In her “Top Breaches of 2019”, a security journalist asked if last year would “…be the worst on record?” It looks like 2020 could surpass last year’s breaches, but it’s not entirely due to consequences of the global pandemic. For sure, unprecedented levels of remote working has emboldened hackers to exploit new vulnerabilities, but there’s one very insidious risk that shows up year after year: the silent and unwitting exposure of sensitive data that no one notices… until it’s too late.

The internet has become a powerful force for global interconnectivity and democratization. What’s more, the internet has introduced new methods for collective mobilization, such as “e-rebellions” and virtual protests. The global pandemic has accelerated the use of cyberspace as a powerful venue for individuals, groups, and nations to share ideas, engage, mobilize, and challenge authoritarian states in an impactful way.

The National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) released a new Cybersecurity Advisory about previously undisclosed Russian malware.

ESET researchers explored Mekotio, a banking trojan targeting Spanish- and Portuguese-speaking countries: mainly Brazil, Chile, Mexico, Spain, Peru and Portugal. Mekotio boasts several typical backdoor activities, including taking screenshots, restarting affected machines, restricting access to legitimate banking websites, and, in some variants, even stealing bitcoins and exfiltrating credentials stored by the Google Chrome browser.

(ISC)² announced the list of honorees for its 2020 (ISC)² Global Achievement Awards, which recognize and celebrate the most outstanding annual and lifetime achievements in the field of cybersecurity.

Germany announced it had launched a federal agency to combat cyberattacks and strengthen its digital security. 

New research finds nearly half of organizations regularly and knowingly ship vulnerable code despite using application security tools. Among the top reasons cited for pushing vulnerable code were pressure to meet release deadlines (54 percent) and finding vulnerabilities too late in the software development lifecycle (45 percent), according to the Veracode and Enterprise Strategy Group (ESG) research.

Congressman Andy Barr (KY-06) introduced the NIST COVID-19 Cyber-Security Act, which instructs the Director of the National Institute of Standards and Technology (NIST) to produce standards for mitigating and protecting against cyberattacks to American universities researching COVID-19. 

SANS Institute, a provider of cybersecurity training and certification services, lost approximately 28,000 items of personally identifiable information (PII) in a data breach that occurred after a single staff member fell victim to a phishing attack.