Security reports have alleged that the Chinese telecommunications company Huawei has been recruiting high-level operatives linked to China’s military and intelligence agencies, the express.co.uk reported.

According to Professor Christopher Balding, who conducted the research, around 100 Huawei’s employees had connections with the Chinese military and state-sponsored hacking operations. The professor described the employees as representatives of the Ministry of State Security (MSS) at Huawei. He also claimed that they’ve worked on “building lawful interception capability into Huawei equipment”.

“Huawei’s co-founder Ren Zhengfei held a senior position within China’s People’s Liberation Army (PLA) before starting the company,” Balding said in a media statement.

Recently, security researchers from cybersecurity firm Swascan revealed that they have discovered multiple vulnerabilities in Huawei’s Web Application and Servers. Swascan stated cybercriminals can exploit the critical vulnerabilities to access sensitive information. The research team said they’ve identified three vulnerabilities that could impact regular operations if exploited.

According to Swascan, the three discovered flaws in Huawei’s web applications include: CWE-119 (Improper Restriction on Memory Buffer) — The hacker can access the memory and can possibly execute malicious codes. CWE-125 (Out-of-bounds Read) — This flaw allows an attacker to read sensitive information. CWE-78 (OS Command Injection) — The attackers can use this flaw to execute unauthorized commands to crash the software and access the restricted data.

Security researchers revealed that cybercrime incidents are on a dramatic rise. According to a report from the Internet Society’s Online Trust Alliance (OTA), cybercrime has become a $45 billion industry in 2018.

The report, Cyber Incident & Breach Trends, was prepared from the sources including the Federal Bureau of Investigation, Symantec, Risk Based Security, the Identity Theft Resource Center, and the Internet Society’s internal data.

The report stated that the number of ransomware, data breaches, and DDoS incidences came down in 2018. However, the financial damage due to ransomware rose by 60 percent. It also said that losses from business email compromise (BEC) doubled while damage from Cryptojacking tripled.

“It is difficult to get a complete, accurate picture of the overall cyber incident landscape. Much like putting together a jigsaw puzzle with only a handful of key pieces, it is possible to get a sense of the overall picture, but many of the details are missing. In tracking cyber incidents, many key data “pieces” exist, but are limited for a variety of reasons – they often represent only one vendor’s view of their user base, they are typically regional and not global, it is easier to measure attacks than measure which are successful, there is a lack of consolidated reporting mechanisms, and finally, it is still the case that most incidents go unreported,” OTA said in a statement.

Security experts opined that Phishing and Ransomware attacks are the most reported types of cyber-attacks on financial services firms. According to the Audit and Consulting firm RSM International in the United Kingdom, around 819 cyber incidents were reported by Financial services firms to the Financial Conduct Authority (FCA) last year.

RSM said that Retail Banks were the most frequently affected by cyber-attacks (486 security incidents) followed by wholesale financial markets (115 attacks), and retail investment firms (53 incidents). In 2018, financial firms reported around 93 cyber-attacks, in which half of these (48 attacks) were phishing attacks while 20 percent (19 attacks) were ransomware attacks.

RSM said the sudden increase in the companies reporting security incidents was due to the introduction of the European Union’s General Data Protection Regulation (GDPR) laws that took effect last May.

Google recently announced the increase in bug bounty rewards, making them more lucrative to security researchers. The search engine giant stated that it has raised the bounties for Chrome and Google Play bugs.

Google launched the vulnerability rewards program in 2010 and provides cash rewards to security researchers who report vulnerabilities in Google code. The company stated that they’ve received around 8,500 vulnerability reports and paid rewards over $5 million (£4 million).

According to Google’s Chrome security experts Natasha Pabrai and Andrew Whalley, the company has doubled the maximum reward on High-Quality Reports from $15,000 (£12,000) to $30,000 (£24,000) and tripled the baseline reward amount from $5000 ((£4 million) to $15,000 (£12,000) for good measure.

“Today, we’re delighted to announce an across the board increase in our reward amounts! Full details can be found on our program rules page, but highlights include tripling the maximum baseline reward amount from $5,000 to $15,000 and doubling the maximum reward amount for high quality reports from $15,000 to $30,000. The additional bonus given to bugs found by fuzzers running under Chrome Fuzzer Program is also doubling to $1,000,” Google said in an official post.

“But that’s not all! On Chrome OS we’re increasing our standing reward to $150,000 for exploit chains that can compromise a Chromebook or Chromebox with persistence in guest mode. Security bug in firmware and lock screen bypasses also get their own reward categories,” Google added.

Scammers are making phishing attacks, by abusing Google Calendar services, to trick users into giving away sensitive information like passwords, card details, and other financial data. The threat intelligence and cybersecurity firm Kaspersky stated that it detected many unsolicited pop-up calendar notifications sent to Gmail users by cybercriminals as a sophisticated spam email attack.

