cybercrime – Quantilus Innovation http://testdev1.quantilus.com AI Driven Innovation Mon, 17 Feb 2025 18:58:21 +0000 en-US hourly 1 https://wordpress.org/?v=6.2.6 http://testdev1.quantilus.com/wp-content/uploads/2023/03/Quantilus-FavIcon-1.svg cybercrime – Quantilus Innovation http://testdev1.quantilus.com 32 32 Understanding 3 Major Cyberattacks in the U.S. http://testdev1.quantilus.com/article/understanding-3-major-cyberattacks-in-the-u-s/ Mon, 18 Oct 2021 14:12:15 +0000 http://3.87.238.128/?p=7634

Understanding 3 Major Cyberattacks in the U.S.

Cyberattack.

Understanding 3 Major Cyberattacks in the U.S.

Cyberattacks have been a consistent news headline over the past few years. As a result of these attacks increasing in frequency, people are becoming more vigilant about cybersecurity measures as they realize the severe damage these attacks can produce. Cyberattacks can range widely regarding the number of victims, the type of damage done, the technology used to carry out the attack, and more. Keep reading to learn about a few of these significant cyberattacks as we break down what happened in each situation.

 

SolarWinds — Malware

SolarWinds is an IT management software for companies around the globe. As with most software providers, the company routinely releases software updates for its clients to fix bugs and improve performance. It is believed that Russian hackers carried out the SolarWinds cyberattack by using the software update as a vessel to infiltrate computers. Essentially, Russian hackers snuck malware into the software update, so when clients installed the update, the Russian malware was unknowingly downloaded onto users’ computers. Then, the hackers were able to install additional malware onto users’ computers, thus allowing them to gain access to companies’ network servers so they could spy on organizations.

 

Months passed before anyone realized the cyberattack was occurring, with up to 18,000 clients downloading the compromised software, including hospitals, higher education institutions, and government agencies. For reference, some compromised organizations were Microsoft, Intel, Nvidia, The Department of Homeland Security, and The Treasury Department. This attack is referred to as a supply chain attack because the product (in this case, the software update) was hacked before it was available to consumers. Also, the hackers streamlined the hacking process by inserting malware into the software update that was deployed to thousands of companies in a vast array of industries instead of going after companies one at a time.

 

To prevent attacks like this, companies should implement multi-factor authentication with biometrics. Basic multi-factor authentication involves something a user knows or has, which includes a username and password, as well as a mobile device. Only requiring a username and password is not very protective because hackers can easily bypass this. Multi-factor authentication with biometrics incorporates something an individual is, such as a fingerprint scan or facial and voice recognition. Biometrics are much harder for cybercriminals to circumvent.

 

Colonial Pipeline — Ransomware

One of the most familiar cyberattacks in recent memory is the Colonial Pipeline attack. The Colonial Pipeline is the longest petroleum pipeline in the U.S., stretching more than 5,500 miles, and provides gasoline to nearly half of the U.S.’s eastern coast. Cybercriminals were able to gain access to Colonial’s systems for a few reasons. First and foremost, the company did not have multi-factor authentication set up, which again is a fundamental cybersecurity practice. Additionally, the criminals accessed a leaked password found on the dark web and discovered an inactive VPN account. This created the perfect trifecta to carry out the attack.

 

After hacking into the systems, the cybercriminals used ransomware to lock Colonial out of their back-end data systems. The hackers then demanded payment in Bitcoin and claimed they would restore Colonial’s access to its systems once the payment was processed. The company responded by ceasing company operations which included halting the pipeline. Colonial ended up paying $4.4 million in Bitcoin to regain access; however, decrypting the locked data and re-opening the pipeline was a slow and intensive process. A month after Colonial completed the ransom demand, the U.S. government recovered $2.3 million of the total payment.

