Recently the United States slammed China for one of the biggest hacks of all time. The United States accused China, the Chinese state of stealing emails and data from a Microsoft exchange, but China denied any connection with the incident.

United States: US allies, accuse China of cyberattack

The US Law enforcement officials have seized an estimated $6 million in ransom payments and the justice department has charged two suspects over a damaging July ransomware attack on an American company.

US recovers $6 million in ransom payments and charges two men over major cyberattack

In a recent cyberattack on its servers, National Bank of Pakistan (NBP) informed that no financial loss or data breach has been observed, the bank said on Saturday. It did report that the attack impacted “some of the bank’s services”. &nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet">
NBP has reported a cyber security related incident which is being investigated. NBP has not observed any data breach or financial loss. No other bank has reported any such incidence. SBP is monitoring the situation closely to ensure safety and soundness of banking system.
— SBP (@StateBank_Pak) <a href="https://twitter.com/StateBank_Pak/status/1454478620131536899?ref_src=twsrc%5Etfw">October 30, 2021</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

On Twitter, the central bank announced, “NBP has reported a cybersecurity-related incident, which is being investigated. NBP has not observed any data breach or financial loss.” &nbsp;

Also Read:&nbsp;<a href="https://www.wionews.com/south-asia/taliban-send-envoy-to-pakistan-as-diplomats-start-work-in-capital-city-islamabad-425114" hreflang="en">Taliban send envoy to Pakistan as 'diplomats' start work in Islamabad</a>

It clarified that no other bank reported such incident. The central bank is also currently monitoring the situation to ensure the safety and soundness of the banking system. &nbsp;

The bank said it took "immediate steps" to isolate the affected systems. “At this point, no customer or financial data has been compromised,” it stated. &nbsp;

Also Read:&nbsp;<a href="https://www.wionews.com/south-asia/pakistan-islamist-group-vows-to-march-to-capital-amid-deadlock-in-talks-with-govt-424929" hreflang="en">Pakistan Islamist group vows to march to capital amid deadlock in talks with govt</a>

In a statement, the bank said, “Remediation efforts are underway using industry-leading subject matter experts including international resources where ever required.” &nbsp;

Currently, the NBP's services to its customers have been disrupted. The NBP said that the bank is making concerted efforts to address the breach. It is confident that essential customer services will be restored by Monday morning. &nbsp;

(With inputs from agencies)

In a recent cyberattack on its servers, National Bank of Pakistan (NBP) informed that no financial loss or data breach has been observed, the bank said on Saturday.

In a recent cyberattack on its servers, National Bank of Pakistan (NBP) informed that no financial loss or data breach has been observed, the bank said on Saturday. It did report that the attack impacted “some of the bank’s services”. NBP has reported a cyber security related incident which is being investigated. NBP has not observed any data breach or financial loss. No other bank has reported any such incidence. SBP is monitoring the situation closely to ensure safety and soundness of banking system. — SBP (@StateBank_Pak) October 30, 2021 × On Twitter, the central bank announced, “NBP has reported a cybersecurity-related incident, which is being investigated. NBP has not observed any data breach or financial loss.” Also Read: Taliban send envoy to Pakistan as 'diplomats' start work in Islamabad It clarified that no other bank reported such incident. The central bank is also currently monitoring the situation to ensure the safety and soundness of the banking system. The bank said it took "immediate steps" to isolate the affected systems. “At this point, no customer or financial data has been compromised,” it stated. Also Read: Pakistan Islamist group vows to march to capital amid deadlock in talks with govt In a statement, the bank said, “Remediation efforts are underway using industry-leading subject matter experts including international resources where ever required.” Currently, the NBP's services to its customers have been disrupted. The NBP said that the bank is making concerted efforts to address the breach. It is confident that essential customer services will be restored by Monday morning. (With inputs from agencies)

National Bank of Pakistan gets hit by cyberattack, reports no financial loss or data breach

A cyberattack crippled gas stations across Iran on Tuesday, leaving angry motorists stranded in long lines.

No group immediately claimed responsibility for the attack, which rendered useless the government-issued electronic cards that many Iranians use to buy subsidized fuel at the pump.

It bore similarities to another attack months earlier that seemed to directly challenge Iran’s Supreme Leader Ayatollah Ali Khamenei as the country’s economy buckles under American sanctions. Those economic problems worsen as the US&nbsp;and Iran have yet to jointly re-enter Tehran’s tattered nuclear deal with world powers.

State television quoted an unnamed official in the country's National Security Council acknowledging the cyberattack, hours after it aired images of long lines of cars waiting to fill up in Tehran. Associated Press journalists also saw lines of cars at Tehran gas stations, with the pumps off and the station closed.

“I have been waiting a couple of hours for the gas stations to reopen so that I can fill up,” said a motorcyclist who gave his name only as Farzin. “There is no fuel wherever I go.”

The semiofficial ISNA news agency, which first called the incident a cyberattack, said it saw those trying to buy fuel with a government-issued card through the machines instead receive a message reading “cyberattack 64411.” Most Iranians rely on those subsidies to fuel their vehicles, particularly amid the country’s economic problems.

Also Read |&nbsp;<a href="https://www.wionews.com/world/abandoned-red-sea-oil-tanker-may-leave-millions-without-water-420247">Abandoned Red Sea oil tanker may leave millions without water</a>

While ISNA didn’t acknowledge the number’s significance, that number is associated with a hotline run through Khamenei’s office that handles questions about Islamic law. ISNA later removed its reports, claiming that it too had been hacked. Such claims of hacking can come quickly when Iranian outlets publish news that angers the theocracy.

Farsi-language satellite channels abroad published videos apparently shot by drivers in Isfahan, a major Iranian city, showing electronic billboards there reading: “Khamenei! Where is our gas?” Another said: “Free gas in Jamaran gas station,” a reference to the home of the late Supreme Leader Ayatollah Ruhollah Khomeini.

State TV said Oil Ministry officials were holding an “emergency meeting” to solve the problem. Some gas stations that accept only cash and are not in the subsidy card network continued pumping fuel.

The use of the number “64411” mirrored an attack in July targeting Iran’s railroad system that also saw the number displayed. Israeli cybersecurity firm Check Point later attributed the train attack to a group of hackers that called themselves Indra, after the Hindu god of war. 
Indra previously targeted firms in Syria, where President Bashar Assad has held onto power through Iran’s intervention in his country’s grinding war.

Cheap gasoline is practically considered a birthright in Iran, home to the world’s fourth-largest crude oil reserves despite decades of economic woes.

Subsidies allow Iranian motorists to buy regular gasoline at 15,000 rials per liter. That’s 5 cents a liter, or about 20 cents a gallon. After a monthly 60-liter quota, it costs 30,000 rials a liter. That’s 10 cents a liter or 41 cents a gallon. Regular gasoline costs 89 cents a liter or $3.38 a gallon on average in the US, according to AAA.

In 2019, Iran faced days of mass protests across some 100 cities and towns over gasoline prices rising. Security forces arrested thousands and Amnesty International said it believes 304 people were killed in a government crackdown. Tuesday's cyberattack came in the same month in the Persian calendar as the gasoline protests in 2019.

Also Read |&nbsp;<a href="https://www.wionews.com/india-news/abraham-accords-dividend-india-us-uae-israel-foreign-ministers-to-hold-meeting-421701">Abraham Accords dividend: India, US, UAE &amp; Israel foreign ministers to hold meeting</a>

The attack also came on the birthday of the late Shah Mohammad Reza Pahlavi who, stricken with cancer, fled the country in 1979 just before the Islamic Revolution.

Iran has faced a series of cyberattacks, including one that leaked video of abuses at its notorious Evin prison in August.

The country disconnected much of its government infrastructure from the internet after the Stuxnet computer virus — widely believed to be a joint US -Israeli creation — disrupted thousands of Iranian centrifuges in the country's nuclear sites in the late 2000s.

A cyberattack crippled gas stations across Iran on Tuesday, leaving angry motorists stranded in long lines. No group immediately claimed responsibility for the attack, which rendered useless the government-issued electronic cards that many Iranians use to buy subsidized fuel at the pump.

A cyberattack crippled gas stations across Iran on Tuesday, leaving angry motorists stranded in long lines. No group immediately claimed responsibility for the attack, which rendered useless the government-issued electronic cards that many Iranians use to buy subsidized fuel at the pump. It bore similarities to another attack months earlier that seemed to directly challenge Iran’s Supreme Leader Ayatollah Ali Khamenei as the country’s economy buckles under American sanctions. Those economic problems worsen as the US and Iran have yet to jointly re-enter Tehran’s tattered nuclear deal with world powers. State television quoted an unnamed official in the country's National Security Council acknowledging the cyberattack, hours after it aired images of long lines of cars waiting to fill up in Tehran. Associated Press journalists also saw lines of cars at Tehran gas stations, with the pumps off and the station closed. “I have been waiting a couple of hours for the gas stations to reopen so that I can fill up,” said a motorcyclist who gave his name only as Farzin. “There is no fuel wherever I go.” The semiofficial ISNA news agency, which first called the incident a cyberattack, said it saw those trying to buy fuel with a government-issued card through the machines instead receive a message reading “cyberattack 64411.” Most Iranians rely on those subsidies to fuel their vehicles, particularly amid the country’s economic problems. Also Read | Abandoned Red Sea oil tanker may leave millions without water While ISNA didn’t acknowledge the number’s significance, that number is associated with a hotline run through Khamenei’s office that handles questions about Islamic law. ISNA later removed its reports, claiming that it too had been hacked. Such claims of hacking can come quickly when Iranian outlets publish news that angers the theocracy. Farsi-language satellite channels abroad published videos apparently shot by drivers in Isfahan, a major Iranian city, showing electronic billboards there reading: “Khamenei! Where is our gas?” Another said: “Free gas in Jamaran gas station,” a reference to the home of the late Supreme Leader Ayatollah Ruhollah Khomeini. State TV said Oil Ministry officials were holding an “emergency meeting” to solve the problem. Some gas stations that accept only cash and are not in the subsidy card network continued pumping fuel. The use of the number “64411” mirrored an attack in July targeting Iran’s railroad system that also saw the number displayed. Israeli cybersecurity firm Check Point later attributed the train attack to a group of hackers that called themselves Indra, after the Hindu god of war. Indra previously targeted firms in Syria, where President Bashar Assad has held onto power through Iran’s intervention in his country’s grinding war. Cheap gasoline is practically considered a birthright in Iran, home to the world’s fourth-largest crude oil reserves despite decades of economic woes. Subsidies allow Iranian motorists to buy regular gasoline at 15,000 rials per liter. That’s 5 cents a liter, or about 20 cents a gallon. After a monthly 60-liter quota, it costs 30,000 rials a liter. That’s 10 cents a liter or 41 cents a gallon. Regular gasoline costs 89 cents a liter or $3.38 a gallon on average in the US, according to AAA. In 2019, Iran faced days of mass protests across some 100 cities and towns over gasoline prices rising. Security forces arrested thousands and Amnesty International said it believes 304 people were killed in a government crackdown. Tuesday's cyberattack came in the same month in the Persian calendar as the gasoline protests in 2019. Also Read | Abraham Accords dividend: India, US, UAE & Israel foreign ministers to hold meeting The attack also came on the birthday of the late Shah Mohammad Reza Pahlavi who, stricken with cancer, fled the country in 1979 just before the Islamic Revolution. Iran has faced a series of cyberattacks, including one that leaked video of abuses at its notorious Evin prison in August. The country disconnected much of its government infrastructure from the internet after the Stuxnet computer virus — widely believed to be a joint US -Israeli creation — disrupted thousands of Iranian centrifuges in the country's nuclear sites in the late 2000s.

Iran says cyberattack closes gas stations across country

The Russian-based agency behind last year's massive SolarWinds cyber attack has targeted hundreds more companies and organisations as a part of its latest attacks on US-based computer systems, reveals Microsoft in a blog post.

In a blog post dated October 24, Microsoft said that Nobelium's latest wave targeted "resellers and other technology service providers" of cloud services. The attacks come as a part of a broader campaign over the summer, Microsoft said. It further added that it had notified 609 customers between July 1 and October 19 that they had been attacked.

The software giant's Threat Intelligence Center (MSTIC), described the cyberattack as "nation-state activity."

MSTIC said that it "shares the hallmarks" of the assault on SolarWinds, a Texas-based software company targeted as its 300,000-strong customer base gave the hackers access to a huge number of companies.&nbsp;

The latest attack has been underway since at least May, MSTIC said.&nbsp;

<a href="https://www.wionews.com/world/woman-finds-her-dad-on-facebook-after-58-years-423786">Also read |&nbsp;Woman finds her dad on Facebook after 58 years</a>

In April, Washington imposed sanctions and expelled Russian diplomats in retaliation for Moscow's alleged involvement in the SolarWinds attack, election interference and other hostile activity.

The software company urged its customers to check on their security arrangements using multi-factor authentification.

This is not the first time that Nobelium has mounted a comeback since SolarWinds, with Microsoft announcing in May that it had again detected a series of attacks by the group on government agencies.

In May, the effort targeted about 3,000 email accounts at more than 150 different organisations, at least a quarter of them involved in international development, humanitarian and human rights work.

This time, Burt said the speed of the attacks was escalating. While the success rate was only "in the low single digits", this compares to "attacks from all nation-state actors 20,500 times over the past three years".

The Russian-based agency behind last year's massive SolarWinds cyber attack has targeted hundreds more companies and organisations as a part of its latest attacks on US-based computer systems, reveals Microsoft in a blog post.

