A boutique cybersecurity firm that provides the financial, health care and retail sectors with custom security services has been acquired by technology security firm GoVanguard.

Gotham Security, acquired by the firm for an undisclosed sum, was described by GoVanguard CEO Mahdi Hedhli as a close partner of some years’ standing. 

The headquarters of Gotham Security are situated a two-minute walk away from world-famous landmark the Empire State Building. The company, which specializes in professional security services and managed security SOC services, has a second office in Washington, DC. 

Gotham Security CEO Trevor Goering and COO Blake Shalem co-founded the company in 2013. Following the acquisition, Shalem will be joining GoVanguard as its chief customer officer.

She said: “This move allows us to elevate what we do best, which translates to a superior class of protection for our clients.”

GoVanguard said the acquisition would allow it to provide elite-level cybersecurity to its clients, which include Odyssey Group, nTopology, Insurance Technologies, and Abacus Group. 

“As threat actors become more sophisticated, it’s become obvious that the best defense is to go on the offensive. Adversary simulation has become increasingly valuable for organizations looking to quickly gauge and improve their security position. After all, if you can’t measure it, you can’t improve it,” said Hedhli.

“Gotham Security has been a close partner for years, and this was a natural next step to allow our red-teaming experts to take our clients’ defenses to the next level and continue our dedication to finding the security gaps before cyber-criminals do.”

Gotham offers security assessments that include penetration testing, phishing vulnerability analysis, and an evaluation of an organization’s system for weak points.

GoVanguard said that the acquisition was part of a move to provide clients with adversarial red-team tactic cybersecurity assistance that could identify and resolve vulnerabilities before cyber-criminals had a chance to strike. 

“We’re doubling down on our commitment to improve the cybersecurity landscape by honing our focus on red teaming,” Hedhli said. “We feel this is the area where GoVanguard makes the biggest impact for our clients and the industry as a whole.”

Police in Europe have arrested nearly two dozen individuals on suspicion of being part of an international group of online fraudsters.

The alleged cyber-criminals are accused of cheating companies in at least 20 countries out of approximately $1.17m.

Charges were brought against 23 individuals on August 10. The suspects were taken into custody in a series of raids simultaneously carried out at 34 addresses in Ireland, Romania, and the Netherlands. 

Europol, which coordinated the action, said the cyber-criminal gang had been running scams for years, updating its tactics to exploit current events.

“The fraud was run by an organized crime group which prior to the COVID-19 pandemic already illegally offered other fictitious products for sale online, such as wooden pellets,” said Europol in a press release. 

“Last year the criminals changed their modus operandi and started offering protective materials after the outbreak of the COVID-19 pandemic.”

The group accused of running the scams is allegedly made up of individuals hailing from various countries in Africa, who relocated to Europe. There, they created fake web pages and email addresses that allowed them to impersonate legitimate wholesale companies.

Members of the group, posing as employees of these wholesalers, would then defraud other companies by soliciting orders from them and requesting payments in advance of goods’ being shipped. 

Victims companies – most of which were located in Europe and Asia – sent the money in good faith; however, the goods they had ordered never arrived. 

Europol said that the gang’s criminal proceeds “were laundered through Romanian bank accounts controlled by the criminals before being withdrawn at ATMs.”

An ongoing investigation into the cyber-criminal gang has been supported by Europol since 2017. Assistance offered by the organization included the deployment of two of its cyber-crime experts to the raids that took place in the Netherlands to help secure relevant evidence and support Dutch authorities with cross-checking data against real-time information gathered during the operation.

This latest coordinated action against cybercrime follows an Interpol operation that led to the arrest of an alleged 45-year-old sexual predator and human trafficker on August 6 in Guatemala. The unnamed man is suspected of producing and distributing child sexual abuse material.

Nearly half (44%) of organizations have been targeted or fallen victim to a ransom-related distributed denial of service (RDDoS) attack in the past 12 months, according to a survey of 313 cybersecurity professionals by the Neustar International Security Council (NISC).

Interestingly, during the same period, a lower proportion (41%) of organizations were targeted by a ransomware attack, suggesting cyber-criminals are increasingly using DDoS attacks as a means of extorting money from victims.

Rodney Joffe, chairman of NISC, SVP and fellow, Neustar, explained: “Rather than spending a lot of time and careful planning on infecting an organization’s network with malware or ransomware, cyber-criminals are taking an easier approach and using DDoS as a ransom vector. For bad actors, launching a DDoS attack is relatively simple and also has the added benefit of being harder to trace back to its origin.”

