{"id":40449,"date":"2020-04-24T19:37:45","date_gmt":"2020-04-24T15:37:45","guid":{"rendered":"https:\/\/www.msp360.com\/resources\/?p=40449"},"modified":"2020-12-10T14:25:29","modified_gmt":"2020-12-10T10:25:29","slug":"news-you-mightve-missed-20-24-april","status":"publish","type":"post","link":"https:\/\/www.msp360.com\/resources\/blog\/news-you-mightve-missed-20-24-april\/","title":{"rendered":"News You Might\u2019ve Missed. 20-24 April"},"content":{"rendered":"<p>What's new this week in the news for MSPs? This week Google's Cloud for Healthcare is ready to launch, and BeyondCorp remote access for virtual workers is launched. Amazon's AppFlow debuts, IT giant Cognizant is hit by Maze ransomware, and the City of Torrance in LA County is targeted by DoppelPaymer ransomware. Finally, beware of a new phishing campaign using fake customer complaints to access corporate networks.<\/p>\n<p><!--more--><\/p>\n<p>Let's see what's going on.<\/p>\n<h2>Google Cloud Healthcare API Ready<\/h2>\n<p>Google Healthcare API is a service that aims to help the exchange of data between healthcare apps and services that run on Google's cloud. Google LLC <a href=\"https:\/\/cloud.google.com\/blog\/topics\/inside-google-cloud\/how-google-cloud-is-supporting-healthcare-and-life-sciences-organizations\" target=\"\u201c_blank\u201d\" rel=\"\u201cnoopener\u201d noopener noreferrer\">announced this week<\/a> that this API would help patients to access their healthcare information using third-party applications.<br \/>\nHealthcare workers will be able to enter and manage data from multiple inputs and systems. They can then analyze the data using AI and machine-learning-based tools. New government directives to healthcare providers specify giving patients more convenient access to their healthcare data. Due to this, many believe that providers are likely to embrace this new API.<br \/>\nGoogle Cloud Healthcare API is a managed, scalable environment to build clinical and analytics applications. It also supports HIPAA compliance and incorporates several data loss prevention schemes, and policy and identity management tools, according to Google.<\/p>\n<h2>BeyondCorp Remote Access for Virtual Workers Launched from Google<\/h2>\n<p>To assist businesses in securing their most critical applications and data during this challenging time when many workers are doing work from home, Google LLC has updated its <a href=\"https:\/\/cloud.google.com\/solutions\/beyondcorp-remote-access\" target=\"\u201c_blank\u201d\" rel=\"\u201cnoopener\u201d noopener noreferrer\">BeyondCorp<\/a> security framework.<br \/>\nWith BeyondCorp's \"zero trust\" security framework, employees can work from anywhere without needing a traditional VPN. It moves away from using access control based on whether users' access requests are internal or external to the corporate network. Instead, it assumes that users requesting access from inside the network are just as untrustworthy as those seeking remote access.<\/p>\n<p id=\"last\">This change results in access being granted based on details about the particular users, their jobs, and the security status of the devices they're using. In short, this is a zero trust model.<\/p>\n<div id=\"slidebox\"><a class=\"close\">\u00a0<\/a><!--HubSpot Call-to-Action Code --><span class=\"hs-cta-wrapper hs-cta-deferred\" id=\"hs-cta-wrapper-c825537e-9998-44be-92aa-7a0a97b055c1\" data-portal=\"5442029\" data-id=\"c825537e-9998-44be-92aa-7a0a97b055c1\"><span class=\"hs-cta-node hs-cta-c825537e-9998-44be-92aa-7a0a97b055c1\" id=\"hs-cta-c825537e-9998-44be-92aa-7a0a97b055c1\"><!--[if lte IE 8]><div id=\"hs-cta-ie-element\"><\/div><![endif]--><a href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/5442029\/c825537e-9998-44be-92aa-7a0a97b055c1\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"hs-cta-img\" id=\"hs-cta-img-c825537e-9998-44be-92aa-7a0a97b055c1\" style=\"border-width:0px;\" src=\"https:\/\/no-cache.hubspot.com\/cta\/default\/5442029\/c825537e-9998-44be-92aa-7a0a97b055c1.png\" alt=\"CTA\"><\/a><\/span><\/span><!