 

 As a result of Colonial temporarily shutting down its pipeline, consumers swiftly began panic-buying, which resulted in a slew of negative consequences. These include mass gasoline shortages, extremely long lines at gas pumps, and price increases due to the surge in demand and decrease in supply. Responsibility for this attack was claimed by the hacker group, DarkSide, an apolitical team that is believed to be centered in eastern Europe.

 

Apple — Spyware

The most recent cyberattack of the three covered in this article is the Apple spyware attack. The attack started in February 2021 and lasted until it was identified by independent researchers in September of the same year. In this situation, hackers accessed users’ devices by sending them a zero-click, malicious PDF file through iMessage. Zero-click means the malware infected victims’ devices without them even having to open the compromised file. Therefore, once hackers sent the file through iMessage, the hackers would have access to the recipient’s device, and there would be no sign that the hack is occurring.

 

This method was never seen before this attack and is believed to have been the work of the Israeli technology firm, NSO Group. Furthermore, the suspected targets for this attack were journalists and human rights activists. For reference, spyware is used to secretly collect information, data, and activity on a device through malicious software. Apple claims that these attacks cost millions, have a short lifespan, and are hyper-targeted, so the average consumer would not have to worry about being a victim. The attack impacted most Apple devices, including iPhones, iPads, Macs, and Apple watches.

 

In general, there is no clear solution to prevent zero-click spyware from infecting devices. To combat this attack, Apple quickly created a patch that would fill in the security gap. As for spyware that is not zero-click, the primary way to avoid becoming a victim is to not click on suspicious links or files.

 

As technology continues to advance, so will cyberattacks. Accordingly, cybersecurity must evolve, and companies need to be proactive about keeping up with the latest security software, researching trends in the cybercrime space, and monitoring suspicious activity. For more updates and news on cybersecurity and emerging technologies, continue to check our blog. Lastly, if you are curious how Quantilus can help your business or would like more information, contact us at info@quantilus.com, and we can set up a time to talk

Share:

More Insights

]]> Why Your Company Needs Cybersecurity http://testdev1.quantilus.com/article/why-your-company-needs-cybersecurity/ Mon, 11 Oct 2021 18:48:42 +0000 http://3.87.238.128/?p=7609

Why Your Company Needs Cybersecurity

Hacker at a computer.

Prefer to listen instead? Here’s the podcast version of this article.

Cybersecurity has been around in various capacities for a few decades, but it was not a common practice until relatively recently. It was not until 2003 that the United States established the National Cybersecurity Division—the first official unit responsible for handling cybersecurity.

 

As technology continues to advance and become more accessible to everyday consumers around the globe, the volume of cybercrimes committed is growing exponentially. Furthermore, these cyberattacks are continuing to increase in complexity and are resulting in more severe damages. However, some companies are still lagging and are not implementing adequate measures to protect themselves, their employees, and their customers.

 

To help explain why companies need cybersecurity, we enlisted the help of Rick Tracy, the Chief Security Officer at Telos Corporation. Rick shared with us some of the main reasons companies need proactive cybersecurity operations in place and how businesses can best protect themselves against the continued growth of cyberattacks. Cyberattacks include ransomware, malware, phishing, denial-of-service, fraud, and more. Continue reading to discover some of the insightful Rick shared. And, be sure to listen to our podcast episode with Rick for a deeper dive and considerations to protect your company.

Threat Landscape

Over the past few years, the threat landscape has become bombarded with countless cyberattacks daily. According to the data and trends collected on cyberattacks, especially data from the past 12-18 months, these cyberattacks will continue to increase at exponential rates. Part of this is because cyberattacks are becoming more lucrative for cybercriminals since they are figuring out new ways to extort and collect money from massive corporations, small and medium-sized businesses, as well as everyday individuals.

 

Furthermore, the shift towards remote work due to the COVID-19 pandemic exponentially increased the number of cyberattacks. For reference, the first six months of 2020 saw more cyberattacks than the entire year of 2019. Therefore, companies are now tasked with keeping remote employees’ systems, devices, and networks safe now that they are not working out of a central and more secure location, such as a company office. Some actions companies are taking to combat cyberattacks include:

 

  • Installing protection software on company computers.
  • Entering VPNs.
  • Installing multi-factor authentication.
  • Holding security training and awareness sessions.

