Federal authorities have brought civil and criminal actions related to a cyberattack on the Securities and Exchange Commission. The Washington Post reports: [T]he Securities and Exchange Commission alleged that the defendants launched a sophisticated cyberattack against the agency starting in 2016. Once they penetrated the SEC’s system, the hackers stole thousands of documents with sensitive, confidential information about corporations' financial conditions. They used that information to make a profit from illegal trading, prosecutors said. The indictment provides the details on what a sophisticated cyberattack includes: 7. It was further part of the conspiracy that the defendants and others employed phishing [...]

Yesterday the U.S. Department of Justice unsealed the indictment of two Chinese government hackers. The Justice Department said, Through their involvement with the APT10 Group, from at least in or about 2006 up to and including in or about 2018, Zhu and Zhang conducted global campaigns of computer intrusions targeting, among other data, intellectual property and confidential business and technological information at managed service providers (MSPs), which are companies that remotely manage the information technology infrastructure of businesses and governments around the world, more than 45 technology companies in at least a dozen U.S. states, and U.S. government agencies. The [...]

In a new findings from the University of Maryland, Baltimore County (UMBC), researchers came to a startling conclusion: Contrary to our expectations, we observed greater user susceptibility with greater phishing knowledge and awareness. We have no convincing explanation for this finding, and we do not know if it is reproducible. Nevertheless, we consider two speculations. First, it is possible that the act of falling for the phishing scheme might have increased the user’s awareness about phishing. In hindsight, it might have been wiser to have asked in the post-event survey what was the level of phishing awareness the user had [...]

On October 30, 2018, the U.S. Justice Department announced the indictment of Chinese intelligence officers and their hackers for allegedly stealing U.S. aviation and technical data. For over five years the Chinese are alleged to have stolen important aviation technology by using unauthorized access to computer systems. How did they do it? An important tool of choice was spearphishing. In order to enhance the deceptive power of their  evil emails, they used Doppelganger Domain Names.  According to the indictment: Doppelganger Domain Names, the creation and use of domain names that closely resemble legitimate domain names to trick unwitting' recipients of [...]