-- end HubSpot Call-to-Action Code --><\/div>\n<h2>Debut of AppFlow from Amazon<\/h2>\n<p>Developers can now make use of <a href=\"https:\/\/www.businesswire.com\/news\/home\/20200422005973\/en\/AWS-Announces-Amazon-AppFlow\" target=\"\u201c_blank\u201d\" rel=\"\u201cnoopener\u201d noopener noreferrer\">Amazon's AppFlow<\/a> to manage the flow of data between AWS and other SaaS applications like Google Analytics, Marketo, Salesforce, ServiceNow, Slack, Snowflake, and Zendesk.<br \/>\nThis managed service enables users to create and automate bidirectional data flows without the need to write custom integration code. The flows use event triggers or can be scheduled to run at preset times or on-demand, according to the announcement from Amazon.<br \/>\nDespite Amazon\u2019s statement that the data flows can be bidirectional, it appears that the service is more focused on moving data from SaaS apps to other AWS services. From there, to other AWS services, where the data can be analyzed. Amazon AppFlow comes with many tools for transforming data to help with this.<\/p>\n<div class=\"call-to-action\">\n<div class=\"call-to-action__left\">\n<div class=\"call-to-action__tag\">ON-DEMAND WEBINAR<\/div>\n<div class=\"call-to-action__title\">Ransomware: Prevent or Recover<\/div>\n<div class=\"call-to-action__text\">Watch the webinar and prepare yourself and your customers with the right approach and the right tools<\/div>\n<!--HubSpot Call-to-Action Code --><span class=\"hs-cta-wrapper hs-cta-deferred\" id=\"hs-cta-wrapper-dcb611f1-612b-448d-8afd-7e3fea1fccc0\" data-portal=\"5442029\" data-id=\"dcb611f1-612b-448d-8afd-7e3fea1fccc0\"><span class=\"hs-cta-node hs-cta-dcb611f1-612b-448d-8afd-7e3fea1fccc0\" id=\"hs-cta-dcb611f1-612b-448d-8afd-7e3fea1fccc0\"><!--[if lte IE 8]><div id=\"hs-cta-ie-element\"><\/div><![endif]--><a href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/5442029\/dcb611f1-612b-448d-8afd-7e3fea1fccc0\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"hs-cta-img\" id=\"hs-cta-img-dcb611f1-612b-448d-8afd-7e3fea1fccc0\" style=\"border-width:0px;\" src=\"https:\/\/no-cache.hubspot.com\/cta\/default\/5442029\/dcb611f1-612b-448d-8afd-7e3fea1fccc0.png\" alt=\"CTA\"><\/a><\/span><\/span><!-- end HubSpot Call-to-Action Code -->\n<\/div>\n<div class=\"call-to-action__right\"><img decoding=\"async\" style=\"max-width: 300px;\" src=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2020\/03\/Ransomware_-Prevent-or-Recover-1.png\" alt=\"Webinar icon\" \/><\/div>\n<\/div>\n<h2>Cognizant Hit by Maze Ransomware<\/h2>\n<p>The information technology services company Cognizant Technology Solutions Corp. <a href=\"https:\/\/www.crn.com\/news\/channel-programs\/cognizant-contains-maze-ransomware-attack-as-cleanup-costs-spiral\" target=\"\u201c_blank\u201d\" rel=\"\u201cnoopener\u201d noopener noreferrer\">was the object of an attack by Maze ransomware<\/a>. In its statement, Cognizant acknowledges a security incident involving its internal systems, saying that its issues were related to a Maze ransomware attack.<br \/>\nAt the time of the announcement, it also disclosed that its internal security teams, supplemented by leading cyber-defense firms, were actively taking steps to contain this incident, as well as reporting the attack to law-enforcement authorities.<br \/>\nOver the last two months, Maze ransomware has frequently been in the news. Most recently, it was used in the attack on Chubb Group Holdings Inc. on March 26th, in addition to Hammersmith Medicines Research Ltd., a company working on developing a COVID-19 vaccine. This attack resulted in private data being disclosed on March 22nd.<br \/>\nSam Roguine, a director at Arcserve LLC, noted that the attack shows that the Maze ransomware gang isn't backing down.<\/p>\n<h2>DoppelPaymer Ransomware Hits Torrance, CA<\/h2>\n<p>The City of Torrance, which is part of the Los Angeles metropolitan area in California, has allegedly <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/doppelpaymer-ransomware-hits-los-angeles-county-city-leaks-files\/\" target=\"\u201c_blank\u201d\" rel=\"\u201cnoopener\u201d noopener noreferrer\">been hit by DoppelPaymer ransomware<\/a> actors. As a result, they have had unencrypted data stolen and devices encrypted.