Understanding the Nuances of the EU's DORA Regulation

Akshaya Asokan • January 17, 2025

The European Union's latest regulatory framework targeting the financial sector, called the Digital Operational Resilience Act, went into effect today, aiming to strengthen the cyber resilience of financial firms - such as banks, insurers and investment firms - and avoid disruptive IT outages.

3rd Party Risk Management

Suspected Russian Cryptomixer Mastermind Trio Indicted in US

Latest

Artificial Intelligence & Machine Learning

US Export Control Rules on AI Chips Spark Backlash

Rashmi Ramesh • January 17, 2025

A decision by the Biden administration to limit international access to American-made advanced artificial intelligence chips is facing backlash from countries whose purchasing power the rule affects. New export controls seeks to choke the supply of advanced chips to China.

Government

Biden's Cybersecurity Legacy Now Hinges on Trump

Chris Riotta • January 17, 2025

President Biden’s tenure has been marked by significant efforts to tackle cybersecurity challenges, from the SolarWinds attack to Salt Typhoon, but experts say his legacy remains uncertain as the new administration faces tough decisions on upholding his initiatives.

Fraud Management & Cybercrime

ISMG Editors: UK Ransomware Reporting Mandate Sparks Debate

Anna Delaney • January 17, 2025

In this week's update, ISMG editors discussed a U.K. proposal to mandate ransomware payment reporting, tackling financial crime by bringing together fraud and AML teams, and the global AI arms race as countries compete to lead innovation while balancing regulation and ethics.

Cyberwarfare / Nation-State Attacks

US Identifies Hacking Firm Behind Salt Typhoon Telecom Hacks

David Perera • January 17, 2025

The U.S. federal government said Friday it's traced the source of Chinese hacker intrusions into telecom networks to a government contractor located in hacking hotbed Sichuan. The Department of Treasury imposed sanctions on the firm, Sichuan Juxinhe Network Technology.

Governance & Risk Management

Fortinet Users See Active Zero-Day Warnings Past and Present

Mathew J. Schwartz • January 17, 2025

Fortinet has released patches to fix a zero-day vulnerability being actively exploited by attackers. Separately, researchers are warning customers to review their infrastructure after attackers leaked configuration details - including firewall rules and plaintext VPN passwords - for 15,000 devices.

Fraud Management & Cybercrime

Biden Boosts Sanctions Powers to Target Cyber Underground

Chris Riotta • January 16, 2025

Biden’s final cybersecurity order expands sanctions authorities to better target ransomware hackers and the financial facilitators and infrastructure providers enabling their attacks, a White House official said Thursday, as the administration aims to disrupt the broader cybercrime ecosystem.

Identity & Access Management

Prove Purchases Portabl to Advance Identity Authentication

Michael Novinson • January 16, 2025

Prove’s acquisition of Philadelphia-based startup Portabl focuses on enhancing interoperability and reusable identity solutions. The move supports emerging industry standards, bridging gaps between identity verification, authentication, and payments for seamless customer experiences.

Identity & Access Management

Abandoned Online Domains Unlock Services With Google OAuth

Prajeet Nair • January 16, 2025

A security researcher purchased abandoned online domains belonging to failed startups and found he could recreate email addresses and access third-party services containing sensitive information collected by the shuttered companies by signing onto the platforms using "Sign in with Google."

Cybercrime

Breach Roundup: Microsoft Makes Security Staff Cuts

Anviksha More • January 16, 2025

This week, Microsoft laid off security staff and released Patch Tuesday, Russian hackers intensified attacks on Ukraine in 2024, Telefónica confirmed a breach, a Tennessee mortgage leader reported a breach and the Texas AG sued Allstate over driver data collection.

Blockchain & Cryptocurrency

Cryptohack Roundup: BitMEX's $100M Penalty

Rashmi Ramesh • January 16, 2025

This week, BitMEX fined $100M, prosecutors sought return of Bitfinex funds, Mango Markets shut, a Web3 attack method; pastor charged in crypto scam, CFPB proposed firms refund hack victims, 2024 crime stats, Wolf Capital co-founder's guilty plea, Thai Bitcoin miners seized and a New York AG lawsuit.

Artificial Intelligence & Machine Learning

Apple Joins the UALink Consortium for AI Chip Connectivity

David Perera , Rashmi Ramesh • January 16, 2025

Device-maker Apple joined the board of a recently incorporated industry group that aims to establish open standards for directly connecting AI accelerator chip clusters in data centers. The direct connection optimizes the parallel computing and high data throughput that make GPUs efficient.

CISO Trainings

CyberEdBoard Profiles in Leadership: Chuck Markarian

Anna Delaney • January 16, 2025

Chuck Markarian’s career began testing airplane components at Boeing. With a background in math and physical sciences, he leveraged his technical expertise and curiosity to transition into IT and eventually into security leadership. In this interview, he shares his journey and advice for others.