The scam occurs when an attacker sends an unsolicited calendar invitation carrying a link to a phishing URL and encourage the recipient to click on the link. The user then redirected to a fake website, appears to be original, that features a simple questionnaire and offered a prize after completion. The victim will be asked to fill in personal details like name, phone number, address, and bank details in order to steal the victim’s money or identity.

Russia becomes the latest victim of a hacking attack that compromised the country’s Federal Security Service (FSB). According to the official statement, the hackers allegedly gained access to 7.5 terabytes of data from a major contractor Sytech.

The incident exposed FSB’s secret projects like how Russia is trying to carry out de-anonymization of users of the Tor browser collecting information of users’ social networks, and separating the Russian internet operations from the rest of the world.

The attack occurred on July 13, 2019, by an unknown hacking group named 0v1ru $. Hackers allegedly accessed into SyTech’s Active Directory server from where they gained access to the company’s entire IT network and defaced the company’s website with a “yoba face,” an emoji used in Russian for trolling.

Hackers then posted screenshots of the company’s servers on Twitter and later shared the stolen data to another hacking group called Digital Revolution, which later shared the stolen files on their Twitter account and with Russian journalists.

According to a threat report from cybersecurity firm CrowdStrike, hackers tied to Russian intelligence agencies are 8 times faster than North Koreans, Chinese, and Iranians in hacking. In its report dubbed Global Threat Report 2019: Adversary Tradecraft and the Importance of Speed, CrowdStrike stated the Russians are the most sophisticated among the many nation-state adversaries that are regularly hacking government and private computers in the United States.

In August 2018, Microsoft Corporation revealed that hackers linked to Russian military intelligence tried to hack the websites of two conservative think-tanks in the United States ahead of November’s midterm elections. It said that it detected and seized websites that were created by hackers linked to the Russian unit to mimic the pages of the International Republican Institute and the Hudson Institute.  These sites are designed to redirect the users to fake web pages where they were asked to enter usernames, passwords, and other credentials.

The Federal Trade Commission and Consumer Financial Protection Bureau have fined Equifax for around $700 million following a massive data breach in 2017 that leaked a massive amount of information of more than 143 million people in the U.S. alone.

According to the official reports, the proposed penalty could be between $650 and $700 million. It’s said that the final amount could vary depending on how many people file claims and their expected compensation.

On September 7, 2017, the Atlanta-based consumer credit reporting agency disclosed that its databases had been breached between May and June 2017, and hackers had gained access to Company data that potentially compromised sensitive information for 143 million American consumers, including Social Security numbers, credit card numbers and driver’s license numbers.  Equifax discovered the breach on July 29, 2017, but had waited until after the close of trading nearly six weeks later to disclose the breach to consumers and Equifax’s investors, after hackers exfiltrated data for 76 days.

Earlier, Equifax was charged with a fine of £500,000 ($660,000) by the Information Commissioner Office (ICO) for failing to protect the personal and financial data of customers. The Information Commissioner’s Office, which carried out the investigation, stated that Equifax had been warned about vulnerabilities in its systems by the US Department of Homeland Security in March 2017. However, Equifax failed to take proper steps to fix the vulnerabilities.

The mid-market businesses in the UK have lost around £30 billion ($37 billion) in the past 12 months due to security breaches. A research from business and financial adviser Grant Thornton UK LLP discovered that cyber-attacks are a present danger for businesses in the UK. The research report, named Cyber Security – the Board Report, stated that the businesses are not prepared to manage the cyber risks.

Grant Thornton stated they surveyed over 500 UK mid-market companies, in which half of them reported losses of up to 10 percent of their income over cyberattacks. The research revealed that 63 percent of the companies don’t have a cybersecurity team. Only 36 percent stated that they’ve provided cybersecurity training to their employees. And more than half of the businesses (59%) don’t have a cyber incident action plan, according to the research.

“Boards have a key role to play in ensuring an effective cyber strategy is in place. Putting cyber-crime onto the board’s agenda is one of the most effective ways to minimise the chances of a successful attack and reduce the financial impact if a breach occurs. With that in mind it is worrying that almost two thirds of the businesses we interviewed do not have a board member responsible for cyber security,” said James Arthur, the head of cyber consulting at Grant Thornton UK LLP.

“While commitment from the top is vital, ensuring your people are properly trained is also essential. Often, companies make themselves vulnerable to attack simply by failing to get the basics right. Training to raise employee awareness can have a hugely positive impact on cyber security. People are often unaware of the important role they play in helping a business to stay protected, so companies of all sizes need to ensure they have regular and ongoing cyber security training in place.”

Earlier, a survey from analytics software company FICO revealed that 62 percent of UK firms lack complete cybersecurity insurance. According to the research, only 38 percent of UK firms surveyed have cybersecurity insurance that covers all risks. Telecommunications firms lag other industries regarding cybersecurity insurance, 17 percent of firms reported that they have no coverage. Most of the respondents stated that their premiums are based on inaccurate analysis or unknown factors.