Krebs warns that paying a ransom offers no verifiable guarantee that stolen data is deleted, as shown by repeat extortion of PowerSchool victims.
While nobody has alleged ShinyHunters was behind the second wave of extortion against PowerSchool users, the incident drives home the reality that there is no technical way to verify the threat actors have deleted the stolen data as promised, or prevent others from abusing the same records.
All statements by Brian Krebs ›
Krebs warns that residential proxies are very commonly found on government and corporate networks, not just consumer devices.
As risky as residential proxies can be for unsuspecting end users, they are all too commonly found on government and corporate networks.
Krebs argues that residential proxy services are a major source of malicious traffic, including account takeover, ad fraud and AI-driven scraping.
As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover activity, advertising fraud, and mass content scraping for AI projects.
Krebs notes a structural problem in incident response: firms refusing to facilitate ransom payments get replaced by those willing to, creating conflicts of interest in the negotiation industry.
But not all cyber forensics and breach response companies will agree to facilitate payments to ransomware groups on behalf of their clients. As a result, once victim firms make a decision to pay, the firms that eschew rewarding extortionists are invariably replaced by companies that have no such qualms.
Krebs argues that Cryptomus and Heleket appear to rely on fake licenses issued by a phony Western Sahara regulator to claim legitimacy for their international financial services.
Where do entities like Cryptomus and Heleket derive their authority to offer international financial services? The answer appears to involve fake financial institutions overseen by a phony regulatory body positioned in a country that is not widely recognized as a sovereign nation.
Krebs notes that AI-driven bug discovery is behind Microsoft's record patch volumes, which are straining corporate security teams that must test updates before deployment.
Microsoft credits large language models for the high volume of bug discovery, and presumably AI gets credit for many of the patches used to fix these flaw. Meanwhile, security experts have been warning that these unusually large patch volleys from Microsoft are placing extra strain on corporate security teams, which often have to test individual updates before deploying them across a network to ensure the fixes don’t cause problems for other software.