A kindergarten teacher from Indiana has been charged with multiple counts of child exploitation and possessing child sexual abuse material (CSAM) following a cyber-tip.

An investigation was launched into the online activities of 49-year-old Brian Lee Jakes in February after a tip was sent into the National Center for Missing and Exploited Children. The tipster said that Jakes had been using the messaging app Kik to share images of children being sexually assaulted.

A search of Jakes’ residence by the Kokomo Police Department on April 13 resulted in the seizure of multiple electronic devices and DVDs. 

Court documents state that images depicting the sexual abuse of children between the ages of 4 and 9 were found to be in Jakes’ possession. The children in the images are not local to the Howard County area. 

Jakes, who taught at Elwood Haynes Elementary School, was reported as a missing person on April 14, the day after his Arundel Drive residence in Kokomo was searched. 

On April 23, the teacher was arrested by the Kokomo Police Department in an Indianapolis hospital where he had been taken on April 15 after appearing to try to take his own life at a farm in Howard County. Jakes is currently being held on a $20,000 bond. 

Jakes was charged with four counts of child exploitation, a level 4 felony, and nine counts of possession of child pornography, a level 5 felony.

Major Brian Seldon with the Kokomo Police Department described the charges leveled at Jakes as “serious in nature” and said that the police will “do what we can to protect the children of our community and any community.” 

Kelly Humes, a guardian of a child attending the school at which Jakes was employed as a kindergarten teacher, said she was “pretty angry” to learn of Jakes’ recent arrest.

“It’s not fair that he was allowed to continue teaching at the school if he’s being investigated since February,” said Humes. “He should’ve been removed from the school system immediately.”

The case concerning Jakes remains under investigation, and Kokomo police ask anyone with additional information to contact them.

Kokomo School Corporation officials wouldn’t comment on an active investigation.  

Threat researchers at Armorblox have come across two new phishing scams targeting customers of JPMorgan Chase Bank. 

Both attacks deployed social engineering and brand impersonation tactics in an attempt to steal customers’ login credentials.

While one scam involved an email that appeared to contain a credit card statement, the other impersonated a locked account workflow to falsely inform victims that access to their account had been blocked following the detection of unusual login activity.

Amorblox researchers said that the first scam “skipped spam filtering because Microsoft determined that the email was from a safe sender, to a safe recipient, or was from an email source server on the IP Allow list.”

The fraudulent email, titled “Your Credit Card Statement Is Ready,” appeared to have been sent by “Jp Morgan Chase.” Its content was fashioned to resemble genuine communications from the American national bank.

“The email contained HTML stylings similar to genuine emails sent from Chase, and included links for the victim to see their statement and make payments,” said the researchers.

Victims who clicked the links would be taken to a web page resembling the Chase login portal and asked to enter their banking account credentials.

“Attackers often bank on victims not paying enough attention to inconsistencies like the URL not being from the Chase domain for example,” said researchers. 

“They assume that because we have busy lives and over-flowing inboxes, we will click before we think.”

Researchers found that the malicious website had been registered with budget Arizonian IT service management company NameSilo, which provides hosting, email, and SSL solutions.

“Services like this are beneficial for millions of people around the world, but unfortunately also lower the bar for cybercriminals looking to launch successful phishing attacks,” noted researchers.

In the second attack, cyber-criminals impersonated the Chase Fraud Department with an email titled “URGENT: Unusual sign-in activity” that looked like it had been sent by “Chase Bank Customer Care.” Inside the email was a malicious account-verification link that victims were told to follow to restore access to their account. 

Researchers shared a useful tip for spotting a phishing attack. They said the locked account impersonation attack had different “reply-to” and “from” addresses, “which is a common adversarial technique employed in email attacks.”

A data breach at the world’s largest online music marketplace has exposed the personal details of high-profile musicians.

Information belonging to Bill Ward of Black Sabbath, Jimmy Chamberlin of the Smashing Pumpkins, and Alessandro Cortini of Nine Inch Nails was among the data exposed in the security incident at Reverb.com.

Millions of the retailer’s records were discovered online in an unsecured Elasticsearch server by independent cybersecurity consultant and securitydiscovery.com owner Volodymyr “Bob” Diachenko.

Sharing details of the breach on LinkedIn on April 23, Diachenko said he had found 5.6 million exposed Reverb.com records containing full names, email address, phone numbers, addresses, PayPal email addresses, and listing/order information. 

When the cybersecurity consultant first came across the cache of unsecured data on April 5, he wasn’t sure who it belonged to.

“At first, it wasn’t immediately clear who owns this and what type of data it is, so I put it on a shelf—until now. Since the discovery the IP with database was taken down,” said Diachenko. 

