Blog

Insights on ATO, Consumer Fraud, Ransomware, the criminal underground and more

It Ain’t Over Til It’s Over: Why Post-Infection Remediation Is Needed to Truly Resolve Malware Infections

As threats from malware infections slip through security defenses, a new approach to preventing ransomware is necessary. With SpyCloud Compass, security teams can now conduct complete Post-Infection Remediation.

What Motivates Cybercriminals to Run Malware Campaigns?

While money is a common and obvious motivation for malware campaigns, we examine various motivating factors behind malware, including hacktivism and notoriety.

The Hidden Costs of Ransomware Attacks

The cost of a ransomware attack isn’t just a payment – negative brand reputation and loss of customers can hurt the bottom line, while employees mitigating an attack can impact productivity.

Why Identity is at the Core of a Federal Zero Trust Strategy

Key tenets of the government’s zero trust strategy include MFA and secure password policies. With identity at the core of zero trust, we offer recommendations for successful strategy implementation.

2022 in Review: The Year of Ransomware

Ransomware has been a growing cyber threat for several years but with increased sophistication and methods it seems like 2022 was really the year it took off. Here we break down the trends and ways organizations can better prepare in 2023 and beyond!

Fool Me Once: How Botnets Help Malicious Actors Pose as Your Employees (And What Enterprises Can Do About It)

Botnets are one of the tools that enable bad actors to carry out extensive infostealer attacks. We discuss the risks of botnets, infostealers, and malware infections, and how to close ransomware visibility gaps.

Passwords, Passkeys, Cookies, MFA – Authentication Methods are Under Attack

Our survey of IT security leaders found organizations are investing in layers of defense against authentication-based attacks, but it still isn’t enough. Here we discuss the issues with passwords, passkeys, and MFA + additional steps beyond these measures security teams can take to close the gaps in their defenses.

Q&A with SpyCloud North American Channel Vice President

SpyCloud is excited to enhance our Partner Program. Stacy Hutchings, VP Channel-North America shares more about the program, its benefits, and why companies should partner with SpyCloud.

How to Avoid Getting Spooked by Ghost Accounts and Shadow IT

Unwitting insider threats create vulnerabilities that can lead to ransomware attacks. We discuss how ghost accounts and shadow IT impact enterprises and how to mitigate these risks.

What is Session Hijacking and How Do You Prevent It?

Session cookies siphoned from unmanaged devices infected with malware pose a significant threat to enterprises. Learn how criminals use stolen web session cookies to access enterprises and launch cyberattacks.

2022 Cybersecurity Industry Statistics: Account Takeover, Ransomware, Data Breaches, BEC & Fraud

Updated stats on the prevalence and cost of common cyberattacks including ATO, ransomware, and fraud for organizations and individuals.

Dark Web Market BidenCash: 30%+ of Credit Cards are Old News

An analysis of the newly launched underground carding marketplace data against SpyCloud’s recaptured data shows the leaked information existed on the dark web prior to its recent disclosure – but does that make it any less powerful in the hands of a criminal?

Outsourcing Initial Access: Ransomware Groups Don’t Break In, They Log In.

Monetizing network access is not a new scheme, but the emergence of Ransomware-as-a-Service (RaaS) operators has created a market for specialized actors called Initial Access Brokers (IABs).

Balancing Act: Tackling the Top Ecommerce Fraud Challenges

The question, ‘is this a legitimate customer or a criminal?’ can be answered with a new approach to preventing fraud that goes beyond identity verification.

70% Password Reuse: Password Security Needs a Forced Reset

The problem of password reuse demands a new framework for credential security – one in which users are blocked from choosing passwords that have ever been exposed.

Tips for Strong Passwords

With stolen credentials being the #1 entry point for cybercriminals, password security has never been more critical. We offer five tips for stronger passwords for users and enterprises alike.

The Most Overlooked Ransomware Defenses

We dig into key findings from our annual survey of more than 300 security leaders, including the role malware plays in ransomware attacks and the missing piece of incident response.

Roses Are Red(Line): Why Credential-Stealing Malware is Giving SOC Teams the Blues

One of the biggest challenges in ransomware prevention is the lack of visibility into credential-stealing malware. Get insights on how these infections work and why malware causes headaches for SOC teams.