The Russian-based agency behind last year's massive SolarWinds cyber attack has targeted hundreds more companies and organisations as a part of its latest attacks on US-based computer systems, reveals Microsoft in a blog post. In a blog post dated October 24, Microsoft said that Nobelium's latest wave targeted "resellers and other technology service providers" of cloud services. The attacks come as a part of a broader campaign over the summer, Microsoft said. It further added that it had notified 609 customers between July 1 and October 19 that they had been attacked. The software giant's Threat Intelligence Center (MSTIC), described the cyberattack as "nation-state activity." MSTIC said that it "shares the hallmarks" of the assault on SolarWinds, a Texas-based software company targeted as its 300,000-strong customer base gave the hackers access to a huge number of companies. The latest attack has been underway since at least May, MSTIC said. Also read | Woman finds her dad on Facebook after 58 years In April, Washington imposed sanctions and expelled Russian diplomats in retaliation for Moscow's alleged involvement in the SolarWinds attack, election interference and other hostile activity. The software company urged its customers to check on their security arrangements using multi-factor authentification. This is not the first time that Nobelium has mounted a comeback since SolarWinds, with Microsoft announcing in May that it had again detected a series of attacks by the group on government agencies. In May, the effort targeted about 3,000 email accounts at more than 150 different organisations, at least a quarter of them involved in international development, humanitarian and human rights work. This time, Burt said the speed of the attacks was escalating. While the success rate was only "in the low single digits", this compares to "attacks from all nation-state actors 20,500 times over the past three years".

Russian cyberattack targeting hundreds of US networks, reveals Microsoft

As ransomware becomes a dangerous&nbsp;threat, US homeland security secretary Alejandro Mayorkas recently informed about a new threat called "killware" which aims to literally kill people.

Mayorkas informed that a "cyber incident" was linked to an attempted hack on a water treatment facility in Florida intended to contaminate the water to be distributed to&nbsp;residents which took place in February.

<a href="https://www.wionews.com/world/it-is-already-over-ex-pentagon-software-chief-claims-us-has-lost-ai-battle-against-china-419997">Also Read:&nbsp;Ex-Pentagon software chief claims US has lost AI battle against China</a>

Mayorkas warned about the increasing frequency of cyberattacks and urged authorities to treat it as a matter of priority.

The top US official on homeland security referred to the Colonial Pipeline ransomware attack in April. The reported cyberattack on the pipeline had led to fuel shortages in the US east coast.&nbsp;

<a href="https://www.wionews.com/world/most-americans-concerned-about-cyberattacks-on-critical-groups-reveals-poll-419974">Also Read:&nbsp;Most Americans concerned about cyberattacks on critical groups, reveals poll</a>

A ransomware group named Darkside was reportedly behind the cyberattack on the pipeline, according to the FBI. The attack had led to fuel shortages and rise in prices even as US President Joe Biden was briefed about the incident.

<a href="https://www.wionews.com/videos/joe-biden-warns-cyberattacks-could-lead-to-a-real-shooting-war-401069">Watch:&nbsp;Joe Biden warns cyberattacks could lead to 'a real shooting war'</a>

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/joe-biden-warns-cyberattacks-could-lead-to-a-real-shooting-war-401069/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

The SolarWinds hacking row was another incident which took US federal agencies by surprise as American officials blamed Russia’s SVR foreign intelligence service.

The hackers reportedly broke into the code of SolarWinds which makes software for various networks. US federal agencies were breached during the hacking incident including Microsoft.

<a href="https://www.wionews.com/technology/hackers-linked-to-russia-reportedly-demand-70-million-from-companies-hit-by-cyberattack-395947">Also Read:&nbsp;Hackers linked to Russia reportedly demand $70 million from companies</a>

President Joe Biden had issued orders to federal agencies to beef up their&nbsp;security as the hacking exposed several US government departments, including reportedly the Justice Department networks.

(With inputs from Agencies) 
&nbsp;

As ransomware becomes a dangerous threat, US homeland security secretary Alejandro Mayorkas recently informed about a new threat called "killware" which aims to literally kill people.

As ransomware becomes a dangerous threat, US homeland security secretary Alejandro Mayorkas recently informed about a new threat called "killware" which aims to literally kill people. Mayorkas informed that a "cyber incident" was linked to an attempted hack on a water treatment facility in Florida intended to contaminate the water to be distributed to residents which took place in February. Also Read: Ex-Pentagon software chief claims US has lost AI battle against China Mayorkas warned about the increasing frequency of cyberattacks and urged authorities to treat it as a matter of priority. The top US official on homeland security referred to the Colonial Pipeline ransomware attack in April. The reported cyberattack on the pipeline had led to fuel shortages in the US east coast. Also Read: Most Americans concerned about cyberattacks on critical groups, reveals poll A ransomware group named Darkside was reportedly behind the cyberattack on the pipeline, according to the FBI. The attack had led to fuel shortages and rise in prices even as US President Joe Biden was briefed about the incident. Watch: Joe Biden warns cyberattacks could lead to 'a real shooting war' The SolarWinds hacking row was another incident which took US federal agencies by surprise as American officials blamed Russia’s SVR foreign intelligence service. The hackers reportedly broke into the code of SolarWinds which makes software for various networks. US federal agencies were breached during the hacking incident including Microsoft. Also Read: Hackers linked to Russia reportedly demand $70 million from companies President Joe Biden had issued orders to federal agencies to beef up their security as the hacking exposed several US government departments, including reportedly the Justice Department networks. (With inputs from Agencies)

Not ransomware, 'killware' is the new threat, top US security official explains

A poll conducted by The Associated Press-NORC Center for Public Affairs and the University of Chicago’s Pearson Institute has found that the majority of Americans are concerned about cyberattacks on critical groups, especially those in the financial and national security sectors.

The poll reveals that three-quarters of those surveyed are especially concerned about cyberattacks from the Russian and Chinese governments, while just over half were concerned about attacks from cybercriminal groups.&nbsp;

There were also concerns around attacks on financial institutions. Over 90 per cent of respondents are concerned about threats to their data as a result of these attacks.&nbsp;

Over 90 per cent of respondents are also similarly concerned about attacks on national security and defence systems, healthcare groups, and the electricity sector.&nbsp;

<a href="https://www.wionews.com/world/capsule-from-1765-containing-air-reveal-facts-about-antarctic-ice-419895">Also read |&nbsp;Capsule from 1765 containing air reveal facts about Antarctic ice</a>

Sheila Kohanteb, the executive director of External Relations at the Pearson Institute, in a statement said, "The public is clearly worried about cyber-attacks, and many Americans see such attacks as a potential result of international conflict."

“The survey results show Americans are far more concerned about cyber-attacks from China and Russia than those from other governments, groups, or individuals.”&nbsp;

The poll concludes that 75 per cent of respondents over the age of 60 were concerned about cyberattacks, while less than half of respondents between the ages of 18 and 29 were concerned about the same.

Older adults were also more concerned about attacks from the Russian or Chinese governments than younger adults

The poll was conducted over a week in September, with over 1,000 US adults responding via online survey or phone interview.&nbsp;

A poll conducted by The Associated Press-NORC Center for Public Affairs and the University of Chicago’s Pearson Institute has found that the majority of Americans are concerned about cyberattacks on critical groups, especially those in the financial and national security sectors.

A poll conducted by The Associated Press-NORC Center for Public Affairs and the University of Chicago’s Pearson Institute has found that the majority of Americans are concerned about cyberattacks on critical groups, especially those in the financial and national security sectors. The poll reveals that three-quarters of those surveyed are especially concerned about cyberattacks from the Russian and Chinese governments, while just over half were concerned about attacks from cybercriminal groups. There were also concerns around attacks on financial institutions. Over 90 per cent of respondents are concerned about threats to their data as a result of these attacks. Over 90 per cent of respondents are also similarly concerned about attacks on national security and defence systems, healthcare groups, and the electricity sector. Also read | Capsule from 1765 containing air reveal facts about Antarctic ice Sheila Kohanteb, the executive director of External Relations at the Pearson Institute, in a statement said, "The public is clearly worried about cyber-attacks, and many Americans see such attacks as a potential result of international conflict." “The survey results show Americans are far more concerned about cyber-attacks from China and Russia than those from other governments, groups, or individuals.” The poll concludes that 75 per cent of respondents over the age of 60 were concerned about cyberattacks, while less than half of respondents between the ages of 18 and 29 were concerned about the same. Older adults were also more concerned about attacks from the Russian or Chinese governments than younger adults The poll was conducted over a week in September, with over 1,000 US adults responding via online survey or phone interview.

Most Americans concerned about cyberattacks on critical groups, reveals poll

Staunchly defending the hasty withdrawal of the American troops from Afghanistan, United States President Joe Biden&nbsp;said it was time for Washington to shift its focus towards “powerful adversaries” such as Russia and China

In his address to the nation from the White House on Tuesday, Biden said, “My fellow Americans, the war in Afghanistan is now over. I give you my word: With all of my heart, I believe this is the right decision, a wise decision, and the best decision for America.” he said.

Biden’s address to the nation came just 11 days before the 20th anniversary of the September 11, 2001, terrorist attacks that led to the US intervention in Afghanistan.

“The fundamental obligation of a President, in my opinion, is to defend and protect America...not against threats of 2001, but against the threats of 2021 and tomorrow,” he said.

“But I also know that the threat from terrorism continues in its pernicious and evil nature. But it's changed, expanded to other countries. Our strategy has to change too,” he added.

The US President also highlighted the evacuation of more than 120,000 people from Afghanistan, saying the “extraordinary success of this mission was due to the incredible skill, bravery, and selfless courage of the United States military and our diplomats and intelligence professionals.”

Also read |&nbsp;&nbsp;<a href="https://www.wionews.com/world/dont-forget-me-here-bidens-former-interpreter-left-in-afghanistan-410031">'Don't forget me here': Biden's former interpreter left in Afghanistan</a>

Biden has been widely criticised over the abrupt manner of the US withdrawal, which led to the unexpected collapse of the Afghan security forces US troops had trained and funded for years.

Stressing that it was time for the US to face new challenges like cyberattacks and nuclear proliferation, Biden said, “We have to shore up America's competitiveness to meet these new challenges in the competition for the 21st century. And we can do both: fight terrorism and take on new threats that are here now and will continue to be here in the future.”

He said, “There's nothing China or Russia would rather have, would want more in this competition than the United States to be bogged down another decade in Afghanistan.”

The United States, he said, will maintain the fight against terrorism in Afghanistan and other countries.

(With inputs from agencies)

Staunchly defending the hasty withdrawal of the American troops from Afghanistan, United States President Joe Biden said it was time for Washington to shift its focus towards “powerful adversaries” such as Russia and China In his address to the nation from the White House on Tuesday, Biden said, “My fellow Americans, the war in Afghanistan is now over.

Staunchly defending the hasty withdrawal of the American troops from Afghanistan, United States President Joe Biden said it was time for Washington to shift its focus towards “powerful adversaries” such as Russia and China In his address to the nation from the White House on Tuesday, Biden said, “My fellow Americans, the war in Afghanistan is now over. I give you my word: With all of my heart, I believe this is the right decision, a wise decision, and the best decision for America.” he said. Biden’s address to the nation came just 11 days before the 20th anniversary of the September 11, 2001, terrorist attacks that led to the US intervention in Afghanistan. “The fundamental obligation of a President, in my opinion, is to defend and protect America...not against threats of 2001, but against the threats of 2021 and tomorrow,” he said. “But I also know that the threat from terrorism continues in its pernicious and evil nature. But it's changed, expanded to other countries. Our strategy has to change too,” he added. The US President also highlighted the evacuation of more than 120,000 people from Afghanistan, saying the “extraordinary success of this mission was due to the incredible skill, bravery, and selfless courage of the United States military and our diplomats and intelligence professionals.” Also read | 'Don't forget me here': Biden's former interpreter left in Afghanistan Biden has been widely criticised over the abrupt manner of the US withdrawal, which led to the unexpected collapse of the Afghan security forces US troops had trained and funded for years. Stressing that it was time for the US to face new challenges like cyberattacks and nuclear proliferation, Biden said, “We have to shore up America's competitiveness to meet these new challenges in the competition for the 21st century. And we can do both: fight terrorism and take on new threats that are here now and will continue to be here in the future.” He said, “There's nothing China or Russia would rather have, would want more in this competition than the United States to be bogged down another decade in Afghanistan.” The United States, he said, will maintain the fight against terrorism in Afghanistan and other countries. (With inputs from agencies)

Biden draws curtain on Afghanistan, shifts focus to 'powerful adversaries' China, Russia

Japanese crypto-exchange platform Liquid has announced that some of its crypto wallets have been compromised, due to which the exchange has suspended all deposit and withdrawal operations.

They announced this suspension via a tweet that said, "We are sorry to announce that #LiquidGlobal warm wallets were compromised, we are moving assets into the cold wallet.

We are currently investigating and will provide regular updates. In the meantime, deposits and withdrawals will be suspended."

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet">
Important Notice: 
We are sorry to announce that <a href="https://twitter.com/hashtag/LiquidGlobal?src=hash&amp;ref_src=twsrc%5Etfw">#LiquidGlobal</a> warm wallets were compromised, we are moving assets into the cold wallet. 
 
We are currently investigating and will provide regular updates. In the meantime deposits and withdrawals will be suspended.
— Liquid Global Official (@Liquid_Global) <a href="https://twitter.com/Liquid_Global/status/1428176357515612165?ref_src=twsrc%5Etfw">August 19, 2021</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

A cold wallet is kept offline and is more secure, whereas a warm wallet is available online and enables customers to access their crypto-assets instantly.

Also read |&nbsp;<a href="https://www.wionews.com/world/expect-us-hacktivist-group-anonymous-targets-elon-musk-over-his-crypto-market-hold-389832">'Expect us': Hacktivist group Anonymous targets Elon Musk over his crypto market hold</a>

This latest attack on Liquid follows a similar attack last month on crypto platform Poly Network, in which over $600m in major cryptocurrencies was stolen.

Elliptic, a blockchain analytics firm, reported that&nbsp;in this latest attack on Liquid, the&nbsp;hacker escaped with cryptocurrencies worth $94 million.&nbsp;This includes $30.9 million in ether, 12.9 million in XRP, $4.8 million in bitcoin, $7.7 million in stablecoins and $37.4 million in other tokens.

Interestingly, the Poly attack hacker&nbsp;returned some of the assets they stole and received a 'bug bounty' from Poly of $478,000 in return. However, Elliptic is concerned, that crypto-related ransom attacks could become more commonplace.

Also read |&nbsp;<a href="https://www.wionews.com/business-economy/hackers-return-260-million-to-crypto-platform-poly-network-after-massive-theft-404728">Hackers return $260 million to crypto platform Poly Network after massive theft</a>

This isn't the first time Liquid has been breached; in November 2020, the exchange acknowledged a user data leak.&nbsp;

Japanese crypto-exchange platform Liquid has announced that some of its crypto wallets have been compromised, due to which the exchange has suspended all deposit and withdrawal operations.

