Cyberattacks wreak havoc on the U.K., LockBit brings big business to its knees and a massive VMware ransomware campaign. Here are the latest threats and advisories for the week of February 10, 2023.    Threat Advisories and Alerts  Massive Ransomware Campaign Targets VMware ESXi Servers  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a script for retrieving VMware ESXi servers encrypted by the massive ESXiArgs ransomware campaign. The attack began last week when cybercriminals launched their attack. At the time of writing, 2,800 servers are know to have been encrypted. As for the script, the U.S. cybersecurity organization has said, "CISA compiled this tool based on publicly available resources, including a tutorial by Enes Sonmez and Ahmet Aykac." To

(ISC)² has adopted a new approach to creating and publishing editorial content such as our news, features, opinions and other educational journalism. Helping our members navigate the cybersecurity landscape is an essential part of what we do. Creating topical, engaging and useful editorial articles is one way that we do this. It is also a popular way our members earn CPE credits as part of their continuing education journey.  Based on member feedback and changes in how members prefer to access our content, we have relaunched our editorial program, based around a new home for our educational journalism at isc2.org/News. We will be providing more and new types of content and publishing much more frequently than before. We are also

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP  In part one of this series, we discussed what lies ahead in 2023, including a rise in wiperware and ransomware attacks plus challenges with OT infrastructure and staffing shortages.   In our part two of this series, we will explore issues relating to cybersecurity insurance, data privacy, supply chain and artificial intelligence (AI) technology.  Cybersecurity Insurance   The global cybersecurity insurance market is projected to grow to U.S. $30 billion by 2027, nearly tripling in growth over five years. In 2023, we can expect the demand for cybersecurity insurance to continue to expand, however it is going to be harder to obtain. Premiums will rise, especially as more organizations become aware of the potential financial

With the ever-changing landscape of the cybersecurity industry, it is important to keep certifications current, accurate and relevant - and we need help from you, the cybersecurity professionals, who hold certifications in the field.   (ISC)² is exploring a new security management credential that is in better alignment with global standards for recognized roles and specialisms. The current CISSP-ISSMP credential is earned after obtaining a CISSP. This new certification could be obtained by a practitioner before seeking the CISSP credential.    The first step of the process is to conduct a JTA workshop, tentatively scheduled for March 13-15, 2023. We are asking that anyone who currently holds the CISSP-ISSMP or CISSP to review the current CISSP-ISSMP Exam Outline and consider

By John E. Dunn The industry is taking a fresh look at the security around multi-factor authentication (MFA) in the face of recent bypass attacks. Multi-factor authentication (MFA) is coming under sustained pressure from attackers, with a striking example being a breach that unfolded at DevOps platform CircleCi back in December.  According to a recent incident update, the attack was traced back to a single malware infection on an engineer’s laptop on December 16, which wasn’t detected by AV. This, it transpired, was a good target for compromise – the engineer had the privileges to generate production access tokens.   Attackers first hijacked a corporate SSO session which had passed 2FA, allowing them less than a week later to elevate their