Three Common Entry Points for Ransomware

Understanding ransomware entry points is critical to preventing attacks in the first place. We examine three common access points for ransomware and discuss how to close gaps in your prevention strategy.

Don’t Get Schooled by Cybercriminals: Back to School Cybersecurity Tips

The start of a new school year is the perfect time to freshen up on cybersecurity awareness. We offer insights on cyberattacks and breaches targeted at children and four back-to-school security tips.

Making the Internet a Safer Place: Celebrating Six Years of SpyCloud

In honor of SpyCloud’s 6th anniversary, we take a look at how we’re achieving our mission to make the internet a safer place and discuss the future of the fight against cybercrime.

Consumer or Fraudster? A Q&A with Fraud Prevention Experts

Fraud experts from SpyCloud and Aite-Novarica tackle recent trends, the rise in ATO, synthetic identities, and malware, and how to level the playing field against fraudsters.

Account Opening Fraud: High Risks and High-Risk Customers

Account opening fraud is a growing concern, especially for financial institutions. Being able to distinguish between legitimate users and fraudsters is critical to Know Your Customer (KYC) requirements.

CISOs Sound Off: Survey Shows CISO Challenges and Priorities

A survey of CISOs found key insights on challenges facing top security leaders, including protecting against ransomware, implementing Zero Trust models, and the need for automated solutions.

Cover image for the Verizon 2022 Data Breach Investigations Report depicting a server room with a greed dot timeline overlay to show the increase in contributors over time

Stolen Credentials, Ransomware & Human Error, Oh My: Key Takeaways from the Verizon 2022 Data Breach Investigations Report

SpyCloud breaks down intriguing insights from Verizon’s annual analysis of data breach causes, techniques, and motives.

The Critical Need to Protect Critical Infrastructure: Spotlight on Utilities

The stakes are high when it comes to protecting critical infrastructure. See the latest thinking on thwarting ransomware attacks against Utilities – and the ATO that often precedes them.

Cybercriminal surrounded by industry icons including financial, energy, aerospace, etc.

Shining a Light on the Identity Exposure of Fortune 1000 and FTSE 100 Enterprises

SpyCloud’s annual analysis of data from the criminal underground tied to Fortune 1000 and FTSE 100 companies offers insights into trends including password security and PII exposure – along with the growing danger of malware-infected devices.

Two dark blue silhouettes with puzzle pieces etched within facing each other amongst 1s and 0s

Too Much, Too Little, or Just Right: How to Spot the Signs of Synthetic Identity Fraud

Synthetic identity fraud is a $20B problem, but it’s not impossible to prevent. We break down the 2 telltale signs. As it turns out, too much information is just as suspicious as not enough when it comes to detecting constructed identities.

A lock and a checkmark on top of credit cards represent the payment card industry

Keeping Up with Compliance: New PCI DSS 4.0 Authentication Standards and What They Mean for You

The latest version of PCI DSS standards feature more robust requirements for passwords and authentication. We break down some of the requirements and how they could impact your organization.

A magnifying glass focuses in on the word Password in green amidst blue 1s and 0s

What To Do If My Password Was Found in a Data Breach

When your password is exposed in a data breach, immediate action is necessary. We offer remediation steps and tips for creating strong passwords to secure online accounts.

Blue-tone image of a magnifying glass focused on a fingerprint next to credit cards to represent organized retail crime

Connecting the Dots: Fight Organized Retail Crime (ORC) With Recaptured Data

Criminals are going omni-channel with Organized Retail Crime. Learn more about this type of fraud and see how the digital and physical worlds can collide to solve ORC cases.

Credit card, keyboard and lock to represent ecommerce fraud prevention

Lessons Learned From the Front Lines in the Fight Against Fraud

Leaders in fraud prevention share insights and experiences about how fraud teams enable revenue and foster collaboration from our MRC 2022 panel discussion.

Brush that is dusting for fingerprints. Fingerprint is shown, implying that a unique value has been uncovered.

Dusting for Fingerprints: How New Anti-Detect Browsers Spoof Real Users with Stolen Digital Fingerprints

The SpyCloud Research team takes an in-depth look at anti-detect browsers and how they are being leveraged alongside stolen credentials and cookies to bypass MFA and easily log into targeted accounts.

