BankInfoSecurity.com

Spear-Phishing Campaign Used RomCom Malware Variant
A phishing campaign wielding malware previously associated with Russian-speaking hackers targeted the U.K. Ministry of Defense in late 2024. It is unclear if the campaign is tied to a data leak of 600 armed personnel, civil servants, and defense contractors reported late last year.

Event to Feature Innovation Sandbox 20-Year Anniversary, DARPA, Hacking Sessions
RSAC Conference brings together thousands of cybersecurity professionals with one goal: finding innovative ways to defend enterprises. This year for the event's annual Innovation Sandbox, the stakes couldn't be bigger. This year, leading-edge projects will receive $5 million in investment funding.

Company Files Report With SEC About Incident Discovered Over the Weekend
Denver-based DaVita Inc., which runs more than 3,100 dialysis and other kidney care facilities in the U.S. and in 13 other countries, reported to the U.S. Securities and Exchange Commission that a ransomware attack over the weekend is disrupting some of its operations.

At-Bay Cyber Insurance Claims Report Finds 83% of Financial Fraud Starts With Email
Financial fraud remains the leading driver of cyberinsurance claims, with 83% of cases traced back to email-based attacks. Common tactics used to deceive employees include wiring funds to fraudulent accounts, generative AI-crafted emails, executive and vendor impersonation and BEC scams.

Senior Technology, Cybersecurity Officials Removed From Interior Department
The U.S. Department of Interior has reportedly removed several key cybersecurity and technology officials from their posts following a reported dispute with staffers from the Department of Government Efficiency over its access to government systems and sensitive federal data.

HHS Cites Security Risk Analysis Failures in Hack That Affected Nearly 300,000
A medical imaging practice with offices in New York and Connecticut has agreed to pay $350,000 to federal regulators and implement a corrective action plan to settle potential HIPAA violations uncovered in an investigation of a 2020 hacking incident that affected nearly 300,000 people.

Laboratory Services Cooperative Says 1.6 Million Patients, Workers, Others Affected
A laboratory that provides medical testing services to Planned Parenthood is notifying 1.6 million patients, workers and those who paid for healthcare on behalf of another person that their sensitive personal and health information was accessed or removed in an October 2024 hacking incident.

Domain Controllers Commandeered to Distribute Malware, Warns Microsoft
Ransomware hackers are hitting up Active Directory domain controllers to boost privileges within compromised networks, warns Microsoft. Nearly eight out of every 10 human-operated cyberattacks involves a breached domain controller. Securing the servers is a challenge.

3 Key Strategies for Security Leaders for Managing On-Premises and Cloud Identities
Machine identities now outnumber human identities 45:1, creating new security risks in an increasingly digital world. As organizations expand across hybrid and multi-cloud environments, fragmented identities become harder to manage, requiring proactive strategies to enhance security and governance.

Lowering Machine Identity Risks in AI, ML and Bot Workflows
While AI, ML and bot workflows boost efficiency, they also expand the attack surface. Over-permissioned identities, exploitable vulnerabilities and AI misuse pose significant security risks. AI-driven security tools can mitigate these risks by detecting anomalies and automating threat response.

Tailoring Machine Identity Management to Specific Industry Needs
A one-size-fits-all security approach to machine identity management cannot address the unique challenges of different industries. Instead, security strategies should be tailored to meet each industry's specific needs, including access control, continuous monitoring and compliance requirements.

Chief Information Officer Meerah Rajavel shares Palo Alto Networks' strategy for enterprise AI: securing models from the outset, combating adversarial use and leveraging increased productivity and automation to cut manual workloads across engineering, support, sales and HR.

Also: PoisonSeed Phishing Campaign, FTX Clients Face Reimbursement Hurdle
This week, Trump administration disbanded a Justice Department crypto unit, the U.S. Securities and Exchange Commission will review crypto guidance, Usual pledged up to $16M in bug bounties, a PoisonSeed phishing campaign, FTX repayment plan troubles and a Coinbase 2FA error.

Also, Oracle Denies Cloud Breach, Blames Hack on Obsolete Servers
This week, Port of Seattle notified victims, Oracle blamed hack on obsolete servers, Google and Microsoft released April patches, WK Kellogg breached, six arrested in Spain for AI-investment scam, Scattered Spider's "King Bob" pleaded guilty, SmokeLoader users busted.

California Health Plan With 6 Million Members Blames Software Configuration Error
Blue Shield of California is notifying health plan members that their protected health information was potentially shared for nearly three years with Google for advertising purposes because of the way Google Analytics online tracking tools were configured on the insurer's websites.

Incident Reporting Low, Government Study Finds
Ransomware attacks targeting U.K. organizations continued to rise last year concluded the British government despite a low reporting rate by victims. The findings come as the government is considering banning public sector organization from paying ransom and mandating incident reporting.

AI Tool Streamlines Clinical Workflows at WellSpan With Microsoft's Dragon Copilot
WellSpan Health deploys Dragon Copilot, blending voice dictation and ambient listening to ease clinician burnout. It streamlines tasks with generative AI as part of an ecosystem shift, offering hope amid high burnout rates and workforce shortages.

Chris Krebs and SentinelOne Targeted as Trump Still Trumpets 2020 Election Lies
The White House said President Trump has ordered a probe into former Cybersecurity and Infrastructure Security Agency Director Chris Krebs' government service, revoked any security clearances he holds and suspended security clearances issued to his employer, SentinelOne.

Emerging AI Tools Can Transform SOC Analysts' Jobs But Require New Sets of Skills
In a job market known for its talent shortage and skills gap, the shift to AI-based solutions represents both an opportunity and a call to action. While AI can tackle grunt work with remarkable accuracy, it also demands a new set of skills from the cybersecurity workforce.

Largest Palo Alto Purchase Since 2020 Would Aid AI Model Security and Governance
Palo Alto Networks is eyeing its largest startup deal since December 2020, with the platform giant targeting Protect AI, a startup that offers AI scanning, LLM security and gen AI red teaming. Palo Alto Networks is prepared to pay between $650 million and $700 million for Protect AI, Globes reported.