Japanese crypto-exchange platform Liquid has announced that some of its crypto wallets have been compromised, due to which the exchange has suspended all deposit and withdrawal operations. They announced this suspension via a tweet that said, "We are sorry to announce that #LiquidGlobal warm wallets were compromised, we are moving assets into the cold wallet. We are currently investigating and will provide regular updates. In the meantime, deposits and withdrawals will be suspended." Important Notice: We are sorry to announce that #LiquidGlobal warm wallets were compromised, we are moving assets into the cold wallet. We are currently investigating and will provide regular updates. In the meantime deposits and withdrawals will be suspended. — Liquid Global Official (@Liquid_Global) August 19, 2021 × A cold wallet is kept offline and is more secure, whereas a warm wallet is available online and enables customers to access their crypto-assets instantly. Also read | 'Expect us': Hacktivist group Anonymous targets Elon Musk over his crypto market hold This latest attack on Liquid follows a similar attack last month on crypto platform Poly Network, in which over $600m in major cryptocurrencies was stolen. Elliptic, a blockchain analytics firm, reported that in this latest attack on Liquid, the hacker escaped with cryptocurrencies worth $94 million. This includes $30.9 million in ether, 12.9 million in XRP, $4.8 million in bitcoin, $7.7 million in stablecoins and $37.4 million in other tokens. Interestingly, the Poly attack hacker returned some of the assets they stole and received a 'bug bounty' from Poly of $478,000 in return. However, Elliptic is concerned, that crypto-related ransom attacks could become more commonplace. Also read | Hackers return $260 million to crypto platform Poly Network after massive theft This isn't the first time Liquid has been breached; in November 2020, the exchange acknowledged a user data leak.

Japanese crypto-exchange 'Liquid' hacked, millions in crypto-currencies stolen

Did China carry out a cyber-attack on Israel? A new investigation claims Chinese hackers disguised themselves as Iranians to strike Israeli assets. Palki Sharma gets you the details.

Gravitas: Did China carry out a cyberattack on Israel?

As cyberattacks proliferated this year, Sanjay Beri, CEO of Netskope, a cloud security startup, got a phone call. Then an email. Then more messages.

All were from venture capitalists who wanted to invest in his company. Given the ransomware attacks and nation-state hacks that were making headlines, they told him, companies that made security products had a bigger market and mission than before.

Also read |&nbsp;<a href="https://www.wionews.com/technology/how-have-cyber-attacks-become-strategy-for-hybrid-warfare-399782">How have cyber attacks become strategy for hybrid warfare?</a>

“We weren’t looking for capital,” said Beri, who founded Netskope in 2012, but the cyberattacks “definitely increased their interest.”

After bids from seven investors, Netskope raised $300 million this month at a valuation of $7.5 billion, up from a $2.8 billion valuation last year. It was one of the year’s largest cybersecurity funding rounds, but not the maximum that Netskope could have attained.

“We could have raised $1 billion in capital,” Beri said.

Recent cyberattacks around the world have taken down operations at gasoline pipelines, hospitals and grocery chains and potentially compromised some intelligence agencies. But they have been a bonanza for one group: cybersecurity startups.

Also read |&nbsp;<a href="https://www.wionews.com/world/white-house-weighs-new-cybersecurity-approach-after-failure-to-detect-hacks-370603">White House weighs new cybersecurity approach after failure to detect hacks</a>

Investors have poured more than $12.2 billion into startups that sell products and services such as cloud security, identify verification and privacy protection so far this year. That exceeds the $10.4 billion that cybersecurity companies raised in all of 2020 and is more than double the $4.8 billion raised in 2016, according to the research firm PitchBook, which tracks funding. Since 2019, the rise in cybersecurity funding has outpaced the increase in overall venture funding.

The surge follows a slew of high-profile ransomware attacks, including against Colonial Pipeline, software maker Kaseya and meat processor JBS. When President Joe Biden met with Russian President Vladimir Putin last month, cyberattacks perpetrated by Russians were high on the diplomatic agenda. This month, the Biden administration and its allies also formally accused China of conducting hacks.

<iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/us-allies-condemn-china-for-malicious-cyber-activity-399125/embed" style="width:100%;max-width:560px;" width="560"></iframe>

The breaches have fueled concerns among companies and governments, leading to increased spending on security products. Worldwide spending on information security and related services is expected to reach $150 billion this year, up 12 per cent from a year ago, according to the research company Gartner.

“Before we got to this point, we as security teams were having to go and fight for every penny we could get, and now it’s the exact opposite,” said John Turner, an information security manager at LendingTree, an online lending marketplace. Executives, he said, are asking: “Are we protected? What do you need?”

All of this is set to drive business for cybersecurity companies, creating a potential windfall that has excited investors. The average valuation of cybersecurity companies raising funds this year has more than doubled to $524.1 million from $221.8 million in 2020, according to PitchBook.

Also read |&nbsp;<a href="https://www.wionews.com/technology/biden-if-us-has-real-shooting-war-it-could-be-result-of-cyber-attacks-401055">Biden: If US has 'real shooting war' it could be result of cyber attacks</a>

“In close to two decades as a VC, I’ve never seen valuations so escalated,” said Asheem Chandna, a venture capitalist at Greylock Partners, who has invested in security companies such as Palo Alto Networks.

The money is flooding into startups that are tackling hackers in new ways. Traditionally, security systems at companies relied on the idea of securing a perimeter. That meant companies installed firewalls and other software to protect access to their corporate network.

But over the past several years, a shift to cloud computing has rendered the perimeter and the reliance on corporate networks obsolete. Employees now get access to applications over the internet, rather than through a data center operated by their employer. That has opened the door to startups that focus on cloud-based security and identity verification.

“Don’t build higher fences — have really good ID cards,” said Jason Crabtree, CEO of Qomplx, a risk-analytics startup that provides identity-verification software and is in the process of going public.

The funding frenzy has built for months. The <a href="https://www.wionews.com/topics/coronavirus">pandemic</a> provided momentum when companies shifted to remote work, which required securing those remote-access systems, investors and executives said.

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/cyber-attack-disrupts-major-south-african-port-operations-401656/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

n a Friday evening in October, Chandna introduced the CEO of Abnormal Security, an email-security company in which he had invested, to another investor, he said. That investor, Venky Ganesan of Menlo Ventures, who had been pursuing a meeting with the CEO, Evan Reiser, for months, immediately emailed Reiser to invite him to dinner that night.

Reiser drove, he said, from San Francisco to Ganesan’s home in Atherton, California, about 30 miles away. By the end of the weekend, Abnormal had signed a deal to raise $50 million at a $600 million valuation, putting its total funding at $74 million. Menlo’s $40 million check was the firm’s largest investment ever.

“As shotgun weddings go, it’s as shotgun as you can get,” Ganesan said.

Since then, the ransomware attacks have given the funding wave a further boost.

In January, Lacework, a cloud security startup in San Jose, California, garnered $525 million in funding. Investors reached out because of Lacework’s products, which use artificial intelligence to identify threats, said Andy Byron, the company’s chief resource officer. In total, Lacework has raised $625 million since it was founded in 2015.

Mike Speiser, a venture capitalist at Sutter Hill Ventures, which led Lacework’s January financing, had no problem getting other investors to participate, he said.

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/gravitas-how-china-breached-thousands-of-organisations-with-one-hacking-operation-399317/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

I called the five people that I thought were the best investors and asked them if they were interested. They were all interested, and within 48 hours we had a deal,” Speiser said. “One hundred percent of the people I called said they wanted in. We could have raised well over $1 billion.”

Business has boomed for Lacework because of “the combination of all of these ransomware and nation-state attacks, together with people moving to the cloud so aggressively,” said David Hatfield, who joined the startup in February as CEO.

Other security startups have also benefited. Orca, a cloud-security startup, raised $210 million in March. Trulioo, a company that makes sure users are who they say they are when they join a platform, collected $394 million last month.

Security startups are also being acquired for large sums or are going public. Last month, SentinelOne went public with a market capitalization of over $10 billion, the highest-valued cybersecurity public offering. In May, Auth0, an identity-verification company, was bought by Okta, another security company, for $6.5 billion.

Netskope's Beri said that with cybersecurity threats mounting, the funding boom was likely to continue.

“Many investors are not security savvy,” he said. “But when your next-door neighbors go, ‘Hey, what’s up with this ransomware stuff,’ then you know that it’s reached public consciousness. From an investor’s perspective, when something hits the average person’s mind, they realize: ‘Wow. This is here to stay.’”

As cyberattacks proliferated this year, Sanjay Beri, CEO of Netskope, a cloud security startup, got a phone call. Then an email. Then more messages. All were from venture capitalists who wanted to invest in his company.

As cyberattacks proliferated this year, Sanjay Beri, CEO of Netskope, a cloud security startup, got a phone call. Then an email. Then more messages. All were from venture capitalists who wanted to invest in his company. Given the ransomware attacks and nation-state hacks that were making headlines, they told him, companies that made security products had a bigger market and mission than before. Also read | How have cyber attacks become strategy for hybrid warfare? “We weren’t looking for capital,” said Beri, who founded Netskope in 2012, but the cyberattacks “definitely increased their interest.” After bids from seven investors, Netskope raised $300 million this month at a valuation of $7.5 billion, up from a $2.8 billion valuation last year. It was one of the year’s largest cybersecurity funding rounds, but not the maximum that Netskope could have attained. “We could have raised $1 billion in capital,” Beri said. Recent cyberattacks around the world have taken down operations at gasoline pipelines, hospitals and grocery chains and potentially compromised some intelligence agencies. But they have been a bonanza for one group: cybersecurity startups. Also read | White House weighs new cybersecurity approach after failure to detect hacks Investors have poured more than $12.2 billion into startups that sell products and services such as cloud security, identify verification and privacy protection so far this year. That exceeds the $10.4 billion that cybersecurity companies raised in all of 2020 and is more than double the $4.8 billion raised in 2016, according to the research firm PitchBook, which tracks funding. Since 2019, the rise in cybersecurity funding has outpaced the increase in overall venture funding. The surge follows a slew of high-profile ransomware attacks, including against Colonial Pipeline, software maker Kaseya and meat processor JBS. When President Joe Biden met with Russian President Vladimir Putin last month, cyberattacks perpetrated by Russians were high on the diplomatic agenda. This month, the Biden administration and its allies also formally accused China of conducting hacks. The breaches have fueled concerns among companies and governments, leading to increased spending on security products. Worldwide spending on information security and related services is expected to reach $150 billion this year, up 12 per cent from a year ago, according to the research company Gartner. “Before we got to this point, we as security teams were having to go and fight for every penny we could get, and now it’s the exact opposite,” said John Turner, an information security manager at LendingTree, an online lending marketplace. Executives, he said, are asking: “Are we protected? What do you need?” All of this is set to drive business for cybersecurity companies, creating a potential windfall that has excited investors. The average valuation of cybersecurity companies raising funds this year has more than doubled to $524.1 million from $221.8 million in 2020, according to PitchBook. Also read | Biden: If US has 'real shooting war' it could be result of cyber attacks “In close to two decades as a VC, I’ve never seen valuations so escalated,” said Asheem Chandna, a venture capitalist at Greylock Partners, who has invested in security companies such as Palo Alto Networks. The money is flooding into startups that are tackling hackers in new ways. Traditionally, security systems at companies relied on the idea of securing a perimeter. That meant companies installed firewalls and other software to protect access to their corporate network. But over the past several years, a shift to cloud computing has rendered the perimeter and the reliance on corporate networks obsolete. Employees now get access to applications over the internet, rather than through a data center operated by their employer. That has opened the door to startups that focus on cloud-based security and identity verification. “Don’t build higher fences — have really good ID cards,” said Jason Crabtree, CEO of Qomplx, a risk-analytics startup that provides identity-verification software and is in the process of going public. The funding frenzy has built for months. The pandemic provided momentum when companies shifted to remote work, which required securing those remote-access systems, investors and executives said. n a Friday evening in October, Chandna introduced the CEO of Abnormal Security, an email-security company in which he had invested, to another investor, he said. That investor, Venky Ganesan of Menlo Ventures, who had been pursuing a meeting with the CEO, Evan Reiser, for months, immediately emailed Reiser to invite him to dinner that night. Reiser drove, he said, from San Francisco to Ganesan’s home in Atherton, California, about 30 miles away. By the end of the weekend, Abnormal had signed a deal to raise $50 million at a $600 million valuation, putting its total funding at $74 million. Menlo’s $40 million check was the firm’s largest investment ever. “As shotgun weddings go, it’s as shotgun as you can get,” Ganesan said. Since then, the ransomware attacks have given the funding wave a further boost. In January, Lacework, a cloud security startup in San Jose, California, garnered $525 million in funding. Investors reached out because of Lacework’s products, which use artificial intelligence to identify threats, said Andy Byron, the company’s chief resource officer. In total, Lacework has raised $625 million since it was founded in 2015. Mike Speiser, a venture capitalist at Sutter Hill Ventures, which led Lacework’s January financing, had no problem getting other investors to participate, he said. I called the five people that I thought were the best investors and asked them if they were interested. They were all interested, and within 48 hours we had a deal,” Speiser said. “One hundred percent of the people I called said they wanted in. We could have raised well over $1 billion.” Business has boomed for Lacework because of “the combination of all of these ransomware and nation-state attacks, together with people moving to the cloud so aggressively,” said David Hatfield, who joined the startup in February as CEO. Other security startups have also benefited. Orca, a cloud-security startup, raised $210 million in March. Trulioo, a company that makes sure users are who they say they are when they join a platform, collected $394 million last month. Security startups are also being acquired for large sums or are going public. Last month, SentinelOne went public with a market capitalization of over $10 billion, the highest-valued cybersecurity public offering. In May, Auth0, an identity-verification company, was bought by Okta, another security company, for $6.5 billion. Netskope's Beri said that with cybersecurity threats mounting, the funding boom was likely to continue. “Many investors are not security savvy,” he said. “But when your next-door neighbors go, ‘Hey, what’s up with this ransomware stuff,’ then you know that it’s reached public consciousness. From an investor’s perspective, when something hits the average person’s mind, they realize: ‘Wow. This is here to stay.’”