Top 5 Takeaways from SpyCloud’s Annual Identity Exposure Report

Credential exposure. Ransomware. Password reuse. Malware. This year’s report spotlights key trends our research team found from analyzing 15 billion credentials and PII assets we recaptured from the criminal underground in 2021.

Three’s a Crowd: Breaking Down Triangulation Fraud

As online shopping continues to boom, both consumers and retailers should be aware of triangulation fraud. Learn more about this tactic, how it works, and how you (and your business) can avoid getting caught up in it.

SpyCloud Identity Risk Engine - High Risk User

4 Ways Underground Data Helps Criminals Sneak Past Fraud Controls – And What You Can Do About It

Stolen data helps criminals sidestep fraud prevention measures. Now, SpyCloud can help enterprises use that same data to stop hard-to-detect fraud.

breach-data-in-fraud-prevention-pattie-dillon-blog

Putting Breach Data to Work in Fraud Prevention

For years, criminals have stolen and exploited consumers’ personal data. It’s time we make that same data work for us in the fight to prevent fraud.

Professional woman speaking to table of individuals at a meeting.

Risky Business: Why a Strong Security Culture Should Be a Top Priority for All Bosses

Enterprise leaders and boards of directors are constantly juggling the multitude of responsibilities they have to the business. Our CEO, Ted Ross, explains why cybersecurity should be at the top of the list.

Future of Passwordless Authentication 2021

The Future of Passwordless Authentication Is…Probably More Passwords

We’d like to believe that passwords are just a hop-skip-jump away from being obsolete but the truth is, we’re still not quite ready for a passwordless world.

2021 Ransomware Defense Report: Breaking Down Key Findings

A summary of key findings from 250 U.S. Enterprise Security Leaders about the state of Ransomware Defense. Spoiler Alert: It’s not all bad news.

Rethinking Trust: Adapting to the Reality of Supply Chain Compromise

In an interconnected business world where organizations depend on hundreds of separate technologies and vendors, third-party access offers a reliably weak spot in any security posture.

Password Hygiene: A Prerequisite for Higher Education

Poor cybersecurity hygiene has made colleges & universities prime targets for ransomware. How can these institutions make security an educational priority?

5 Years of Risk: How Cybersecurity Threats Continue to Evolve

A look back at the threat landscape that experts were predicting over the last five years to see how the industry has changed – and what could be ahead.

Ransomware: A Global Threat with Local Consequences

As the U.S. federal government addresses the ransomware scourge, state and local governments are left unprepared and caught in the crosshairs.

As Cybersecurity Spending Balloons, So Do False Economies

Cybercrime and cybersecurity budgets are both on the rise. And yet, the largest security gaps for most organizations – solving for password reuse and remediating stolen credentials – are left wide open.

Ransomware May Be On Fire Now, But BEC Is Always Simmering

Despite being one of the oldest tricks in the cybercrime playbook, BEC scams comprised 43% of all losses in the US last year compared to 1% from ransomware.

Trends in MFA in a WFH World

Increased adoption of MFA is a good thing for cybersecurity, especially as remote work grows in popularity – and preference – but humans remain the weakest link.

I Just Called to Say… I’ve Taken Over Your Account

When it comes to identity theft, stolen phone numbers are often shrugged off. But the truth is, criminals want your phone numbers just as much as they want your passwords.

One for the Money, Two for the Show, $4.4M for the Ransomware Gang That Used ATO

Ransomware has reached crisis levels across all business sectors and across the globe. What’s fueling it? Two words: stolen credentials.

Everyone Loves Credentials: Highlights from the Verizon 2021 Data Breach Investigations Report

The use of stolen credentials obtained from other breaches and/or credential reuse was a consistent thread throughout most criminal activity last year.

Telecom Companies Face Highest Risk for Cyber Attacks

Telecom companies are rich in data and have huge numbers of customers, both of which make them valuable targets for fraudsters. They’re also heavily exposed in data breaches.

Was It a Breach or Credential Stuffing?

We’ve noticed a trend where media headlines equate data breaches & credential stuffing. The difference is critical for companies like Zoom, Nintendo, and Spotify, who made headlines in 2020 for the wrong reasons & suffered brand damage as a result.