The research indicates that this is an effective ransom tactic; 70% of organizations hit by RDDoS were targeted multiple times, and 36% admitted they paid the ransom. This compares to 57% of those infected by ransomware being targeted on multiple occasions, with the same proportion (36%) choosing to pay the ransom.

Neustar added that while RDDoS threats have traditionally targeted online industries, attackers are increasingly turning their attention to other sectors, including financial services, government and telecoms.

Worryingly, less than a quarter (24%) of cybersecurity professionals said they were ‘very confident’ in their organization’s knowledge of how to respond to an RDDoS attack. The respondents listed ransomware (70%), DDoS (68%) and targeted hacking (66%) as the most increasing cyber-threats to their organization.

Joffe commented, “It’s common for organizations to feel pressure to pay to get their website back up and running and avoid disruption. However, with attackers targeting the same company multiple times, paying the ransom only makes it more likely that you will fall victim again. Instead, businesses must take an ‘always on’ approach to DDoS security, ensuring that their site remains protected even in the event of an attack.”

Global consulting firm Accenture has been the target of ransomware group Lockbit, with the gang reportedly taking encrypted data from the company.

Lockbit says it will publish the data if Accenture does not pay the ransom, according to screenshots of the ransomware group’s website. Infosecurity has asked Accenture for a comment on the ransomware attack.

In a statement provided to CNN, an Accenture spokesperson told the international outlet., “Through our security controls and protocols, we identified irregular activity in one of our environments. We immediately contained the matter and isolated the affected servers.”

This data breach comes after the Australian Cyber Security Centre (ACSC) alerted organizations in the country that cybercriminals were frequently using Lockbit 2.0 ransomware. “The ACSC has received reporting from several Australian organizations that have been impacted by LockBit 2.0 ransomware,” explains the alert. “This activity has occurred across multiple industry sectors.

“Victims have received demands for ransom payments. In addition to data encryption, victims have received threats that data stolen during the incidents will be published.”

What is Lockbit 2.0?

Lockbit 2.0 was rolled out earlier this month — the latest version of the ransomware — and implements lots of additional features.

“With the recent international efforts on fighting ransomware, those gangs are finding it difficult to advertise their malware in hacking forums,” explains Felipe Duarte, security researcher, Appgate.  “A few posts from this new version of LockBit were spotted on a few forums frequented by cybercrime gangs, but they were quickly removed. This version is currently advertised on a new version of their website.

“Our team got access to LockBit’s deep-web site, where the ad is published along with data from victims that refused to pay the ransom,” continues Duarte. “Among the advertised capabilities is a new dangerous feature to encrypt entire Windows domains through group policies.

“After infecting a domain controller, the malware creates new group policies and pushes them to every device connected on the network. Those policies disable antivirus protections and execute the ransomware. Additionally, LockBit seems to have copied a feature from Egregor ransomware that, after a successful infection, sends to all connected printers a command to repeatedly print the ransom note.”

Appgate explains that the new version of Lockbit adds a new strategy to acquire affiliates — after encrypting a device, it sets the wallpaper to a ransom note and claims responsibility for the attack, and points to a more detailed one note .txt file.

“Now the set wallpaper also contains a recruitment ad, promising millions of dollars to employees that provides them access to the company systems so they can launch a ransomware attack,” the security researcher explains. “According to the ad, the access can be a valid credential or even executing a threat attached in an email.

“This strategy may seem unusual at first, but it’s somewhat common for companies to get breached by employees. For example, in 2020, a Russian citizen living in the U.S. was arrested after offering $1 million to a Tesla employee to deploy ransomware in Tesla’s internal network.”

What is Accenture’s response?

At the time of reporting, Accenture had not confirmed the details of the ransomware attack to Infosecurity. However, multiple news sources appear to show  Accenture giving little weight to the attack, with the company saying that it has had “no impact” on the business.

According to ZDNet, the consultancy firm provided a statement that says, “There was no impact on Accenture’s operations or on our clients’ systems.”

However, the outlet also reports that cybercrime intelligence firm Hudson Rock says that 2,500 computers of employees and partners were compromised in the ransomware attack. Another firm, Cyble, claims to have seen a ransom demand of $50 million for six terabytes (TB) of stolen data.

What is Accenture’s response?

At the time of reporting, Accenture had not confirmed the details of the ransomware attack to Infosecurity. When asked to provide further details, a spokesperson told Infosecurity: “We aren’t providing any more comment other than the statement.”

However, from what we do know from multiple news sources, Accenture is downplaying the attack, saying it has had “no impact” on the business.

According to ZDNet, the consultancy firm provided a statement which says: “There was no impact on Accenture’s operations or on our clients’ systems.”

