Content by Mathew J. Schwartz

Abandoned Backdoors: How Malicious Infrastructure Lives On

Mathew J. Schwartz  •  January 8, 2025

How many servers are infected by web shells designed to give attackers remote access to systems, but now "phone home" to malicious infrastructure that's now abandoned or expired? Security researchers who posed that question have counted 4,000 such systems, including in government and education.

T-Mobile Sued by Washington State Over 2021 Data Breach

Mathew J. Schwartz  •  January 7, 2025

Washington state's attorney general filed a consumer protection lawsuit against T-Mobile over a massive 2021 data breach that exposed personally identifiable information for more than 79 million consumers, alleging in part the telecom failed to correctly notify victims.

China's Hacking of US Telecoms: Officials Name More Victims

Mathew J. Schwartz  •  January 6, 2025

The nine known victims of a "broad and significant cyberespionage campaign" the White House has tied to China reportedly include Charter Communications, Consolidated Communications and Windstream, as officials said the hackers' earliest known telecom network penetration began in mid-2023.

Patch Alert: Remotely Exploitable LDAP Flaws in Windows

Mathew J. Schwartz  •  January 6, 2025

Security experts are urging all organizations that use Microsoft Windows to ensure they install patches, released last month, to fix Lightweight Directory Access Protocol denial-of-service and remote code execution flaws. Researchers have released a proof-of-concept exploit for the latter flaw.

36 Chrome Extensions Compromised in Supply Chain Attack

Mathew J. Schwartz  •  January 3, 2025

A supply chain attack that subverted legitimate Google Chrome browser extensions to inject data-stealing malware is more widespread than security researchers first suspected. So far researchers have identified 36 subverted extensions collectively used by 2.6 million people.

Recapping 2024's Top Attacks: Cybercrime, Espionage and More

Mathew J. Schwartz  •  January 2, 2025

What a year 2024 has been on the cybersecurity front, showing that data breaches aren't in decline, and how attackers will exploit built-in backdoors, when they aren't simply hacking edge devices. Even so, promising efforts to boost the collective defense continue.

Arrest of US Army Soldier Tied to AT&T and Verizon Extortion

Mathew J. Schwartz  •  December 31, 2024

A serving member of the U.S. Army has been arrested on a two-count indictment tied to the theft and sale of "confidential phone records," reportedly tied to the theft of terabytes of data from AT&T, Verizon and other customers of cloud data warehousing platform Snowflake.

AT&T and Verizon Say Chinese Hackers Ejected From Networks

Mathew J. Schwartz  •  December 31, 2024

U.S. telecommunications giants AT&T and Verizon Communications believe they have finally ejected Chinese cyber espionage hackers from their networks. The White House said the "Salt Typhoon" nation-state hackers infiltrated at least nine U.S. telecoms' infrastructure, and have been hard to eject.

Hackers Launch Supply Chain Attack Against Chrome Extensions

Mathew J. Schwartz  •  December 30, 2024

Multiple Chrome browser extensions have been hacked, allowing attackers to steal the data they handle, security experts have warned. Subverted extensions include a data-loss tool built by cybersecurity startup Cyberhaven, which said attackers appeared to be targeting Facebook Ads accounts.

Ransomware Group Hits Substance Abuse Treatment Service

Mathew J. Schwartz  •  December 27, 2024

Substance abuse treatment company American Addiction Centers is warning nearly half a million patients that ransomware-wielding attackers stole their personal details, including names and Social Security numbers. The Rhysida ransomware operation claimed to perpetrate the attack.

Palo Alto Patches Exploited Firewall Denial-of-Service Flaw

Mathew J. Schwartz  •  December 27, 2024

Security giant Palo Alto Networks is pushing updates to fix a denial-of-service vulnerability in its PAN-OS device software that unauthenticated, remote attackers have been actively exploiting. The flaw can be triggered by sending firewalls "a malicious packet," which will crash the devices.

Turmoil Besets Phishing-as-a-Service Toolkit Rockstar 2FA

Mathew J. Schwartz  •  December 23, 2024

As the end of the year approaches, it's out with the old and in with the new as researchers report that Rockstar 2FA, which once facilitated prolific phishing-as-a-service hits, has crashed and burned, apparently leading many one-time users to move to rival FlowerStorm.

North Korean Hackers Tied to $1.3B in Stolen Crypto in 2024

Mathew J. Schwartz  •  December 23, 2024

Hackers tied to North Korea's cash-strapped totalitarian dictatorship this year stole a record amount of cryptocurrency, totaling $1.34 billion across 47 incidents, or about double their known haul for 2023, reported blockchain analytics firm Chainalysis.

Attack Exposure: Unpatched Cleo Managed File-Transfer Software

Mathew J. Schwartz  •  December 18, 2024

More than 1,000 Cleo managed file-transfer hosts remain internet-exposed and unpatched, despite warnings of a mass attack targeting critical vulnerabilities in the widely used software. The Clop ransomware operation, which has repeatedly targeted MFT software, claimed credit for the attacks.

Ransomware Defender Risk: 'Overconfidence' in Security Tools

Mathew J. Schwartz  •  December 17, 2024

Are your defenses against ransomware good enough to survive contact with the enemy? Don't be so sure. A new study from market researcher 451 Research finds that "overconfidence in security tooling remains an issue in the face of ransomware" for organizations that haven't yet fallen victim.