Understanding the SolarWinds Supply Chain Attack

Breaking Down the SolarWinds Supply Chain Attack

It will be years – maybe decades – before we know the true extent of the fallout from the SolarWinds Orion software supply chain compromise. Based on what we know so far, SpyCloud has broken down the stages of this targeted, identity-based attack.

2021 Annual Credential Exposure Report

Surprise: If your password includes a keyword like “covid,” “election,” or “sourdough,” you’re in good company. Find out what else we’ve learned from the 1.5 billion stolen credentials our researchers have recovered over the last year.

3 Bad Habits That Increase Your Account Takeover Risk

Human nature makes us vulnerable to account takeover. Let’s dig into 3 very common bad habits and how they play into criminals’ hands.

Favorite passwords of Forune 1000 employees

2021 Report: Breach Exposure of the Fortune 1000

SpyCloud analyzed over 543 million breach assets tied to Fortune 1000 employees to illustrate the challenges enterprises face in preventing account takeover.

The 2021 Remote Workforce Security Report

Findings from our 2021 Remote Workforce Security Report: how companies are tackling the top threat vectors facing remote workers.

Botnets: The Information Stealers Mama Never Warned You About

Get the lowdown on botnets, networks of computers infected by malware. See why they’re dangerous and how to protect yourself.

Make Better Password Habits One Of Your New Year’s Resolutions

Let’s try something different from the usual losing weight and eating better. Here are 5 tips for stronger passwords in 2021.

2021 Cybersecurity Prediction: The Mingling of Work & Personal Accounts Will Lead to a Rise in Vulnerability

See why password reuse and shared devices – so common in 2020 – will create cybersecurity headaches well into 2021.

Is Multi-Factor Authentication Like a Splinter in Your Mind?

MFA keeping you up at night? It probably should. Check out these common MFA bypass techniques and why another layer of account protection is necessary.

Cryptography of the Cracking World

Dictionaries, combolists, rainbow tables…We explain the terms used within online “cracking communities” and what they mean for us as defenders.

Holiday Fraud - SpyCloud Guide for Merchants

The Merchant’s Prep Guide to 2020 Holiday Delivery Fraud

We dive into the creative ways criminals are targeting the convenient ecommerce features that were designed to benefit customers during the pandemic. At the core of it all is stolen data.

Out with the Old: It’s Time to Abandon Outdated Active Directory Password “Best Practices”

Many years’ worth of accumulated best practices have mostly helped strengthen Active Directory security, but a few long-standing beliefs about enforcing password policies are actually outdated.

Never Waste a Crisis: Best Practices for Managing Large-Scale Data Breaches

Questions to ask yourself as you prepare breach prevention & response plans, based on our conversations with CISOs who have survived major breaches that exposed customer data.

SpyCloud Recognized as a Gartner Cool Vendor for Identity Access Management and Fraud Detection

See why Gartner thinks we’re a Cool Vendor – and more about how we’re applying breach data to new use cases beyond ATO prevention.

Credential Stuffing vs. Password Spraying

Dig into the differences between these two common attack types, and how you can prevent account takeovers that stem from either one.

Surviving a Data Breach - interview with Roy Mellinger

Surviving a Data Breach at Anthem: A CISO’s Perspective

The cost of a data breach in the healthcare industry is now at an all-time high: $7.13M. Roy Mellinger, former Anthem CISO, shares his perspective & lessons learned from their 2015 breach – takeaways that are relevant for security leaders from all industries.

Modernize Your Password Security Policy with Latest NIST Guidelines

Confused by the lastest NIST password guidelines? We’ve condensed the recommendations from NIST into an easy-to-follow guide to help you protect your employee and consumer accounts. Plus, learn how SpyCloud’s newest offering can help.

Unemployment Fraud - Recommendations for agencies, fraud teams, employers and individuals

Unemployment Fraud: Who is Using Your Identity to Collect?

Criminals are using stolen credentials and PII to impersonate unemployed workers, diverting the funds from benefit claims into their own pockets. With $26 billion at risk, we provide recommendations for government agencies, fraud teams, employers and individuals on how to stop the bleed.

Preventing Cyberattacks in the Government Supply Chain - CMMC

Get a Demo

Blog

Industries

Products

Resources

Company

SpyCloud Inc.