As cyberattacks surge, security startups reap the rewards

As the Pegasus nuke causes the international stir WION spoke to the NSO spokesperson after it was accused of using its Cyber spyware to surveil journalists globally. Watch the exclusive report.

Pegasus Spyware: NSO responds to allegations and says they are wrong

Israel's technology firm NSO has been accused of using its cyber spyware Pegasus to surveil journalists globally. The latest findings are part of a global investigation called the Pegasus project.

Israel's NSO accused of using Pegasus for spying

A ransomware attack had left thousands of businesses exposed in the US yesterday and the US President <a href="https://www.wionews.com/topics/joe-biden">Joe Biden</a> has now launched an investigation into this massive hit.

On Friday, nearly <a href="https://www.wionews.com/technology/cyberattack-targets-200-businesses-before-independence-day-weekend-395457">200 businesses were urged to shut down servers to avoid a ransomware attack</a> after a computing network management tool by Kaseya came under a cyberattack. Initially, the hit was analysed to have affected only 200 businesses but as the day progressed, experts realised that nearly 1,000 businesses had been targeted.

This attack targeted Kaseya, an IT and security management services provider for small and media size businesses.&nbsp;

<a href="https://www.wionews.com/videos/ransomware-attack-hits-at-least-200-us-companies-395580">WATCH |</a>

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/ransomware-attack-hits-at-least-200-us-companies-395580/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

"We are in the process of investigating the root cause of the incident with an abundance of caution but we recommend that you immediately shutdown your VSA server until you receive further notice from us," Kaseya’s Reddit message read. "It's critical that you do this immediately because one of the first things the attacker does is shutoff administrative access to the VSA."

While Kaseya analysed the threat to have been limited to "a very small percentage of our customers" who use its VSA software and are "currently estimated at fewer than 40 worldwide", a cybersecurity firm Huntress Labs found out that the attack could have targetted 1,000 businesses.

Considering the growing number of cyberattacks in the country, Joe Biden has ordered a full investigation into the matter and has instructed the experts to thoroughly check if the attack was Russia-originated.

"The initial thinking was it was not the Russian government, but we're not sure yet," Biden said as he ordered a full investigation into the matter. "I'll know better tomorrow, and if it is either with the knowledge of and/or a consequence of Russia, then I told Putin we will respond."

A ransomware attack had left thousands of businesses exposed in the US yesterday and the US President Joe Biden has now launched an investigation into this massive hit.

A ransomware attack had left thousands of businesses exposed in the US yesterday and the US President Joe Biden has now launched an investigation into this massive hit. On Friday, nearly 200 businesses were urged to shut down servers to avoid a ransomware attack after a computing network management tool by Kaseya came under a cyberattack. Initially, the hit was analysed to have affected only 200 businesses but as the day progressed, experts realised that nearly 1,000 businesses had been targeted. This attack targeted Kaseya, an IT and security management services provider for small and media size businesses. WATCH | "We are in the process of investigating the root cause of the incident with an abundance of caution but we recommend that you immediately shutdown your VSA server until you receive further notice from us," Kaseya’s Reddit message read. "It's critical that you do this immediately because one of the first things the attacker does is shutoff administrative access to the VSA." While Kaseya analysed the threat to have been limited to "a very small percentage of our customers" who use its VSA software and are "currently estimated at fewer than 40 worldwide", a cybersecurity firm Huntress Labs found out that the attack could have targetted 1,000 businesses. Considering the growing number of cyberattacks in the country, Joe Biden has ordered a full investigation into the matter and has instructed the experts to thoroughly check if the attack was Russia-originated. "The initial thinking was it was not the Russian government, but we're not sure yet," Biden said as he ordered a full investigation into the matter. "I'll know better tomorrow, and if it is either with the knowledge of and/or a consequence of Russia, then I told Putin we will respond."

Joe Biden orders investigation into ransomware attack that targetted 1,000 businesses

Nearly 200 businesses were urged to shut down servers to avoid a ransomware attack after a computing network management tool by Kaseya came under a cyberattack on Friday.<o:p></o:p>

Kaseya is an IT and security management services provider for small and media size businesses. This attack has come at a time when the US is heading towards the Independence Day holiday weekend.

<o:p>Also read | <a href="https://www.wionews.com/technology/massive-online-outages-in-recent-internet-history-392336">Massive online outages in recent internet history</a></o:p>

The company used its official account on Reddit to inform its users about the breach and warn them to immediately shut down their systems.<o:p></o:p>

"We are in the process of investigating the root cause of the incident with an abundance of caution but we recommend that you immediately shutdown your VSA server until you receive further notice from us," Kaseya’s Reddit message read. "It's critical that you do this immediately because one of the first things the attacker does is shutoff administrative access to the VSA."<o:p></o:p>

Meanwhile, the US Cybersecurity and Infrastructure Security Agency (CISA) has assured that the officials are "taking action to understand and address the recent supply-chain ransomware attack" against Kaseya. CISA, too, recommended businesses to immediately shut down their software.<o:p></o:p>

VSA is Kaseya’s software that allows companies to manage networks of computers and printers from one single source.<o:p></o:p>

Nearly 200 businesses were urged to shut down servers to avoid a ransomware attack after a computing network management tool by Kaseya came under a cyberattack on Friday.

Nearly 200 businesses were urged to shut down servers to avoid a ransomware attack after a computing network management tool by Kaseya came under a cyberattack on Friday. Kaseya is an IT and security management services provider for small and media size businesses. This attack has come at a time when the US is heading towards the Independence Day holiday weekend. Also read | Massive online outages in recent internet history The company used its official account on Reddit to inform its users about the breach and warn them to immediately shut down their systems. "We are in the process of investigating the root cause of the incident with an abundance of caution but we recommend that you immediately shutdown your VSA server until you receive further notice from us," Kaseya’s Reddit message read. "It's critical that you do this immediately because one of the first things the attacker does is shutoff administrative access to the VSA." Meanwhile, the US Cybersecurity and Infrastructure Security Agency (CISA) has assured that the officials are "taking action to understand and address the recent supply-chain ransomware attack" against Kaseya. CISA, too, recommended businesses to immediately shut down their software. VSA is Kaseya’s software that allows companies to manage networks of computers and printers from one single source.

Cyberattack targets 200 businesses before Independence Day weekend

One of Sweden's biggest supermarket chains said Saturday it had to temporarily close around 800 stores nationwide after a cyberattack blocked access to its checkouts.

"One of our subcontractors was hit by a digital attack, and that's why our checkouts aren't working any more," Coop Sweden, which accounts for around 20 percent of the sector, said in a statement.

"We regret the situation and will do all we can to reopen swiftly," the cooperative added.

Coop Sweden did not name the subcontractor or reveal the hacking method used against it beginning on Friday evening.

<a href="https://www.wionews.com/south-asia/myanmar-protesters-burn-junta-leaders-images-on-his-birthday-395520">Also Read |&nbsp;Myanmar protesters burn junta leader's images on his birthday</a>

But the attack comes as a wave of ransomware attacks has struck worldwide, especially in the United States.

Ransomware attacks typically involve locking away data in systems using encryption, making companies pay to regain access.

Last year, hackers extorted at least $18 billion using such software, according to security firm Emsisoft.

US IT company Kaseya on Friday urged customers to shut down servers running its VSA platform after dozens were hit with ransomware.

In recent weeks, such attacks have hit oil pipelines, health services and major firms, and made it onto the agenda of US President Joe Biden's June meeting with Russian counterpart Vladimir Putin.

One of Sweden's biggest supermarket chains said Saturday it had to temporarily close around 800 stores nationwide after a cyberattack blocked access to its checkouts.

One of Sweden's biggest supermarket chains said Saturday it had to temporarily close around 800 stores nationwide after a cyberattack blocked access to its checkouts. "One of our subcontractors was hit by a digital attack, and that's why our checkouts aren't working any more," Coop Sweden, which accounts for around 20 percent of the sector, said in a statement. "We regret the situation and will do all we can to reopen swiftly," the cooperative added. Coop Sweden did not name the subcontractor or reveal the hacking method used against it beginning on Friday evening. Also Read | Myanmar protesters burn junta leader's images on his birthday But the attack comes as a wave of ransomware attacks has struck worldwide, especially in the United States. Ransomware attacks typically involve locking away data in systems using encryption, making companies pay to regain access. Last year, hackers extorted at least $18 billion using such software, according to security firm Emsisoft. US IT company Kaseya on Friday urged customers to shut down servers running its VSA platform after dozens were hit with ransomware. In recent weeks, such attacks have hit oil pipelines, health services and major firms, and made it onto the agenda of US President Joe Biden's June meeting with Russian counterpart Vladimir Putin.

Major Swedish supermarket chain hit by cyberattack

Is China waging a cyberwar on India? A Chinese intruder allegedly tried to hack the websites of the Indian Defence Ministry. Palki Sharma tells you more about China's cyber warfare.

Gravitas: Chinese intruder "tried to hack" India's defence ministry

Experts are investigating after the computer systems of two central Florida hospitals showed signs of unusual activity, an official said.

The Villages Regional Hospital and the UF Health Leesburg Hospital shut down multiple systems to protect patient information during the event on Monday night, switching to pen and paper to document patient visits, news outlets report.

"We have since learned that the activity was related to a cybersecurity event," Frank Faust, a spokesman for the University of Florida's Health Central Florida, told the Orlando Sentinel.

"With regard to protected information, at this time we do not believe any patient or personnel records have been compromised or shared." Faust said information technology teams from the University of Florida were investigating.

"These types of situations take time to fully resolve," Faust said. "We are continuing to methodically investigate to delicately and precisely understand what happened, and are taking the appropriate actions to resolve any and all issues." The Villages is one of the country's largest retirement communities, with a population of more than 130,000.

(With inputs from agencies)

Experts are investigating after the computer systems of two central Florida hospitals showed signs of unusual activity, an official said. The Villages Regional Hospital and the UF Health Leesburg Hospital shut down multiple systems to protect patient information during the event on Monday night, switching to pen and paper to document patient visits, news outlets report.

Experts are investigating after the computer systems of two central Florida hospitals showed signs of unusual activity, an official said. The Villages Regional Hospital and the UF Health Leesburg Hospital shut down multiple systems to protect patient information during the event on Monday night, switching to pen and paper to document patient visits, news outlets report. "We have since learned that the activity was related to a cybersecurity event," Frank Faust, a spokesman for the University of Florida's Health Central Florida, told the Orlando Sentinel. "With regard to protected information, at this time we do not believe any patient or personnel records have been compromised or shared." Faust said information technology teams from the University of Florida were investigating. "These types of situations take time to fully resolve," Faust said. "We are continuing to methodically investigate to delicately and precisely understand what happened, and are taking the appropriate actions to resolve any and all issues." The Villages is one of the country's largest retirement communities, with a population of more than 130,000. (With inputs from agencies)

Experts look into possible cyberattack at Florida hospitals

The American subsidiary of the world's largest meat processing companies said on Monday it had been hacked, paralysing some of its operations and impacting thousands of workers in Australia.

The intrusion was detected on Sunday, forcing one of the leading producers of beef and pork in the United States to suspend affected systems, and call in its IT staff and third-party experts to deal with the breach.

"JBS USA determined that it was the target of an organized cybersecurity attack, affecting some of the servers supporting its North American and Australian IT systems," the unit said in a statement.

The hack comes less than a month after a major cyberattack shut down the Colonial Pipeline network, which transports about 45 per cent of fuel consumed on the east coast of the United States.

Brazil-based JBS is a sprawling meat supplier with operations in the United States, Australia, Canada, Europe, Mexico, New Zealand and Britain.

The company's Australian facilities were said to have been paralysed by the attack, with up to 10,000 meat workers being sent home without pay, according to a union representative.

"It's affecting JBS processing facilities around (Australia)," AMIEU Queensland branch secretary Matt Journeaux told AFP. "They have stood down workers across JBS operations."

Journeaux said there was no word yet from the company on when operations will resume.

JBS Foods is one of Australia's largest meat and food processing companies and plays a key role in the country's agriculture sector, making $2.4 billion in livestock purchases each year.

In a statement to AFP, Australian Agriculture Minister David Littleproud said he was "aware of reports" of the attack but declined to comment "until further details are available."

JBS USA said it was "not aware of any evidence at this time that any customer, supplier or employee data has been compromised or misused," but the attack may cause delays for customers and suppliers.

It said its backup servers were not affected.

Colonial's multi-day shutdown in May sparked panic buying in some eastern states, and ended when the company paid $4.4 million in ransom to the hackers.

The demonstrated online vulnerabilities of US pipelines led the federal government last week to impose cybersecurity requirements on petroleum pipelines for the first time.

The new rules, imposed by the Department of Homeland Security, require pipeline operators to designate a cybersecurity coordinator who must be available at all times, and report confirmed incidences to the agency's Cybersecurity and Infrastructure Security Agency.

Pipeline owners will also be required to review their procedures and identify cybersecurity gaps and ways to fix them, with the results reported to the department within 30 days.

"The cybersecurity landscape is constantly evolving and we must adapt to address new and emerging threats," Homeland Security Secretary Alejandro Mayorkas said in a statement on Thursday.

The American subsidiary of the world's largest meat processing companies said on Monday it had been hacked, paralysing some of its operations and impacting thousands of workers in Australia.