 

Cybersecurity Should Not Be Optional

Commercial organizations run around 80% of the United States’ critical infrastructure. These commercial organizations are not mandated to have cybersecurity practices in place. Therefore, these companies can be easy targets for cybercriminals and make both the public and the government extremely vulnerable.One of the main reasons companies avoid cybersecurity comes down to money. Rick compares this to the government requiring car manufacturers to include seatbelts in all new cars in the 1960s and again in 2000 when anti-lock brakes in cars became obligatory. Not all car manufacturers wanted to produce these additional features because it cost them more money to make the vehicles. However, seat belts and anti-lock brakes are vital in keeping car patrons safe and are now the standard.

 

Rick states that this should also apply to cybersecurity. Companies may not want to implement cybersecurity practices because it’s another expense, but in order to keep people and companies safe, cybersecurity needs to be implemented and should not be optional.Moreover, it is beneficial for governments to mandate cybersecurity measures because it will help keep their information, citizens, and country protected from cyberattacks. For example, during the past year in the United States, several cyberattacks against companies have impacted millions of Americans. These include the Colonial Pipeline and SolarWinds attacks. Furthermore, the U.S. government has also been the victim of numerous attacks, including several hacks that are believed to be the work of Russian hackers.

 

Protect Your Company With Cyber Insurance

Cyber insurance is an excellent way for companies to help protect themselves if they are victims of a cyberattack. Cyber insurance not only aids businesses in complying with state and federal regulations when they experience an attack, but they also help cover the resulting fees and expenses.Cyber insurance companies are starting to require that clients follow a list of requirements to help protect themselves from attacks. This is because the volume of cyberattacks is increasing dramatically, along with the number of people impacted, the amount of money lost in each attack, and the complexity. If a company fails to comply with the best practices, the cyber insurance company will likely refuse to take the business on as a client.These best practices created by cyber insurance companies are also helping set a new gold standard, or at the very least, a minimum of how companies should be proactively protecting themselves online. Prior, companies had little to no official recommendations or instructions on the basics of cybersecurity to use for guidelines.

 

Cybersecurity is a field that is continually evolving and adapting due to the nature of technology and those who are looking to abuse it. Companies need to understand that cybersecurity is no longer an option if they want to keep their company, employees, and the public safe. As cyberattacks continue to grow in volume, the vitality of having proper cyber hygiene in place will also continue to escalate. If you are interested in more content in the realm of technology and the industry at large, be sure to check out our other QSights podcasts.

Share:

More Insights

]]> The Importance of Multi-Factor Authentication http://testdev1.quantilus.com/article/the-importance-of-multi-factor-authentication-2/ Mon, 11 Oct 2021 18:20:49 +0000 http://3.87.238.128/?p=7594

The Importance of Multi-Factor Authentication

Multi-factor authentication

Prefer to listen instead? Here’s the podcast version of this article.

The standard for gaining access to an electronic device, account, or platform has historically been through providing the correct username and password combination. The problem with usernames and passwords is that they are becoming easier for cybercriminals to crack. In fact, 86% of breaches are related to stolen credentials, or in other words, passwords. Over the years, strides have been made to help decrease the likelihood that an unauthorized individual gains access to an account or device. One of these advancements has been the introduction of multi-factor authentication.

 

To help us understand why organizations need multi-factor authentication, we enlisted the expertise of Kimberly Johnson, the VP of Product Marketing at BIO-key. Kimberly has a decade of experience working in various areas of cybersecurity, including identity and access management. In our conversation, we went over what multi-factor authentication is, how the shift towards a remote workforce has impacted how companies adopt the technology, why some companies are slow to adopt, and more. Explore key insights below from our interview about multi-factor authentication, and be sure to listen to our podcast episode with Kimberly covering the topic in greater detail.

