As we approach the unofficial end of summer, it feels there is no end to the damage hackers are inflicting on their victims. VentureBeat wrote, “Just in the last few months, we’ve seen cyberattacks of unprecedented scale and audacity.” As threat vectors grow, attacker tactics continue to evolve. Though, there is an ebb and flow to the techniques. We watched the cycle of ransomware attacks earlier this year, but Trojans seem to be trending this week. I saw multiple headlines reporting on bad actors delivering Trojans with malicious macros in phishing campaigns or inserting the Triada Trojan into modified versions of WhatsApp.

Additionally, the mobile devices of human rights activists in Bahrain were compromised with FORCEDENTRY, a never before seen exploit. Security researchers at Citizen Lab identified a zero-click exploit that deploys the notorious NSO Pegasus spyware on iPhones. And last weekend, The Record reported that nearly 2,000 exchange servers were hacked using ProxyShell exploit.

All of these attacks have defenders looking toward the future. Microsoft made headlines this week for an announcement that the company participated in a Big Tech cybersecurity-focused meeting with President Biden. Out of that meeting came news that Microsoft will invest $20 billion in cybersecurity over the next five years.

For more on how to defend against cyberthreats, explore all the content available in our library and be sure to register for our upcoming RSAC 365 Virtual Seminar on Analytics, Intelligence & Response on September 9, 2021.

Now let’s take a look at this week’s cybersecurity headlines.

Aug. 27: Infosecurity Magazine reported, “Security researchers have discovered another critical bug in IoT security camera systems that could allow attackers to hijack devices.”

Aug. 27: While law enforcement’s use of facial recognition technologies remains contentious, Amazon continues to work on improving Rekognition, its technology that is used to identify pictures and videos of famous people.

Aug. 26: “Two recent vulnerability disclosures say millions of IoT devices could be at risk and allow attackers to spy on organizations or completely control affected devices,” MyTechDecisions reported.

Aug. 26: Utah’s Department of Emergency Management is working with the Salt Lake Chamber to help businesses develop cyber incident response plans.

Aug. 25: Threatpost reported, “Hao Kou Chi pleaded guilty to four felonies in a hacker-for-hire scam that used socially engineered emails to trick people out of their credentials.”

Aug. 25: The Government Accountability Office released a report revealing that ten federal agencies intend to expand their use of facial recognition technologies despite pushback from groups concerned about efficacy and privacy concerns.

Aug. 24: WeLiveSecurity reported, “ESET researchers have recently discovered a new undocumented modular backdoor, SideWalk, being used by an APT group we’ve named SparklingGoblin; this backdoor was used during one of SparklingGoblin’s recent campaigns that targeted a computer retail company based in the USA. This backdoor shares multiple similarities with another backdoor used by the group: CROSSWALK.”

Aug. 23: CISA reported that the United States signed a Memorandum of Understanding with Singapore, an agreement that would strengthen cooperation in cybersecurity efforts and information sharing between the two countries.

Aug. 23: Cyber insurance premiums are on the rise, prompting concern among industry executives, according to news from CyberScoop.

Aug. 23: “More than a thousand web apps mistakenly exposed 38 million records on the open internet, including data from a number of Covid-19 contact tracing platforms, vaccination sign-ups, job application portals, and employee databases,” Wired reported.

Aug. 23: Disinformation campaigns could be stopped before they even begin if the research conducted by Harvard professor Joan Donovan on how to predict and squash the spread of disinformation takes hold.