The American subsidiary of the world's largest meat processing companies said on Monday it had been hacked, paralysing some of its operations and impacting thousands of workers in Australia. The intrusion was detected on Sunday, forcing one of the leading producers of beef and pork in the United States to suspend affected systems, and call in its IT staff and third-party experts to deal with the breach. "JBS USA determined that it was the target of an organized cybersecurity attack, affecting some of the servers supporting its North American and Australian IT systems," the unit said in a statement. The hack comes less than a month after a major cyberattack shut down the Colonial Pipeline network, which transports about 45 per cent of fuel consumed on the east coast of the United States. Brazil-based JBS is a sprawling meat supplier with operations in the United States, Australia, Canada, Europe, Mexico, New Zealand and Britain. The company's Australian facilities were said to have been paralysed by the attack, with up to 10,000 meat workers being sent home without pay, according to a union representative. "It's affecting JBS processing facilities around (Australia)," AMIEU Queensland branch secretary Matt Journeaux told AFP. "They have stood down workers across JBS operations." Journeaux said there was no word yet from the company on when operations will resume. JBS Foods is one of Australia's largest meat and food processing companies and plays a key role in the country's agriculture sector, making $2.4 billion in livestock purchases each year. In a statement to AFP, Australian Agriculture Minister David Littleproud said he was "aware of reports" of the attack but declined to comment "until further details are available." JBS USA said it was "not aware of any evidence at this time that any customer, supplier or employee data has been compromised or misused," but the attack may cause delays for customers and suppliers. It said its backup servers were not affected. Colonial's multi-day shutdown in May sparked panic buying in some eastern states, and ended when the company paid $4.4 million in ransom to the hackers. The demonstrated online vulnerabilities of US pipelines led the federal government last week to impose cybersecurity requirements on petroleum pipelines for the first time. The new rules, imposed by the Department of Homeland Security, require pipeline operators to designate a cybersecurity coordinator who must be available at all times, and report confirmed incidences to the agency's Cybersecurity and Infrastructure Security Agency. Pipeline owners will also be required to review their procedures and identify cybersecurity gaps and ways to fix them, with the results reported to the department within 30 days. "The cybersecurity landscape is constantly evolving and we must adapt to address new and emerging threats," Homeland Security Secretary Alejandro Mayorkas said in a statement on Thursday.

US subsidiary of meat-packing giant JBS hit by cyberattack

A newly disclosed effort by Russian intelligence to hijack the email system of a U.S. government agency prompted leading Democrats on Friday to urge stronger action against Moscow for accelerating cyberattacks before President Joe Biden’s summit next month with President Vladimir Putin.

The latest hack was brought to light late Thursday by Microsoft and other private firms. They exposed how Russia’s SVR, the same intelligence agency that Washington has blamed for a range of cyberattacks on American networks over the past decade, infiltrated a communications company that distributes emails on behalf of the U.S. Agency for International Development.

Using that access, the hackers sent authentic-looking messages to human rights groups, nonprofit organizations and think tanks, including some that have been critical of Putin. The emails contained links to malware that gave the Russians access to the recipients’ computer networks.

The White House on Friday played down the severity of the attack, saying it was typical of daily cyberconflict. Officials said the fact that the attack had been caught quickly and neutralized — chiefly by Microsoft, which acted when it saw fake emails being sent — was evidence that enhanced defenses being deployed to defend government networks were beginning to show results.

But the timing was striking, and added to the sense that the scope of cyberattacks emanating from Russia — ranging from the most sophisticated to the most embarrassing, as seen in the ease with which hackers got into the email system used by the aid agency — is expanding rapidly despite warnings and retaliation from Washington.

A month ago, Biden imposed economic sanctions on Russia and expelled diplomats in response to one of the most sophisticated attacks ever seen on the “supply chain” of software that government and private sector networks rely on — one that gave Russian intelligence wide access to 18,000 networks. While the Russians used the access only to enter about 150 government agencies and companies, the attack demonstrated that it was possible to corrupt regularly scheduled software updates of the kind that government agencies and companies rely on to keep their systems current.

Then, this month, came a ransomware attack on Colonial Pipeline, carried out by a criminal group that Biden said was based in Russia. The pipeline was shut down for days, prompting panic-buying, long lines at the pump and shuttering gas stations across the Southeast. Colonial paid a $4.4 million ransom, and the attack underscored the vulnerability of the United States’ critical infrastructure.

The latest attack, at a moment of heightened tension with Russia, was more basic, but it focused further attention on why the United States has not been able to deter the wave of attacks by making its adversaries pay a higher price for them.

Rep. Adam Schiff, D-Calif., chairman of the House Intelligence Committee, argued that years of efforts to deter such attacks from Russia were failing.

“If Moscow is responsible, this brazen act of utilizing emails associated with the U.S. government demonstrates that Russia remains undeterred despite sanctions following the SolarWinds attack,” Schiff said, referring to the attack last year on the software supply chain. “Those sanctions gave the administration flexibility to tighten the economic screws further if necessary — it now appears necessary.”

Sen. Mark Warner, D-Va., chair of the Senate Intelligence Committee, echoed Schiff in calling for stronger consequences. “We must make clear to Russia — and any other adversaries — that they will face consequences for this and any other malicious cyberactivity,” he said.

Biden has already said that Russia’s cyberaggression would be part of the tense conversation he planned to have with Putin on June 16 in Geneva, at a moment when the two nations are at odds over Ukraine, human rights and Russia’s new generation of nuclear weapons.

Some analysts praised the way the U.S. government was responding.

“If you look at the steps the administration is taking to both defend and deter, which are the two key things we need to do here, they are going in the right direction in a significant way we have never seen before,” said Tom Burt, a senior Microsoft official who worked with the administration on several of the recent hacks. “But they are also facing a greater threat than we have ever seen.”

But some intelligence officials argued that sanctions and more covert actions — if there have been any — were showing few signs of deterring Putin. And so Biden is seeing the same kind of robust debate inside his own White House over whether more forceful responses are necessary, whether by exposing Putin’s financial entanglements, or by conducting retaliatory cyberstrikes.

Biden has shown caution, saying last month that he “chose to be proportionate” in response to the SolarWinds attack because he did not want “to kick off a cycle of escalation and conflict with Russia.”

Some cybersecurity experts now argue that Biden should have responded more aggressively.

“The U.S. tends to get too hung up on proportionality,” said James Lewis, one such expert at the Center for Strategic and International Studies in Washington. “We were too cautious in responding to SolarWinds, and that turned out to be a mistake. The way you set boundaries is through action, not by sending them nasty, diplomatic notes.”

U.S. officials have often been reluctant to respond to cyberaggression in kind, in part because the country’s own defenses are so inadequate. “Until we are confident in our own ability to deflect Russian cyberattacks, our actions will continue to be driven by concerns over what Putin will do,” said Kiersten Todt, managing director of the Cyber Readiness Institute.

But both government officials and some experts argued that the hijacking of emails by the SVR was such bread-and-butter stuff in the modern world of constant cyberconflict that it did not mark an escalation from SolarWinds. “It’s not obvious to me that this type of attack is over the red line,” said Robert Chesney, director of the Strauss Center at the University of Texas at Austin.

In this case, Microsoft reported, the goal of the hackers was not to go after the aid agency itself. Instead, its motivation appeared to be to use emails purporting to be from the U.S. government to get inside groups that have revealed Russian disinformation campaigns, anti-corruption groups and those who have protested the poisoning, conviction and jailing of Russia’s best-known opposition leader, Alexei Navalny.

According to SecureWorks, an Atlanta cybersecurity firm tracking the attacks, the Russian hackers targeted the Atlantic Council and EU Disinfo Lab, which have both exposed several Russian disinformation campaigns.

Other targets included the Organization for Security and Cooperation in Europe, which has drawn Putin’s ire for criticizing the fairness of elections in Belarus and Ukraine; the Ukrainian Anti-Corruption Action Center, and Ireland’s Department of Foreign Affairs, according to SecureWorks.

Putin had previously described the Organization for Security and Cooperation in Europe as a “vile instrument of the West.” The fact that Russia took aim at these targets, not federal networks as it did with SolarWinds, suggested sanctions may have diverted Russia elsewhere.

“This may be Russia, and Putin specifically, saying, ‘Thanks for the sanctions — now we’re going to use America’s open and vulnerable networks for our own political purposes and vendettas,’” Todt said.

Microsoft, like other major firms involved in cybersecurity, maintains a vast sensor network to look for malicious activity on the internet, and is frequently a target itself. It was deeply involved in revealing the SolarWinds attack.

In the most recent case, Burt said that Microsoft had been tracking the hackers as they broke into a mass-email system run by a company called Constant Contact, which has the Agency for International Development as a client.

“They never had to enter a U.S. government system,” Burt said. Instead, they compromised the Constant Contact communications system and made their way into the agency’s account. That enabled them to send emails that appeared to be from the agency.

In a statement, Constant Contact, without confirming the identity of its client, suggested that hackers had used stolen security credentials to breach the agency’s Constant Contact email accounts. “This is an isolated incident,” the statement said, “and we have temporarily disabled the impacted accounts while we work in cooperation with our customer, who is working with law enforcement.”

But Russian hackers have seized on many such opportunities, intelligence officials say. Biden’s aides said that the fact that the hackers were caught so quickly underscored the need for government agencies and suppliers to adhere to new standards required by an executive order issued two weeks ago. That includes monitoring requirements that would most likely set off alarms in cases where malware is being transmitted in emails, and reporting requirements if there are attacks.

Presenting the new order this month, Anne Neuberger, Biden’s deputy national security adviser for cyber and emerging technology, said the new order would “raise the game” for anyone who wanted to do business with the federal government, and that the higher standards of security would spread through private industry. There are some signs that is already happening.

But the adversaries are also improving. Microsoft noted that the Russian attack used new tools and tradecraft in an apparent effort to avoid detection. “Some people would call this ‘espionage as usual,’ and it was,” Burt said. “But no government wants some other government living in their networks for three months.”

A newly disclosed effort by Russian intelligence to hijack the email system of a U.S. government agency prompted leading Democrats on Friday to urge stronger action against Moscow for accelerating cyberattacks before President Joe Biden’s summit next month with President Vladimir Putin.

A newly disclosed effort by Russian intelligence to hijack the email system of a U.S. government agency prompted leading Democrats on Friday to urge stronger action against Moscow for accelerating cyberattacks before President Joe Biden’s summit next month with President Vladimir Putin. The latest hack was brought to light late Thursday by Microsoft and other private firms. They exposed how Russia’s SVR, the same intelligence agency that Washington has blamed for a range of cyberattacks on American networks over the past decade, infiltrated a communications company that distributes emails on behalf of the U.S. Agency for International Development. Using that access, the hackers sent authentic-looking messages to human rights groups, nonprofit organizations and think tanks, including some that have been critical of Putin. The emails contained links to malware that gave the Russians access to the recipients’ computer networks. The White House on Friday played down the severity of the attack, saying it was typical of daily cyberconflict. Officials said the fact that the attack had been caught quickly and neutralized — chiefly by Microsoft, which acted when it saw fake emails being sent — was evidence that enhanced defenses being deployed to defend government networks were beginning to show results. But the timing was striking, and added to the sense that the scope of cyberattacks emanating from Russia — ranging from the most sophisticated to the most embarrassing, as seen in the ease with which hackers got into the email system used by the aid agency — is expanding rapidly despite warnings and retaliation from Washington. A month ago, Biden imposed economic sanctions on Russia and expelled diplomats in response to one of the most sophisticated attacks ever seen on the “supply chain” of software that government and private sector networks rely on — one that gave Russian intelligence wide access to 18,000 networks. While the Russians used the access only to enter about 150 government agencies and companies, the attack demonstrated that it was possible to corrupt regularly scheduled software updates of the kind that government agencies and companies rely on to keep their systems current. Then, this month, came a ransomware attack on Colonial Pipeline, carried out by a criminal group that Biden said was based in Russia. The pipeline was shut down for days, prompting panic-buying, long lines at the pump and shuttering gas stations across the Southeast. Colonial paid a $4.4 million ransom, and the attack underscored the vulnerability of the United States’ critical infrastructure. The latest attack, at a moment of heightened tension with Russia, was more basic, but it focused further attention on why the United States has not been able to deter the wave of attacks by making its adversaries pay a higher price for them. Rep. Adam Schiff, D-Calif., chairman of the House Intelligence Committee, argued that years of efforts to deter such attacks from Russia were failing. “If Moscow is responsible, this brazen act of utilizing emails associated with the U.S. government demonstrates that Russia remains undeterred despite sanctions following the SolarWinds attack,” Schiff said, referring to the attack last year on the software supply chain. “Those sanctions gave the administration flexibility to tighten the economic screws further if necessary — it now appears necessary.” Sen. Mark Warner, D-Va., chair of the Senate Intelligence Committee, echoed Schiff in calling for stronger consequences. “We must make clear to Russia — and any other adversaries — that they will face consequences for this and any other malicious cyberactivity,” he said. Biden has already said that Russia’s cyberaggression would be part of the tense conversation he planned to have with Putin on June 16 in Geneva, at a moment when the two nations are at odds over Ukraine, human rights and Russia’s new generation of nuclear weapons. Some analysts praised the way the U.S. government was responding. “If you look at the steps the administration is taking to both defend and deter, which are the two key things we need to do here, they are going in the right direction in a significant way we have never seen before,” said Tom Burt, a senior Microsoft official who worked with the administration on several of the recent hacks. “But they are also facing a greater threat than we have ever seen.” But some intelligence officials argued that sanctions and more covert actions — if there have been any — were showing few signs of deterring Putin. And so Biden is seeing the same kind of robust debate inside his own White House over whether more forceful responses are necessary, whether by exposing Putin’s financial entanglements, or by conducting retaliatory cyberstrikes. Biden has shown caution, saying last month that he “chose to be proportionate” in response to the SolarWinds attack because he did not want “to kick off a cycle of escalation and conflict with Russia.” Some cybersecurity experts now argue that Biden should have responded more aggressively. “The U.S. tends to get too hung up on proportionality,” said James Lewis, one such expert at the Center for Strategic and International Studies in Washington. “We were too cautious in responding to SolarWinds, and that turned out to be a mistake. The way you set boundaries is through action, not by sending them nasty, diplomatic notes.” U.S. officials have often been reluctant to respond to cyberaggression in kind, in part because the country’s own defenses are so inadequate. “Until we are confident in our own ability to deflect Russian cyberattacks, our actions will continue to be driven by concerns over what Putin will do,” said Kiersten Todt, managing director of the Cyber Readiness Institute. But both government officials and some experts argued that the hijacking of emails by the SVR was such bread-and-butter stuff in the modern world of constant cyberconflict that it did not mark an escalation from SolarWinds. “It’s not obvious to me that this type of attack is over the red line,” said Robert Chesney, director of the Strauss Center at the University of Texas at Austin. In this case, Microsoft reported, the goal of the hackers was not to go after the aid agency itself. Instead, its motivation appeared to be to use emails purporting to be from the U.S. government to get inside groups that have revealed Russian disinformation campaigns, anti-corruption groups and those who have protested the poisoning, conviction and jailing of Russia’s best-known opposition leader, Alexei Navalny. According to SecureWorks, an Atlanta cybersecurity firm tracking the attacks, the Russian hackers targeted the Atlantic Council and EU Disinfo Lab, which have both exposed several Russian disinformation campaigns. Other targets included the Organization for Security and Cooperation in Europe, which has drawn Putin’s ire for criticizing the fairness of elections in Belarus and Ukraine; the Ukrainian Anti-Corruption Action Center, and Ireland’s Department of Foreign Affairs, according to SecureWorks. Putin had previously described the Organization for Security and Cooperation in Europe as a “vile instrument of the West.” The fact that Russia took aim at these targets, not federal networks as it did with SolarWinds, suggested sanctions may have diverted Russia elsewhere. “This may be Russia, and Putin specifically, saying, ‘Thanks for the sanctions — now we’re going to use America’s open and vulnerable networks for our own political purposes and vendettas,’” Todt said. Microsoft, like other major firms involved in cybersecurity, maintains a vast sensor network to look for malicious activity on the internet, and is frequently a target itself. It was deeply involved in revealing the SolarWinds attack. In the most recent case, Burt said that Microsoft had been tracking the hackers as they broke into a mass-email system run by a company called Constant Contact, which has the Agency for International Development as a client. “They never had to enter a U.S. government system,” Burt said. Instead, they compromised the Constant Contact communications system and made their way into the agency’s account. That enabled them to send emails that appeared to be from the agency. In a statement, Constant Contact, without confirming the identity of its client, suggested that hackers had used stolen security credentials to breach the agency’s Constant Contact email accounts. “This is an isolated incident,” the statement said, “and we have temporarily disabled the impacted accounts while we work in cooperation with our customer, who is working with law enforcement.” But Russian hackers have seized on many such opportunities, intelligence officials say. Biden’s aides said that the fact that the hackers were caught so quickly underscored the need for government agencies and suppliers to adhere to new standards required by an executive order issued two weeks ago. That includes monitoring requirements that would most likely set off alarms in cases where malware is being transmitted in emails, and reporting requirements if there are attacks. Presenting the new order this month, Anne Neuberger, Biden’s deputy national security adviser for cyber and emerging technology, said the new order would “raise the game” for anyone who wanted to do business with the federal government, and that the higher standards of security would spread through private industry. There are some signs that is already happening. But the adversaries are also improving. Microsoft noted that the Russian attack used new tools and tradecraft in an apparent effort to avoid detection. “Some people would call this ‘espionage as usual,’ and it was,” Burt said. “But no government wants some other government living in their networks for three months.”