 

 

What is Multi-Factor Authentication?

Multi-factor authentication combines at least two components that an individual knows, has, and/or are. Essentially, it’s a more secure method of determining if a user is whom they are claiming to be using something that is uniquely identifiable to said user. For example, mobile authentication is a common tactic that sends a code or pin to the valid user’s phone that must be entered after the password. Additionally, authentication also can be biometric, such as fingerprint scanning or facial recognition to identify that the person attempting access is in fact the intended user.

 

Multi-factor authentication is an additional step to increase the odds of correctly identifying individuals and granting them access to secure information. Therefore, the technology is a great tool to prevent attacks because hackers have an extra, much more challenging step to bypass, compared to just needing a username and password.

 

Furthermore, multi-factor authentication is beneficial because it prevents hackers from infiltrating entire organizations. Without multi-factor authentication, a hacker can gain entry through cracking a password, a vulnerable point, or a phishing attack. Once the hacker gets into the account, they can then easily hack into other accounts within the organization. However, with multi-factor authentication in place, it makes it nearly impossible for a hacker to move laterally across an organization and gain access to additional accounts, even if they managed to gain access to one account.

 

Targeted Attacks Through Other Companies

In the digital world, everyone and everything is connected. This also applies to companies. Hackers understand that businesses frequently outsource projects and partner with other organizations. Therefore, hackers use this to their advantage by infiltrating one company to gain access to another. For example, let’s say a large corporation hires a small advertising agency for a new digital campaign they wish to run. Hackers may then target the smaller organization because they determine that the small ad agency does not have advanced cybersecurity practices in place. Once the hackers gain access to the ad agency’s systems, they can move on to invading the large corporation since those businesses regularly share accounts, information, files, data, and more.

 

However, multi-factor authentication is a highly effective way of preventing this exact scenario from occurring. If the big corporation has multi-factor authentication in place, it becomes much more difficult for hackers to access its systems. Furthermore, this example illuminates that smaller companies are both lucrative and viable options to hack. It also shows that businesses are only as safe as the company they keep. So not only is it the company’s due diligence to implement multi-factor authentication to protect themselves, but it is also a measure of protecting other organizations in the interconnected web of the digital ecosystem.

 

Why Some Businesses Are Hesitant Towards Implementing Multi-Factor Authentication

There are a few common reasons why companies and individuals are slow to adopt multi-factor authentication. The first of which is that people do not believe it is going to happen to them. This could be because a company rationalizes that they are a small or medium-sized business, so why would a hacker waste time infiltrating their systems. For perspective, 43% of cyberattacks are against small and medium-sized businesses. Or, maybe they think their industry or services provided are not high-stakes and do not realize the magnitude of damage that can occur from an attack.

 

Another reason is that companies sometimes view multi-factor authentication as insurance, since it can be paid in monthly installments. The technology tends to cost between $1 and $4 per user per month, for an entry level package. Cost also depends on which additional features are included in the service. Commonly, companies invest in the technology, but if they do not experience a cyberattack, the company may decide it is a waste of money since it did not prevent anything, at least from their point of view. Essentially, the return on investment for multi-factor authentication can be hard to measure if no breach happens. However, if no breach occurs, then multi-factor authentication is fulfilling its purpose.

 

Lastly, it is not always straightforward to implement. It requires the expertise of IT and specifically cybersecurity professionals to properly install. This is further exacerbated by the fact that the world is experiencing a cybersecurity personnel shortage. So small and medium-sized businesses are left particularly vulnerable since it can be more difficult for them to secure adequate cybersecurity services.

 

Companies that are hesitant to implement multi-factor authentication are commonly businesses that have yet to experience a cybersecurity attack. Additionally, implementing multi-factor authentication after an attack is too late, and the damage will already be done. Companies and their leaders need to vocalize the importance of investing in multi-factor authentication before a cyberattack transpires. When it comes to cybersecurity and cyber defense, be proactive, not reactive.