<br \/>\nDoppelPaymer created a site called \"Doppel Leaks\" in February 2020. In its most recent update, it has added a page titled \"City of Torrance, CA\", which contains many leaked file archives allegedly stolen during the attack.<br \/>\nIn an email to BleepingComputer, the DoppelPaymer operators claimed that in the attack on March 1st, they erased the city's local backups and encrypted about 150 servers and 500 workstations.<br \/>\nDoppelPaymer requires 100 bitcoins, or approximately $680,000, to provide a decryption key.<br \/>\nAs part of the attack, they also claim to have stolen approximately 200+ GB of files.<\/p>\n<h2>New Phishing Campaign Masquerades as Customer Complaint<\/h2>\n<p>If your clients have received any emails purporting to be from their corporate lawyer, it could be the <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/customer-complaint-phishing-pushes-network-hacking-malware\/\" target=\"\u201c_blank\u201d\" rel=\"\u201cnoopener\u201d noopener noreferrer\">latest phishing scam<\/a> at work. This new phishing campaign targets a company's employees with fake customer complaints that install a new back door, which is then used to compromise the network.<br \/>\nThe suspect emails utilize subjects like \"Re: customer complaint in [insert company name]\" or \"Re: customer complaint for [recipient name]\" and state that the recipient's employer has received a customer complaint about them and that, at a result, the employee will be fined and have the amount deducted from their salary. The rest plays out like this:<\/p>\n<ol>\n<li>The employee is instructed to download and review the complaint from an included Google Docs link, as the \"Corporate Lawyer\" would like to meet with them to discuss it<\/li>\n<li>When the user visits this link, they will see a stylized Google Docs document masquerading as a customer complaint, with information on how to download it<\/li>\n<li>When the user clicks the \"Expand and Preview\" link, the Prevew.PDF.exe file is downloaded containing a back door called \u201cbazaloader\u201d (based on the domain used by its command and control server)<\/li>\n<li>When executed, bazaloader releases malware that injects itself into the legitimate C:\\Windows\\system32\\svchost.exe<\/li>\n<li>Bazaloader proceeds to connect to a remote server command and control server, where it sends data and receives additional commands or payloads<br \/>\nTo be safe, always enable file extensions in Windows, so that you can quickly determine what kind of file is being downloaded.<\/li>\n<\/ol>\n<h2>That's a Wrap<\/h2>\n<p>That's the news for MSPs this week in summary. I hope this has been helpful. MSP360 is your resource for MSP news. Stay home, stay safe and healthy, and remember to check back next week for more highlights.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>What&#8217;s new this week in the news for MSPs? This week Google&#8217;s Cloud for Healthcare is ready to launch, and BeyondCorp remote access for virtual workers is launched. Amazon&#8217;s AppFlow debuts, IT giant Cognizant is hit by Maze ransomware, and the City of Torrance in LA County is targeted by DoppelPaymer ransomware. Finally, beware of [&hellip;]<\/p>\n","protected":false},"author":84,"featured_media":40452,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[877,885],"tags":[],"class_list":["post-40449","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-articles","category-other"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/40449","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/users\/84"}],"replies":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/comments?post=40449"}],"version-history":[{"count":0,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/40449\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media\/40452"}],"wp:attachment":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media?parent=40449"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/categories?post=40449"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/tags?post=40449"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}