Top Democrats call for stronger action against Russia after latest cyberattack

Colonial Pipeline, the major US pipeline network hit by cyber attack recently said on Tuesday that one of its servers was disrupted. But the company maintained that delivery of petroleum products was not affected.

Colonial announced last Thursday that it had restarted its entire network and resumed fuel deliveries to all markets.

"Our internal server that runs our nomination system experienced intermittent disruptions this morning due to some of the hardening efforts that are ongoing and part of our restoration process," a Colonial spokesperson said on Tuesday.

"These issues were not related to the ransomware or any type of reinfection," the spokesperson said, adding,&nbsp; 
"The Colonial Pipeline system continues to deliver refined products as nominated by our shippers."&nbsp;

The pipeline's shutdown caused panic buying in the eastern United States and a spike in gasoline prices as Washington waived clean air regulations and rules on shipping and trucking to alleviate shortages.

Unknown actors last Friday shut down the servers of Darkside, which was behind the ransomware scam, amid reports Colonial paid the Russia-based cyber-extortionist millions of dollars in bitcoin.&nbsp;

(With inputs from agencies)

Colonial Pipeline, the major US pipeline network hit by cyber attack recently said on Tuesday that one of its servers was disrupted. But the company maintained that delivery of petroleum products was not affected.

Colonial Pipeline, the major US pipeline network hit by cyber attack recently said on Tuesday that one of its servers was disrupted. But the company maintained that delivery of petroleum products was not affected. Colonial announced last Thursday that it had restarted its entire network and resumed fuel deliveries to all markets. "Our internal server that runs our nomination system experienced intermittent disruptions this morning due to some of the hardening efforts that are ongoing and part of our restoration process," a Colonial spokesperson said on Tuesday. "These issues were not related to the ransomware or any type of reinfection," the spokesperson said, adding, "The Colonial Pipeline system continues to deliver refined products as nominated by our shippers." The pipeline's shutdown caused panic buying in the eastern United States and a spike in gasoline prices as Washington waived clean air regulations and rules on shipping and trucking to alleviate shortages. Unknown actors last Friday shut down the servers of Darkside, which was behind the ransomware scam, amid reports Colonial paid the Russia-based cyber-extortionist millions of dollars in bitcoin. (With inputs from agencies)

Colonial Pipeline affected by server issue

US President Joe Biden took to the airways on Thursday to assure the American public that it can expect things to return to normal over the next couple of days following last Friday's cyberattack on the colonial pipeline.

US faces gas shortage after pipeline cyberattack

Cyberattack-hit top US pipeline network Colonial Pipeline said on Monday that it had begun phased restart of a giant US gasoline pipeline. The company said it hoped to restore operations by the end of the week.

The pipeline company said operations were being "brought back online in a stepwise fashion" after Saturday's complete shutdown due to a cyberattack.&nbsp;

While "the situation remains fluid and continues to evolve," the company said it has a goal of "substantially restoring operational service by the end of the week."

The affected pipeline ships gasoline and jet fuel from the Gulf Coast of Texas to the populous East Coast through 5,500 miles (8,850 kilometers) of conduit, serving 50 million consumers.

Just a few days ago Colonial Pipeline operations were crippled due to a cyberattack. It was a ransomware attack. Such an attack encrypts computer systems and seeks to extract payment.

The Federal Bureau of Investigation (FBI) identified DarkSide as the group which produced the ransomware used in the attack.

DarkSide is an enigmatic group that surfaced last year with its corporate-style approach to inserting itself into a target's computers, locking them up and demanding payment in exchange for supplying the tools to digitally unfreeze them.

The shutdown raised fears gasoline prices could shoot up ahead of the Memorial Day holiday May 31, but oil and gasoline prices were little changed near 1710 GMT.

(With inputs from agencies)

Cyberattack-hit top US pipeline network Colonial Pipeline said on Monday that it had begun phased restart of a giant US gasoline pipeline. The company said it hoped to restore operations by the end of the week.

Cyberattack-hit top US pipeline network Colonial Pipeline said on Monday that it had begun phased restart of a giant US gasoline pipeline. The company said it hoped to restore operations by the end of the week. The pipeline company said operations were being "brought back online in a stepwise fashion" after Saturday's complete shutdown due to a cyberattack. While "the situation remains fluid and continues to evolve," the company said it has a goal of "substantially restoring operational service by the end of the week." The affected pipeline ships gasoline and jet fuel from the Gulf Coast of Texas to the populous East Coast through 5,500 miles (8,850 kilometers) of conduit, serving 50 million consumers. Just a few days ago Colonial Pipeline operations were crippled due to a cyberattack. It was a ransomware attack. Such an attack encrypts computer systems and seeks to extract payment. The Federal Bureau of Investigation (FBI) identified DarkSide as the group which produced the ransomware used in the attack. DarkSide is an enigmatic group that surfaced last year with its corporate-style approach to inserting itself into a target's computers, locking them up and demanding payment in exchange for supplying the tools to digitally unfreeze them. The shutdown raised fears gasoline prices could shoot up ahead of the Memorial Day holiday May 31, but oil and gasoline prices were little changed near 1710 GMT. (With inputs from agencies)

Colonial pipeline to restore Gasoline flow this week

Hit by a cyberattack, the operator of a major US fuel pipeline said it hopes to have services mostly restored by the end of the week as the FBI and administration officials identified the culprits as a gang of criminal hackers. US officials sought to soothe concerns about price spikes or damage to the economy by stressing that the fuel supply had so far not experienced widespread disruptions, and the company said Monday that it was working toward substantially restoring operational service by the weekend.

The White House said in a statement late Monday that it was monitoring supply shortages in parts of the Southeast and that President Joe Biden had directed federal agencies to bring their resources to bear.

Colonial Pipeline, which delivers about 45% of the fuel consumed on the East Coast, halted operations last week after revealing a ransomware attack that it said had affected some of its systems.

Nonetheless, the attack underscored the vulnerabilities of the nation’s energy sector and other critical industries whose infrastructure is largely privately owned. Ransomware attacks are typically carried out by criminal hackers who scramble data, paralyzing victim networks, and demand large payments to decrypt it.

The Colonial attack was a potent reminder of the real-world implications of the burgeoning threat. Even as the Biden administration works to confront organized hacking campaigns sponsored by foreign governments, it must still contend with difficult-to-prevent attacks from cybercriminals.

We need to invest to safeguard our critical infrastructure, Biden said Monday. Energy Secretary Jennifer Granholm said the attack tells you how utterly vulnerable we are to cyberattacks on US infrastructure.

The attack came as the administration, still grappling with its response to massive breaches by Russia of federal agencies and private corporations, works on an executive order aimed at bolstering cybersecurity defences. The Justice Department, meanwhile, has formed a ransomware task force designed for situations just like Colonial Pipeline, and the Energy Department on April 20 announced a 100-day initiative focused on protecting energy infrastructure from cyber threats. Similar actions are planned for other critical industries, such as water and natural gas.

Despite that, the challenge facing the government and the private sector remains immense.

In this case, the FBI publicly assigned blame Monday by saying the criminal syndicate whose ransomware was used in the attack is named DarkSide. The group’s members are Russian speakers, and the syndicates' malware is coded not to attack networks using Russian-language keyboards.

Anne Neuberger, the White House deputy national security adviser for cyber and emerging technology, said at a briefing that the group has been on the FBI’s radar for months. She said its business model is to demand ransom payments from victims and then split the proceeds with the ransomware developers, relying on what she said was a new and very troubling variant.

She declined to say if Colonial Pipeline had paid any ransom, and the company has not given any indication of that one way or the other. Though the FBI has historically discouraged victims from making payments for fear of promoting additional attacks, she acknowledged the very difficult situation that victims face and said the administration needs to look thoughtfully at this area” of how best to deter ransomware.

”Given the rise in ransomware, that is one area were looking at now to say, What should be the government's approach to ransomware actors and ransoms overall?

Speaking later in the day at a conference on national security, Neuberger said the administration was committed to leveraging the government’s massive buying power to ensure that software makers make their products less vulnerable to hackers.

Security can’t be an afterthought, Neuberger said. We don’t buy a car and only then decide if we want to pay for seatbelts and airbags.

The US sanctioned the Kremlin last month for a hack of federal government agencies, known as the SolarWinds breach, that officials have linked to a Russian intelligence unit and characterized as an intelligence-gathering operation.

In this case, though, the hackers are not known to be working at the behest of any foreign government. The group posted a statement on its dark website describing itself as apolitical. Our goal is to make money, and not creating problems for society, DarkSide said.

Asked Monday whether Russia was involved, Biden said, I am going to be meeting with President (Vladimir) Putin, and so far there is no evidence-based on, from our intelligence people, that Russia is involved, although there is evidence that the actors, ransomware, is in Russia.

They have some responsibility to deal with this, he added.

U.S. officials have sought to head off anxieties about the prospect of a lingering economic impact and disruption to the fuel supply, especially given Colonial Pipeline’s key role in transporting gasoline, jet fuel, diesel and other petroleum products between Texas and the East Coast.

Colonial is in the process of restarting portions of its network. It said Monday that it was evaluating the product inventory in storage tanks at its facilities. Administration officials stressed that Colonial proactively took some of its systems offline to prevent the ransomware from migrating from business computer systems to those that control and operate the pipeline.

In response to the attack, the administration loosened regulations for the transport of petroleum products on highways as part of an all-hands-on-deck effort to avoid disruptions in the fuel supply.

The time of the outage is now approaching critical levels and if it continues to remain down we do expect an increase in East Coast gasoline and diesel prices, said Debnil Chowdhury, IHS Markit Executive Director. The last time there was an outage of this magnitude was in 2016, he said when gas prices rose 15 to 20 cents per gallon. The Northeast had significantly more local refining capacity at that time.

The pipeline utilizes both common and custom technology systems, which could complicate efforts to bring the entire network back online, according to analysts at Third Bridge.

Granholm, the Energy Secretary, said Cyber attacks on our critical infrastructure especially energy infrastructure are not going away. "This is a serious example of what we're seeing across the board in many places and it tells you that we need to invest in our systems, our transmission grid for electricity. We need to invest in cyber defence in these energy systems,” she told Bloomberg TV.

The attack has not affected the supply of gasoline, she said, but if it goes on too long, of course, that will change.

Gasoline futures ticked higher Monday. Futures for crude and fuel, prices that traders pay for contracts for delivery in the future, typically begin to rise anyway each year as the driving season approaches. The price you pay at the pump tends to follow.

The average US price of regular-grade gasoline has jumped 6 cents over the past two weeks, to $3.02 per gallon, which is $1.05 higher than a year ago. The year-ago numbers are skewed somewhat because the nation was going into lockdown due to the pandemic. 
The attack on the Colonial Pipeline could exacerbate the upward pressure on prices if it is unresolved for some time.&nbsp;

Hit by a cyberattack, the operator of a major US fuel pipeline said it hopes to have services mostly restored by the end of the week as the FBI and administration officials identified the culprits as a gang of criminal hackers.

