: Mobile carrier exposes data for millions of accounts…

Nation-state cyber attacks double in three years… | Discord and Slack are becoming potent tools for malware attacks… | How the quick shift to the cloud has led to more security risks… | Ubiquiti’s Breach Notification: The ‘No Evidence’ Hedge… | 533 million Facebook users’ phone numbers and personal data have been leaked online…

After hack, officials draw attention to supply chain threats
“We must enhance the resilience, diversity, and security of our supply chains. The vitality of our nation depends on it.”

Credential phishing on the rise with Office 365 a top target
“New attack tactics include the use of data URLs/encoding to mask content, dynamic content generation, leveraging of local HTML/PDF decoy files, dynamic loading of brand logos.”

Whistleblower: Ubiquiti Breach “Catastrophic”
“In reality…the attackers had gained administrative access to Ubiquiti’s servers at Amazon’s cloud service, which secures the underlying server hardware and software but requires the cloud tenant (client) to secure access to any data stored there.”

AP sources: SolarWinds hack got emails of top DHS officials
“The SolarWinds hack was a victory for our foreign adversaries, and a failure for DHS. We are talking about DHS’s crown jewels.”

Nine cyber attack has all the hallmarks of ransomware, without the ransom
“The attack hit Nine’s systems in Sydney early on Sunday morning, disrupting live television, as workers arriving and logging in found their machines unresponsive.”

Manufacturing’s Cloud Migration Opens Door to Major Cyber-Risk
“The lift and shift of applications that were never meant to be internet-facing to become internet-enabled has likely resulted in this high risk.”

CNA Financial suffers extensive network disruption following cyber attack
“CNA’s network may be out of commission for a while, with the attack mainly impacting the underwriting and claims side of its business.”

Ransomware gang demands $50 million from computer maker Acer
“Here the ransom demand was clearly visible, a whopping $50 million payment request, which represents the highest ransom demand ever requested by a ransomware group.”

Microsoft Exchange Server attacks: ‘They’re being hacked faster than we can count’, says security company
“There are a ton of things [Microsoft Exchange customers] can do manually to prevent a full disaster. I just encourage them to do them immediately. Globally, this is a disaster in the making.”

3 in 4 companies have experienced account takeover attacks in the last year
“We’re regularly seeing identity-based attacks being used to circumnavigate traditional perimeter defences like multi-factor authentication (MFA). Account takeover is replacing phishing as the most common attack vector and MFA defenses are speed bumps not forcefields.”

“Expert” hackers used 11 zerodays to infect Windows, iOS, and Android users
“The ability to pierce advanced defenses built into well-fortified OSes and apps that were fully patched—for example, Chrome running on Windows 10 and Safari running on iOSA—was one testament to the group’s skill.”

Mimecast says SolarWinds hackers breached its network and spied on customers
“The hackers also accessed email addresses, contact information, and ‘encrypted and/or hashed and salted credentials.’”

Microsoft Exchange attacks doubling ‘every two to three hours’
“Most of the attacks are against organizations in Turkey and the United States, followed by Italy . In most cases, criminals are pursuing government and military organizations, manufacturing firms and financial institutions.”

Verkada Breach Demonstrates Danger of Overprivileged Users
“The massive breach of privacy of Verkada’s customers highlights that companies — often, startups — have not always adopted best practices for privileged access to systems. The lesson is learned with regularity, often when a vendor’s clients or customers have their security or privacy compromised.”

Exchange servers first compromised by Chinese hackers hit with ransomware
“Though many of the still unpatched organizations may have been exploited by cyber espionage actors, criminal ransomware operations may pose a greater risk as they disrupt organizations and even extort victims by releasing stolen emails.”

Molson Coors discloses cyberattack disrupting its brewery operations ZDNet, Natalie Gagliordi "Although the Company is actively managing this cybersecurity incident, it has caused and may continue to cause a delay or disruption to parts of the Company's business,...