“Upon closer inspection I noticed that there are many ‘test’ emails coming from @reverb.com domain. I decided to verify shop slugs against real URLs on Reverb site and quickly confirmed the initial thought—it was all Reverb users’ data.”

Reverb.com is an online marketplace for new, used, and vintage music gear with its headquarters in Chicago, Illinois. The company was founded in 2013 by Chicago Music Exchange owner David Kalt and has more than 10 million monthly visitors. 

Diachenko said the exposure of the data could make Reverb.com users vulnerable to cybercrimes, including phishing attacks carried out over email, text, or on the phone. 

“Scammers might pose as Reverb or an associated company in an attempt to persuade victims to divulge additional information such as account login credentials or payment details,” said the consultant.

“The fact that customer shop IDs were exposed is troublesome as these can be used to make fraudulent correspondence look legitimate.”

He added that cyber-criminals could cross-reference data leaked in this breach with information exposed in other breaches to gain enough details to make their phishing attempts “extra convincing.”

Actions parents can take to protect their children from growing cyber-risks were highlighted during a webinar organized by Menlo Security and featuring insights from Nina Bual, co-author & CEO, Cyber Lite Ready, Get Set, CONNECT! Interactive Workbook.

Mike East, vice president, EMEA at Menlo, began by highlighting the expansion of the internet, which, while enriching, “sadly also we have to be painfully aware that not everything on the internet is good, and there is quite a lot of malicious intent.”

Although there have been huge advancements in the cybersecurity industry over recent years, this has been primarily aimed at protecting organizations. “But who is looking after our children? Who is looking over their shoulders to make sure they’re safe?” he asked.

East went on to note a recent Twitter poll of parents conducted by Menlo, which showed that social media was the least trusted platform in regard to their children’s internet usage. The number one concern for parents was their child meeting a stranger online. Yet despite this, 63% admitted they had not placed restrictions on their child’s use of the internet.

Bual then highlighted the substantial cyber-risks children are exposed to. She cited studies showing the enormous amount of time children are spending on non-educational resources online. Pre-COVID, those in the ‘tween’ bracket, aged between 7 and 13, spent 44 minutes a day on average, but from ages 13–17, this rose to an incredible 7 hours and 22 minutes. As a result, many youngsters are exposed to numerous harms online, including cyber-bullying, self-harm/suicide, and sexual conduct.

Worryingly, this is regularly occurring on well-known apps, such as WhatsApp, Spotify, and Pinterest.

One major issue, in the view of Bual, is that AI technology is essentially taking over the role of parenting when children are online. “AI is driving material to our children, and deciding what our children are actually looking at,” she explained.

Bual gave the example of YouTube, and parents allowing their children to sit and watch programs such as Peppa Pig to keep them occupied. She noted that children of such a young age are likely to click on other video ideas on the side, generated by AI, which can lead to highly inappropriate or even dangerous content. At this point, “I am no longer the parent, YouTube has taken over the parenting—it has decided what my child gets to view.”

For older children, the situation is even more concerning in terms of the areas they can end up in. Bual gave another example: “Put yourself in the mind of a 15-year-old girl who’s feeling worried about her weight. She starts Googling healthy eating. Her AI’s then going to start travelling in that direction and if you follow certain accounts, you may end up on pro-anorexia sites. These sites have a cult-like following on apps such as TikTok.”

Bual also described the risk of online grooming on sites such as gaming. Groomers can have various motivations, ranging from sexual exploitation to indoctrination. In one case, on the popular online game Fortnite, a child struck up a friendship with someone he thought was his same age. However, he was in fact being groomed to give away information about his father, who was CEO of a large company. Bual explained: “He gained all the passwords and managed to break into the company accounts, which cost millions.”

Bual believes a mix of education and safeguarding technologies is necessary to help keep children safe from these various dangers. She said parents should be aware of a range of tools out there that can notify them when their child is engaging in potentially dangerous online behavior. These include SafeToNet, a smart keyboard that can be incorporated onto the child’s phone that uses AI “to correct their behavior as they are doing it” by filtering harmful outgoing messages, thereby helping tackle cyber-bullying. Another is Qustodio, in which parents can monitor and manage their child’s device use.

Arguably even more important in protecting against cyber-risks is education in a range of areas. In regard to recognizing ‘fake news’ online, which can lead to children’s obtaining fanatical views, Bual said it is vital youngsters are taught critical-thinking skills. One technique she advised parents to use is to show two newspapers that have opposing political views and compare the way the same story has been covered by each, discussing “why you think the facts have been reported differently, the language has been reported differently,” and “have that conversation of what you think is fake and how do you validate it.”

To help equip children to detect grooming, there are a number of steps that can be taken, such as teaching them red-alert words and questions, and getting them to consider what a child of their age would be asking them in this game.