Hit by a cyberattack, the operator of a major US fuel pipeline said it hopes to have services mostly restored by the end of the week as the FBI and administration officials identified the culprits as a gang of criminal hackers. US officials sought to soothe concerns about price spikes or damage to the economy by stressing that the fuel supply had so far not experienced widespread disruptions, and the company said Monday that it was working toward substantially restoring operational service by the weekend. The White House said in a statement late Monday that it was monitoring supply shortages in parts of the Southeast and that President Joe Biden had directed federal agencies to bring their resources to bear. Colonial Pipeline, which delivers about 45% of the fuel consumed on the East Coast, halted operations last week after revealing a ransomware attack that it said had affected some of its systems. Nonetheless, the attack underscored the vulnerabilities of the nation’s energy sector and other critical industries whose infrastructure is largely privately owned. Ransomware attacks are typically carried out by criminal hackers who scramble data, paralyzing victim networks, and demand large payments to decrypt it. The Colonial attack was a potent reminder of the real-world implications of the burgeoning threat. Even as the Biden administration works to confront organized hacking campaigns sponsored by foreign governments, it must still contend with difficult-to-prevent attacks from cybercriminals. We need to invest to safeguard our critical infrastructure, Biden said Monday. Energy Secretary Jennifer Granholm said the attack tells you how utterly vulnerable we are to cyberattacks on US infrastructure. The attack came as the administration, still grappling with its response to massive breaches by Russia of federal agencies and private corporations, works on an executive order aimed at bolstering cybersecurity defences. The Justice Department, meanwhile, has formed a ransomware task force designed for situations just like Colonial Pipeline, and the Energy Department on April 20 announced a 100-day initiative focused on protecting energy infrastructure from cyber threats. Similar actions are planned for other critical industries, such as water and natural gas. Despite that, the challenge facing the government and the private sector remains immense. In this case, the FBI publicly assigned blame Monday by saying the criminal syndicate whose ransomware was used in the attack is named DarkSide. The group’s members are Russian speakers, and the syndicates' malware is coded not to attack networks using Russian-language keyboards. Anne Neuberger, the White House deputy national security adviser for cyber and emerging technology, said at a briefing that the group has been on the FBI’s radar for months. She said its business model is to demand ransom payments from victims and then split the proceeds with the ransomware developers, relying on what she said was a new and very troubling variant. She declined to say if Colonial Pipeline had paid any ransom, and the company has not given any indication of that one way or the other. Though the FBI has historically discouraged victims from making payments for fear of promoting additional attacks, she acknowledged the very difficult situation that victims face and said the administration needs to look thoughtfully at this area” of how best to deter ransomware. ”Given the rise in ransomware, that is one area were looking at now to say, What should be the government's approach to ransomware actors and ransoms overall? Speaking later in the day at a conference on national security, Neuberger said the administration was committed to leveraging the government’s massive buying power to ensure that software makers make their products less vulnerable to hackers. Security can’t be an afterthought, Neuberger said. We don’t buy a car and only then decide if we want to pay for seatbelts and airbags. The US sanctioned the Kremlin last month for a hack of federal government agencies, known as the SolarWinds breach, that officials have linked to a Russian intelligence unit and characterized as an intelligence-gathering operation. In this case, though, the hackers are not known to be working at the behest of any foreign government. The group posted a statement on its dark website describing itself as apolitical. Our goal is to make money, and not creating problems for society, DarkSide said. Asked Monday whether Russia was involved, Biden said, I am going to be meeting with President (Vladimir) Putin, and so far there is no evidence-based on, from our intelligence people, that Russia is involved, although there is evidence that the actors, ransomware, is in Russia. They have some responsibility to deal with this, he added. U.S. officials have sought to head off anxieties about the prospect of a lingering economic impact and disruption to the fuel supply, especially given Colonial Pipeline’s key role in transporting gasoline, jet fuel, diesel and other petroleum products between Texas and the East Coast. Colonial is in the process of restarting portions of its network. It said Monday that it was evaluating the product inventory in storage tanks at its facilities. Administration officials stressed that Colonial proactively took some of its systems offline to prevent the ransomware from migrating from business computer systems to those that control and operate the pipeline. In response to the attack, the administration loosened regulations for the transport of petroleum products on highways as part of an all-hands-on-deck effort to avoid disruptions in the fuel supply. The time of the outage is now approaching critical levels and if it continues to remain down we do expect an increase in East Coast gasoline and diesel prices, said Debnil Chowdhury, IHS Markit Executive Director. The last time there was an outage of this magnitude was in 2016, he said when gas prices rose 15 to 20 cents per gallon. The Northeast had significantly more local refining capacity at that time. The pipeline utilizes both common and custom technology systems, which could complicate efforts to bring the entire network back online, according to analysts at Third Bridge. Granholm, the Energy Secretary, said Cyber attacks on our critical infrastructure especially energy infrastructure are not going away. "This is a serious example of what we're seeing across the board in many places and it tells you that we need to invest in our systems, our transmission grid for electricity. We need to invest in cyber defence in these energy systems,” she told Bloomberg TV. The attack has not affected the supply of gasoline, she said, but if it goes on too long, of course, that will change. Gasoline futures ticked higher Monday. Futures for crude and fuel, prices that traders pay for contracts for delivery in the future, typically begin to rise anyway each year as the driving season approaches. The price you pay at the pump tends to follow. The average US price of regular-grade gasoline has jumped 6 cents over the past two weeks, to $3.02 per gallon, which is $1.05 higher than a year ago. The year-ago numbers are skewed somewhat because the nation was going into lockdown due to the pandemic. The attack on the Colonial Pipeline could exacerbate the upward pressure on prices if it is unresolved for some time.

Cyberattack on US pipeline: Officials hope most service will be back by weekend

The hackers that paralysed Colonial Pipeline operations have stolen a large amount of data, reported Bloomberg News citing people familiar with the matter.

The attackers, part of a cybercrime group called DarkSide and have been reported to have stolen 100 GB data in just two hours on Thursday (May 6).

The massive cyberattack forced Colonial Pipeline to shut its operations. The top pipeline network supplies nearly half of US East Coast's fuel supply.

The company transports 2.5 million barrels per day of gasoline, diesel, jet fuel and other refined products through 5,500 miles (8,850 km) of pipelines linking refiners on the Gulf Coast to the eastern and southern United States.

The cyberattack on Colonial Pipeline involved ransomware.

(With inputs from agencies)

The hackers that paralysed Colonial Pipeline operations have stolen a large amount of data, reported Bloomberg News citing people familiar with the matter. The attackers, part of a cybercrime group called DarkSide and have been reported to have stolen 100 GB data in just two hours on Thursday (May 6).

The hackers that paralysed Colonial Pipeline operations have stolen a large amount of data, reported Bloomberg News citing people familiar with the matter. The attackers, part of a cybercrime group called DarkSide and have been reported to have stolen 100 GB data in just two hours on Thursday (May 6). The massive cyberattack forced Colonial Pipeline to shut its operations. The top pipeline network supplies nearly half of US East Coast's fuel supply. The company transports 2.5 million barrels per day of gasoline, diesel, jet fuel and other refined products through 5,500 miles (8,850 km) of pipelines linking refiners on the Gulf Coast to the eastern and southern United States. The cyberattack on Colonial Pipeline involved ransomware. (With inputs from agencies)

Colonial Pipeline hackers stole large amount of data, says report

US pipeline operator Colonial Pipeline shut its entire network after a cyber attack believed to have been caused by ransomware. The pipeline network of Colonial Pipeline conveys nearly half of US East Coast's fuel supply.

The company transports 2.5 million barrels per day of gasoline, diesel, jet fuel and other refined products through 5,500 miles (8,850 km) of pipelines linking refiners on the Gulf Coast to the eastern and southern United States.

Colonial Pipelines said in its statement that it shut down systems to contain the threat after it learnt about it on Friday.

Reuters quoted a former US government official and two industry sources who said that the hackers are likely from a highly professional cybercriminal group. US government investigation is underway.

Investigators are looking into whether a group dubbed "DarkSide" by the cybersecurity research community is responsible, the former government official said.

DarkSide is known for deploying ransomware and extorting victims, while selectively avoiding targets in post-Soviet states.

The malicious software used in the attack was ransomware, two cybersecurity industry sources familiar with the matter said. Ransomware is a type of malware that is designed to lock down systems by encrypting data and demanding payment to regain access. The malware has grown in popularity over the last five years.

Colonial has engaged a third-party cybersecurity firm to launch an investigation and contacted law enforcement and other federal agencies, it said.

Cybersecurity company FireEye has been brought in to respond to the attack, the cybersecurity industry sources said. FireEye declined to comment when asked if it was working on the incident.

The U.S. Transportation Security Administration told Reuters it is working with other agencies on the situation.

Colonial did not give further details or say for how long its pipelines would be shut.

(With inputs from agencies)

US pipeline operator Colonial Pipeline shut its entire network after a cyber attack believed to have been caused by ransomware. The pipeline network of Colonial Pipeline conveys nearly half of US East Coast's fuel supply.

US pipeline operator Colonial Pipeline shut its entire network after a cyber attack believed to have been caused by ransomware. The pipeline network of Colonial Pipeline conveys nearly half of US East Coast's fuel supply. The company transports 2.5 million barrels per day of gasoline, diesel, jet fuel and other refined products through 5,500 miles (8,850 km) of pipelines linking refiners on the Gulf Coast to the eastern and southern United States. Colonial Pipelines said in its statement that it shut down systems to contain the threat after it learnt about it on Friday. Reuters quoted a former US government official and two industry sources who said that the hackers are likely from a highly professional cybercriminal group. US government investigation is underway. Investigators are looking into whether a group dubbed "DarkSide" by the cybersecurity research community is responsible, the former government official said. DarkSide is known for deploying ransomware and extorting victims, while selectively avoiding targets in post-Soviet states. The malicious software used in the attack was ransomware, two cybersecurity industry sources familiar with the matter said. Ransomware is a type of malware that is designed to lock down systems by encrypting data and demanding payment to regain access. The malware has grown in popularity over the last five years. Colonial has engaged a third-party cybersecurity firm to launch an investigation and contacted law enforcement and other federal agencies, it said. Cybersecurity company FireEye has been brought in to respond to the attack, the cybersecurity industry sources said. FireEye declined to comment when asked if it was working on the incident. The U.S. Transportation Security Administration told Reuters it is working with other agencies on the situation. Colonial did not give further details or say for how long its pipelines would be shut. (With inputs from agencies)

Top US fuel pipeline network shut down due to cyber attack

The company providing internet services for Belgium's parliament, government agencies, universities and scientific institutions said on Tuesday that its network was under cyberattack, with connections to several customers disrupted. &nbsp;

Belnet said in a statement the attack is still in progress and takes place in successive waves. Our teams are working hard to mitigate them. The company has around 200 customers.&nbsp;

Two hours later it said, the effect of the attack seems to be diminishing, but provided no other details.&nbsp;

Belgian media reported that online services for coronavirus vaccination centres were partly disrupted and that prosecutors' offices in Brussels had experienced problems.&nbsp;

Belnet Director Dirk Haex told broadcaster VRT, this is the first time that we've faced such a gigantic attack. It is tough to counter an attack like this. The company has been in operation since 1993.&nbsp;

"Everything reached a crescendo around noon," Haex said, insisting that no information was stolen. “The point of such an attack is to disable the system, not to steal information."&nbsp;

Haex said it was too early to say, who could be behind the attack. &nbsp;

(With inputs from agencies)&nbsp;

The company providing internet services for Belgium's parliament, government agencies, universities and scientific institutions said on Tuesday that its network was under cyberattack, with connections to several customers disrupted.

The company providing internet services for Belgium's parliament, government agencies, universities and scientific institutions said on Tuesday that its network was under cyberattack, with connections to several customers disrupted. Belnet said in a statement the attack is still in progress and takes place in successive waves. Our teams are working hard to mitigate them. The company has around 200 customers. Two hours later it said, the effect of the attack seems to be diminishing, but provided no other details. Belgian media reported that online services for coronavirus vaccination centres were partly disrupted and that prosecutors' offices in Brussels had experienced problems. Belnet Director Dirk Haex told broadcaster VRT, this is the first time that we've faced such a gigantic attack. It is tough to counter an attack like this. The company has been in operation since 1993. "Everything reached a crescendo around noon," Haex said, insisting that no information was stolen. “The point of such an attack is to disable the system, not to steal information." Haex said it was too early to say, who could be behind the attack. (With inputs from agencies)

Belgian government, parliament, colleges hit by cyberattack 

US Justice Department has charged 3 North Korean military intelligence officials over cyberattacks to steal $1.3 billion in cryptocurrency. The three, who are not in custody, are also accused of deploying malicious cryptocurrency programs.

US charges 3 North Korean hackers over $1.3 bn cryptocurrency attacks

As the United States comes to grips with a far-reaching Russian cyberattack on federal agencies, private corporations and the nation’s infrastructure, new evidence has emerged that the hackers hunted their victims through multiple channels.

The most significant intrusions discovered so far piggybacked on software from SolarWinds, the Austin, Texas-based company whose updates the Russians compromised. But new evidence from the security firm CrowdStrike suggests that companies that sell software on Microsoft’s behalf were also used to break into customers of Microsoft’s Office 365 software.

Because resellers are often entrusted to set up and maintain clients’ software, they — like SolarWinds — have been an ideal front for Russian hackers and a nightmare for Microsoft’s cloud customers, who are still assessing just how deep into their systems Russia’s hackers have crawled.

“They couldn’t get into Microsoft 365 directly, so they targeted the weakest point in the supply chain: the resellers,” said Glenn Chisholm, a founder of Obsidian, a cybersecurity firm.

CrowdStrike confirmed Wednesday that it was also a target of the attack. In CrowdStrike’s case, the Russians did not use SolarWinds but a Microsoft reseller, and the attack was unsuccessful. A CrowdStrike spokeswoman, Ilina Dimitrova, declined to elaborate beyond a company blog post describing the attempted attack.

The approach is not unlike the 2013 attack on Target in which hackers got in through the retailer’s heating and cooling vendor.

The latest Russian attacks, which are thought to have begun last spring, have exposed a substantial blind spot in the software supply chain. Companies can track phishing attacks and malware all they want, but as long as they are blindly trusting vendors and cloud services like Microsoft, Salesforce Google’s G-Suite, Zoom, Slack, SolarWinds and others — and giving them broad access to employee email and corporate networks — they will never be secure, cybersecurity experts say.

“These cloud services create a web of interconnections and opportunity for the attacker,” Chisholm said. “What we are witnessing now is a new wave of modern attacks against these modern cloud platforms, and we need 2021 defenses.”