If you are interested in more content in the realm of technology and the industry at large, be sure to check out our other QSights podcasts.

Share:

More Insights

]]> Cybersecurity Update September 2020: What You Should Know http://testdev1.quantilus.com/article/cybersecurity-update-september-2020-what-you-should-know/ Mon, 31 Aug 2020 15:11:33 +0000 http://3.87.238.128/?p=5342

Cybersecurity Update September 2020: What You Should Know

Cybersecurity

Prefer to listen instead? Here’s the podcast version of this article.

Quantilus Innovation continually monitors cybersecurity news and developments that could impact companies like ours—and yours. Our team has compiled useful information and resources below to grow awareness of potential threats and prevent any compromise to system. To read our previous cybersecurity roundup, click here.

With the upcoming school year and millions of young students logging into digital classrooms for the first time, cyber safety is more important than ever. On top of which, we are continuing to see widescale cyber crimes against businesses of all sizes. From data breaches against trending companies such as TikTok, to phishing emails sent to personal emails, cybercriminals are targeting all levels of the digital ecosystem at staggering rates. Below you will discover the latest news in internet safety and cybersecurity concerns, including eCommerce scams, phishing sites, bribery, and data scraping:

1. Microsoft announces 5 ways the pandemic has altered the future of cybersecurity.

2. Data breaches were up 273% in the first quarter of 2020. Find out how companies are losing billions to cybercrimes.

3. More than 235 Million TikTok, Instagram, and YouTube accounts exposed due to a massive data breach.

4. Just how many new cybersecurity threats arise every 60 seconds? (Hint, it’s more than you might think.)

5. Alert from US Officials claims hackers tied to the North Korean government are stealing hundreds of millions from banks across the world.

6. With the classrooms starting virtually across the globe, explore some internet and tech tips to keep students safe.

7. What do those mysterious seed packages and free amazon deliveries have in common? They are both considered ‘brushing’ scams.

8. U.S. Coronavius scams have officially topped the $100 million in fraud. Find out the most commonly used tactics and what states are targeted most.

9. How a Russian hacker gang targeted Tesla using malware and finding an inside employee.

10. Hackers with manners? Hackers now offer victims payment discounts, customer services, and more.

The cybersecurity specialists at Quantilus can identify your company’s susceptibility to specific external and internal threats and collaborate to mitigate the short-term and long-term risks. Call 212-768-8900 or email info@quantilus.com.

Share:

More Insights

]]> Implementing Cybersecurity During The Coronavirus Pandemic http://testdev1.quantilus.com/article/implementing-cybersecurity-during-the-coronavirus-pandemic/ Mon, 29 Jun 2020 21:55:36 +0000 http://3.87.238.128/?p=5593

Implementing Cybersecurity During The Coronavirus Pandemic

Quantilus Innovation continually monitors cybersecurity news and developments that could impact companies like ours—and yours.

Prefer to listen instead? Here’s the podcast version of this article.

Quantilus Innovation continually monitors cybersecurity news and developments that could impact companies like ours—and yours. Our team has compiled useful information and resources below to grow awareness of potential threats and prevent any compromise to systems.

Most of the working world continues to be a participant in a massive experiment on distributed, remote work structures. However, the coronavirus pandemic combined with the unprecedented, massive work-from-home shift creates another kind of threat—a breeding ground for cyber criminals to capitalize on vulnerabilities. The public health crisis has sparked a rise in cyber incidents, from phishing scams and malware to VPN DDoS attacks and vulnerabilities with teleconferencing and cloud SaaS applications, so here’s the latest on what you need to know:



Contact us to discuss penetration testing and other assessment options.

The cybersecurity specialists at Quantilus can identify your company’s susceptibility to specific external and internal threats and collaborate to mitigate the short-term and long-term risks. Call 212-768-8900 or email info@quantilus.com.

Share:

More Insights

]]>