However, the outlet also reports that cybercrime intelligence firm Hudson Rock says that 2,500 computers of employees and partners were compromised in the ransomware attack. Another firm, Cyble, claims to have seen a ransom demand of $50 million for 6 terabytes (TB) of stolen data.

UK employees can now use one single click to flag scam emails to the National Cyber Security Centre (NCSC), with the organization already receiving 6.5 million reports from the public since its original launch.

Launched today, the NCSC says it has made it easier than ever for employees in the UK to join the fightback against email scams targeting their organizations. Guidance has been published on how IT administrators can add a new reporting tool to their organizations’ Microsoft Office 365 accounts.

According to its announcement today, the NCSC, part of GCHQ, says that by clicking the new button, employees can report “potential scams directly to the NCSC’s Suspicious Email Reporting Service (SERS). It will also report the scam to the organization’s IT team.

Since its launch in April 2020, the NCSC says that its SERS has received over 6,500,000 reports from the public. The reports have resulted in the removal of over 87,000 scam URLs. In July, it took four hours on average to remove malicious URLs in phishing emails reporting to the SERS, according to the NCSC.

“Opportunistic scams during the pandemic have demonstrated how cyber-criminals constantly find new ways to target us,” says Dr. Ian Levy, technical director, NCSC. “The good news is that you can help protect your workplace by forwarding suspected scam emails to the [SERS] from your work email account at the click of a button.

“This simple technical innovation could enable millions more people to join our mission to stop scam emails from ever reaching UK inboxes.”

According to the NCSC, typical phishing URLs identified by its experts that target business organizations include: malware, clone login pages and enterprise software spoofs. Businesses in the financial services industry are expecting email-borne attacks to increase, as reported by Infosecurity, says a report by Mimecast.

This action by the NCSC is part of its Active Cyber Defence programme. It is also working in partnership with the City of London Police and has committed to protecting organizations from cybercrime, which it says cost them over £5 million in the last 13 months.

Mike Cherry, national chair of the Federation of Small Business, welcomes this innovation: “[These] are crucial to calling time on business crime. Small achievable steps will go a long way to protect thousands of small firms from cyber attacks.

“Every year, there are almost 4 million cases of cyberattacks against small businesses in the UK, and more than 50% of these come from phishing,” he continues. “We’d encourage as many small firms as possible to look further into this NCSC tool and see how they can implement it to protect employees as well as businesses from harm. And anyone can take part, any small business, employee or self-employed person can forward attempted scam emails to report@phishing.gov.uk.”

A regulatory technology (RegTech) company has launched a new campaign to encourage UK organizations to ditch manual “outdated” identification and verification methods for regulated businesses.

SmartSearch, based in West Yorkshire, UK, launched its Electronic Verification Uncovered campaign to raise awareness of the dangers of manual ID checks. As part of the campaign, it has published its SmartSearch Index report, conducted by 3Gem Market Research, to highlight the ongoing threat of money laundering in the UK.

The research, which surveyed 500 regulated businesses in the UK in June 2021, found more than a third (34%) of regulated businesses across the financial services, legal and property sectors still make manual checks when onboarding new customers. In the legal sector, manual verification methods are still preferred, says the report, with 42% of the firms saying it’s their preference. Whereas a third (33%) of financial services, banks and estate agents confirmed they relied on manual checks.    

SmartSearch also found that almost one in ten (8.5%) firms in the property agency sector said they do not verify customer ID at all, with 10% of all firms in the report saying they carry out no checks on business customers.

John Dobson, chief executive officer, says, “It’s really important for regulated businesses to realize that when it comes to secure methods of customer ID verification, documents are high risk and should be at least supplemented with reliable low-risk electronic verification. This is not only because of the increase in money laundering and financial crime we’ve seen since the start of the pandemic but also the increasing cost of manually complying with regulations.

“Businesses need to make due diligence and Know Your Customer (KYC) obligations more efficient in terms of speed and cost, as well as remaining secure and accurate,” he continues. “That is not possible by relying on checking passports, driving licenses and council tax bills.”

When SmartSearch asked the business why they still used manual verification methods, one-third said they felt hard copy documents reassured them that the customer was genuine. “It’s that kind of belief that we are looking to overturn with our campaign, because increasingly when you’re inviting a customer to send copies of hard documents for verification, you’re actually inviting fraud in through the front door,” explains Dobson.

According to the research, businesses cite “Issues of compliance” to be behind their decisions to still use manual methods of verification. A quarter overall (24%) say it meets Anti Money Laundering (AML) obligations and a further 30% claim it’s the only way to guarantee a person’s identity.