Some reports have confused the latest development with a breach of Microsoft itself. But the company said it stood by its statement last week that it was not hacked, nor was it used to attack customers.

But the CrowdStrike discovery shows how the Russian hackers used its resellers to target its customers indirectly. CrowdStrike said in a blog post Wednesday that hackers tried to read the company’s emails from a reseller account but were not able to gain access to its data or systems.

U.S. officials did not detect the attack until recent weeks, and then only when a private cybersecurity firm, FireEye, alerted U.S. intelligence that the hackers had evaded layers of defenses.

It was evident that the Treasury and Commerce departments, the first agencies reported to be breached, were only part of a far larger operation whose sophistication stunned even experts who have been following a quarter-century of Russian hackings on the Pentagon and American civilian agencies.

The National Security Agency — the premier U.S. intelligence organization that both hacks into foreign networks and defends national security agencies from attacks — apparently did not know of the breach in the network-monitoring software made by SolarWinds until it was notified last week by FireEye. The National Security Agency itself uses SolarWinds software.

Two of the most embarrassing breaches came at the Pentagon and the Department of Homeland Security, whose Cybersecurity and Infrastructure Security Agency oversaw the successful defense of the U.S. election system last month.

The Russian hackers behind the attack broke into the email system used by top officials at the Treasury Department in July.

Computers at at least two dozen organizations — including Cisco, Intel, Nvidia, Deloitte and the California Department of State Hospitals — appear to have been hacked, The Wall Street Journal reported. Some of the groups, like Intel and Deloitte, said the attack did not affect their most delicate systems.

As the United States comes to grips with a far-reaching Russian cyberattack on federal agencies, private corporations and the nation’s infrastructure, new evidence has emerged that the hackers hunted their victims through multiple channels.

As the United States comes to grips with a far-reaching Russian cyberattack on federal agencies, private corporations and the nation’s infrastructure, new evidence has emerged that the hackers hunted their victims through multiple channels. The most significant intrusions discovered so far piggybacked on software from SolarWinds, the Austin, Texas-based company whose updates the Russians compromised. But new evidence from the security firm CrowdStrike suggests that companies that sell software on Microsoft’s behalf were also used to break into customers of Microsoft’s Office 365 software. Because resellers are often entrusted to set up and maintain clients’ software, they — like SolarWinds — have been an ideal front for Russian hackers and a nightmare for Microsoft’s cloud customers, who are still assessing just how deep into their systems Russia’s hackers have crawled. “They couldn’t get into Microsoft 365 directly, so they targeted the weakest point in the supply chain: the resellers,” said Glenn Chisholm, a founder of Obsidian, a cybersecurity firm. CrowdStrike confirmed Wednesday that it was also a target of the attack. In CrowdStrike’s case, the Russians did not use SolarWinds but a Microsoft reseller, and the attack was unsuccessful. A CrowdStrike spokeswoman, Ilina Dimitrova, declined to elaborate beyond a company blog post describing the attempted attack. The approach is not unlike the 2013 attack on Target in which hackers got in through the retailer’s heating and cooling vendor. The latest Russian attacks, which are thought to have begun last spring, have exposed a substantial blind spot in the software supply chain. Companies can track phishing attacks and malware all they want, but as long as they are blindly trusting vendors and cloud services like Microsoft, Salesforce Google’s G-Suite, Zoom, Slack, SolarWinds and others — and giving them broad access to employee email and corporate networks — they will never be secure, cybersecurity experts say. “These cloud services create a web of interconnections and opportunity for the attacker,” Chisholm said. “What we are witnessing now is a new wave of modern attacks against these modern cloud platforms, and we need 2021 defenses.” Some reports have confused the latest development with a breach of Microsoft itself. But the company said it stood by its statement last week that it was not hacked, nor was it used to attack customers. But the CrowdStrike discovery shows how the Russian hackers used its resellers to target its customers indirectly. CrowdStrike said in a blog post Wednesday that hackers tried to read the company’s emails from a reseller account but were not able to gain access to its data or systems. U.S. officials did not detect the attack until recent weeks, and then only when a private cybersecurity firm, FireEye, alerted U.S. intelligence that the hackers had evaded layers of defenses. It was evident that the Treasury and Commerce departments, the first agencies reported to be breached, were only part of a far larger operation whose sophistication stunned even experts who have been following a quarter-century of Russian hackings on the Pentagon and American civilian agencies. The National Security Agency — the premier U.S. intelligence organization that both hacks into foreign networks and defends national security agencies from attacks — apparently did not know of the breach in the network-monitoring software made by SolarWinds until it was notified last week by FireEye. The National Security Agency itself uses SolarWinds software. Two of the most embarrassing breaches came at the Pentagon and the Department of Homeland Security, whose Cybersecurity and Infrastructure Security Agency oversaw the successful defense of the U.S. election system last month. The Russian hackers behind the attack broke into the email system used by top officials at the Treasury Department in July. Computers at at least two dozen organizations — including Cisco, Intel, Nvidia, Deloitte and the California Department of State Hospitals — appear to have been hacked, The Wall Street Journal reported. Some of the groups, like Intel and Deloitte, said the attack did not affect their most delicate systems.

Russians are believed to have used Microsoft resellers in cyberattacks

The suspected Russian hackers responsible for the worst US cyber attack in years leveraged reseller access to Microsoft Corp services to penetrate targets that had no compromised network software from SolarWinds Corp, investigators have said.&nbsp;

Notably, the updates to SolarWinds' Orion software was previously the only known point of entry.

Security company CrowdStrike Holdings Inc said Thursday hackers had won access to the vendor that sold it Office licenses and used that to try to read CrowdStrike's email.

CrowdStrike uses Office programmes for word processing but not email. The failed attempt, made months ago, was pointed out to CrowdStrike by Microsoft on December 15.

CrowdStrike, which does not use SolarWinds, said it had found no impact from the intrusion attempt and declined to name the reseller. "They got in through the reseller's access and tried to enable mail 'read' privileges," one of the people familiar with the investigation told Reuters.&nbsp;

"If it had been using Office 365 for email, it would have been game over."&nbsp;

Many Microsoft software licenses are sold through third parties, and those companies can have near-constant access to clients' systems as the customers add products or employees. Microsoft said Thursday that those customers need to be vigilant.&nbsp;

The use of a Microsoft reseller to try to break into a top digital defense company raises new questions about how many avenues the hackers, whom US officials have alleged are operating on behalf of the Russian government, have at their disposal.

The known victims so far include CrowdStrike security rival FireEye Inc and the US Departments of Defense, State, Commerce, Treasury, and Homeland Security. Other big companies, including Microsoft and Cisco Systems Inc, said they found tainted SolarWinds software internally but had not found signs that the hackers used it to range widely on their networks. Until now, Texas-based SolarWinds was the only publicly confirmed channel for the initial break-ins, although officials have been warning for days that the hackers had other ways in.

Reuters reported a week ago that Microsoft products were used in attacks. But federal officials said they had not seen it as an initial vector, and the software giant said its systems were not utilized in the campaign.

Microsoft then hinted that its customers should still be wary. At the end of a long, technical blog post on Tuesday, it used one sentence to mention seeing hackers reach Microsoft 365 Cloud "from trusted vendor accounts where the attacker had compromised the vendor environment."

Microsoft requires its vendors to have access to client systems in order to install products and allow new users. But discovering which vendors still have access rights at any given time is so hard that CrowdStrike developed and released an auditing tool to do that. After a series of other breaches through cloud providers, including a major set of attacks attributed to Chinese government-backed hackers and known as CloudHopper, Microsoft this year imposed new controls on its resellers, including requirements for multifactor authentication.

Also Thursday, SolarWinds released an update to fix the vulnerabilities in its flagship network management software Orion following the discovery of a second set of hackers that had targeted the company's products.&nbsp;

(with inputs)

The suspected Russian hackers responsible for the worst US cyber attack in years leveraged reseller access to Microsoft Corp services to penetrate targets that had no compromised network software from SolarWinds Corp, investigators have said.

The suspected Russian hackers responsible for the worst US cyber attack in years leveraged reseller access to Microsoft Corp services to penetrate targets that had no compromised network software from SolarWinds Corp, investigators have said. Notably, the updates to SolarWinds' Orion software was previously the only known point of entry. Security company CrowdStrike Holdings Inc said Thursday hackers had won access to the vendor that sold it Office licenses and used that to try to read CrowdStrike's email. CrowdStrike uses Office programmes for word processing but not email. The failed attempt, made months ago, was pointed out to CrowdStrike by Microsoft on December 15. CrowdStrike, which does not use SolarWinds, said it had found no impact from the intrusion attempt and declined to name the reseller. "They got in through the reseller's access and tried to enable mail 'read' privileges," one of the people familiar with the investigation told Reuters. "If it had been using Office 365 for email, it would have been game over." Many Microsoft software licenses are sold through third parties, and those companies can have near-constant access to clients' systems as the customers add products or employees. Microsoft said Thursday that those customers need to be vigilant. The use of a Microsoft reseller to try to break into a top digital defense company raises new questions about how many avenues the hackers, whom US officials have alleged are operating on behalf of the Russian government, have at their disposal. The known victims so far include CrowdStrike security rival FireEye Inc and the US Departments of Defense, State, Commerce, Treasury, and Homeland Security. Other big companies, including Microsoft and Cisco Systems Inc, said they found tainted SolarWinds software internally but had not found signs that the hackers used it to range widely on their networks. Until now, Texas-based SolarWinds was the only publicly confirmed channel for the initial break-ins, although officials have been warning for days that the hackers had other ways in. Reuters reported a week ago that Microsoft products were used in attacks. But federal officials said they had not seen it as an initial vector, and the software giant said its systems were not utilized in the campaign. Microsoft then hinted that its customers should still be wary. At the end of a long, technical blog post on Tuesday, it used one sentence to mention seeing hackers reach Microsoft 365 Cloud "from trusted vendor accounts where the attacker had compromised the vendor environment." Microsoft requires its vendors to have access to client systems in order to install products and allow new users. But discovering which vendors still have access rights at any given time is so hard that CrowdStrike developed and released an auditing tool to do that. After a series of other breaches through cloud providers, including a major set of attacks attributed to Chinese government-backed hackers and known as CloudHopper, Microsoft this year imposed new controls on its resellers, including requirements for multifactor authentication. Also Thursday, SolarWinds released an update to fix the vulnerabilities in its flagship network management software Orion following the discovery of a second set of hackers that had targeted the company's products. (with inputs)

Russian hackers used Microsoft vendors to breach customers, investigators say

US President-elect Joe Biden said that he had not seen any evidence that cyberattack against the US was under control. He lashed out at US President Donald Trump for being reluctant to name Russia. US Secretary of State Mike Pompeo and Attorney General William Barr have both accused Moscow.

“It is a grave risk and it continues," Biden told reporters in Wilmington, Delaware. "I see no evidence that it’s under control. I see none. Heard of none. Department won’t even brief us on many things. So I know of nothing that suggests it’s under control."

Biden faulted Trump for stripping U.S. defenses against cyberattacks, saying: "This assault happened on Donald Trump's watch, when he wasn't watching."

Trump has floated the idea on Twitter that China might be responsible for the hacking spree. Uncovered last week, it breached at least half a dozen U.S. government agencies and left thousands of American companies exposed.

Also Read | <a href="https://www.wionews.com/world/trump-issues-series-of-pardons-including-russia-probe-figure-george-papadopoulos-351684">Trump issues series of pardons, including Russia probe figure George Papadopoulos</a>

Joe Biden has warned that the cyberattack will not go unanswered once he takes office on January 20. He said his administration will take meaningful steps to respond to the cyber breach.

The incoming White House chief of staff said on Sunday that Biden's response to the hacking campaign would go beyond sanctions. Ron Klain said Biden was mapping out ways to degrade the capacity of foreign actors to engage in cyber attacks against the United States.

Options being mulled by the Biden administration to punish Moscow for its alleged role include financial penalties and retaliatory hacks on Russian infrastructure, people familiar with the matter have told Reuters.

The Kremlin denies any role in the hacking.

"The question of the damage done remains to be determined. We have to look at, very closely, the nature of the breaches, how extensive they are, and what damage has been done," Biden said.

(With Reuters inputs)

US President-elect Joe Biden said that he had not seen any evidence that cyberattack against the US was under control. He lashed out at US President Donald Trump for being reluctant to name Russia.

US President-elect Joe Biden said that he had not seen any evidence that cyberattack against the US was under control. He lashed out at US President Donald Trump for being reluctant to name Russia. US Secretary of State Mike Pompeo and Attorney General William Barr have both accused Moscow. “It is a grave risk and it continues," Biden told reporters in Wilmington, Delaware. "I see no evidence that it’s under control. I see none. Heard of none. Department won’t even brief us on many things. So I know of nothing that suggests it’s under control." Biden faulted Trump for stripping U.S. defenses against cyberattacks, saying: "This assault happened on Donald Trump's watch, when he wasn't watching." Trump has floated the idea on Twitter that China might be responsible for the hacking spree. Uncovered last week, it breached at least half a dozen U.S. government agencies and left thousands of American companies exposed. Also Read | Trump issues series of pardons, including Russia probe figure George Papadopoulos Joe Biden has warned that the cyberattack will not go unanswered once he takes office on January 20. He said his administration will take meaningful steps to respond to the cyber breach. The incoming White House chief of staff said on Sunday that Biden's response to the hacking campaign would go beyond sanctions. Ron Klain said Biden was mapping out ways to degrade the capacity of foreign actors to engage in cyber attacks against the United States. Options being mulled by the Biden administration to punish Moscow for its alleged role include financial penalties and retaliatory hacks on Russian infrastructure, people familiar with the matter have told Reuters. The Kremlin denies any role in the hacking. "The question of the damage done remains to be determined. We have to look at, very closely, the nature of the breaches, how extensive they are, and what damage has been done," Biden said. (With Reuters inputs)

Trump must put blame on Russia for cyberattack, says Biden

cyberattack

Cyberattack, News on Cyberattack, stories on Cyberattack, articles on Cyberattack, Cyberattack stories at Wion, Cyberattack news, Cyberattack latest news