Bual concluded: “Get your children into these digital behaviors now, get their cyber-hygiene up now.”

A ransomware group that claimed to have Apple trade secrets in its possession after compromising a supplier has reportedly deleted all mention of the extortion attempt from its dark web site.

It emerged last week that the notorious REvil group had managed to steal some schematics for Macbooks from one of Apple’s main manufacturing partners, Quanta Computer.

Reports claimed that, as the Taiwanese firm refused to pay a $50 million ransom to get the stolen data back, REvil approached Apple instead.

“Our team is negotiating the sale of large quantities of confidential drawings and gigabytes of personal data with several major brands,” the REvil operators reportedly wrote at the time. “We recommend that Apple buy back the available data by May 1.”

It was unclear how much the group was hoping to extort from the US tech giant, but a new report from MacRumors claims that all mention of the blackmail attempt has been removed from the REvil “naming and shaming” site used for such purposes.

As the report clarified, no additional extortion threats were made public since the original demand last week.

REvil is not known for its compassion, so it would seem strange that it decided to take such unilateral action without good reason.

Like all ransomware threat groups, REvil (aka Sodinokibi) is motivated by one thing: greed. The Russian speaking cyber-criminals claimed last October to have made $100 million in a single year and that they want to earn as much as $2 billion from their activities.

With more Quanta Computer clients at risk from similar extortion schemes, it may well be on track for just such a total.

There were over 2400 ransomware incidents reported to the FBI last year, according to the agency’s latest cybercrime report.

Proofpoint is set to become the latest cybersecurity acquisition of private equity giant Thoma Bravo after a $12.3 billion deal was announced yesterday.

The all-cash deal will see Proofpoint shareholders receive $176 per share in cash, around a third more than the firm’s closing price on Friday.

The two parties are claiming that, following the deal, Proofpoint will benefit from the “flexibility” of being a private company and from the “operating capabilities, capital support and deep sector expertise” of its new owner.

In fact, Thoma Bravo has made a string of acquisitions in the cybersecurity space over recent years, snapping up Barracuda Networks, Centrify, Flexera, Imperva, McAfee, SonicWall, Sophos, Veracode, Tripwire, Venafi and many more.

Proofpoint had also been on a mini-acquisition spree before it was itself targeted, acquiring companies including Meta Networks, Cloudmark and ObserveIT.

The SaaS security player’s heritage is in email security, but in recent years it has expanded its product portfolio to include cloud application security, archiving and compliance, mobile protection and security awareness training.

Email remains the number one vector for today’s threat actors, especially since the start of the pandemic. A surge in distracted home workers using potentially unsecured devices has made email an even more attractive option.

Of the 62.6 billion cyber-threats blocked by Trend Micro last year, over 91% were email-borne.

“Proofpoint has established itself as a true powerhouse in the cybersecurity sector due to its innovative suite of market-leading products and impressive customer base of leading companies around the world,” said Chip Virnig, a partner at Thoma Bravo.

“As the sophistication of cyber-attacks continues to increase, Proofpoint is delivering the most effective solutions to help organizations protect their data and people across digital platforms. We look forward to partnering with the talented Proofpoint team and leveraging Thoma Bravo’s significant security and operational expertise to help accelerate the company’s growth.”

Washington DC’s police department has reportedly been hit by Russian-speaking ransomware threat actors who claim to have stolen sensitive information on informants.

The Babuk group has given the police three days to pay-up before it shares the data with local gangs, according to AP.

As is usually the case with “double extortion” ransomware attempts like this, the group has apparently posted screenshots of the stolen data on a dark web-hosted website.

These include intelligence reports, information on gang conflicts and the jail census, network locations accessed by Babuk and other administrative files, according to the newswire.

The District of Columbia’s Metropolitan Police Department, as it is officially known, released a short statement claiming it was “aware of unauthorized access on our server,” but failing to confirm the ransomware reports.

“While we determine the full impact and continue to review activity, we have engaged the FBI to fully investigate this matter,” it said.

Not a great deal is known about the Babuk group, although just this week it emerged that the threat actors had targeted NBA team the Houston Rockets.

In that incident it’s believed that attempts to disrupt operations with ransomware were largely mitigated, although the group did claim to have stolen 500GB of data belonging to the NBA franchise.

Babuk has also previously been reported to have breached UK government outsourcer Serco, which runs the COVID-19 Test and Trace scheme in the country.

Ransomware attacks surged 150% in 2020 versus the previous year as cyber-criminals sought to target organizations exposed operationally by the pandemic.

The Maze (20%), Egregor (15%) and Conti (15%) groups accounted for most of the attacks analyzed by Group-IB, demanding between $1 million and $2 million in ransoms.

Babuk operates via a Ransomware-as-a-Service (RaaS) model that now accounts for an estimated 64% of attacks.