A cyber crime ring known as Vendetta Brothers Inc. has distinguished itself in the world of online theft by relying on tactics more familiar to real-world criminals. A profile published by security vendor FireEye highlights how this ring, run by a pair of hackers known as “1nsider” and “p0s3id0n”, has achieved a level of success and longevity that is rare in the world of cyber crime.

The group primarily pursues point-of-sale targets and sells data that it is able to harvest online. Most groups would coordinate and deploy the attack using its own resources. Vendetta Brothers Inc. stands apart by outsourcing the most time and labor intensive technical aspects of the attacks.

This strategy has two primary benefits. First, it allows the group to implement a larger number of attacks and reap a greater number of rewards. Second, and more significant, the group is able to insulate itself from investigation. The people actually perpetrating the attacks are separate enough from Vendetta Brothers Inc. that if they were ever to be caught they would not be able to lead investigators back to the hackers at the top of the cyber crime ring.

The groups is hardly the biggest collection of point-of-sale hackers. Since the researchers at FireEye began studying Vendetta Brothers Inc. the group has posted the data for around 9,400 payment cards on its online marketplace. Some other groups have posted data for hundreds of thousands of cards. However, Vendetta Brother Inc. is operated by a pair who is able to reap the majority of the rewards for data theft while avoiding the primary share of the risk.

The group relies on a number of tactics to steal data. In some cases they simply post ads on the dark web looking for hackers who have already gained access to point-of-sale systems. In others they send out spam emails with malware embedded in attachments. They extend their operation into the real world by installing card skimmers on bank machines along with discreet video cameras able to record information displayed on the screen and typed in to the keypad. By relying on multiple methods, Vendetta Brothers Inc. is able to minimize the risk of detection and discovery.

Summarizing the problem, FireEye researchers wrote “Despite the Vendetta Brothers’ relatively small operation, they nonetheless emulate proven practices from both business and organized crime that indicate thoughtful planning on how to maximize profit and minimize risk.”

Last week Yahoo revealed that over 500 million users had been affected by one of the largest data breaches in history. Disgruntled users in Illinois and California have already filed class-action lawsuits aimed at holding the struggling internet giant responsible.

The lawsuits are not only related to Yahoo’s ineffective information security measures. They also relate to the amount of time it took the company to reveal the data breach. Some plantiffs contend that by failing to announce the breach immediately, cyber criminals had time to exploit data before users were able to take simple protective measures.

These plaintiffs specifically cited a study conducted by the Ponemon Institute identifying 191 days as the average amount of time necessary to detect and announce a data breach affecting public users. In the case of the Yahoo data breach, the company took two years to detect and announce the breach.

Yahoo has blamed the attack on a state-sponsored group of hackers but has declined to point a finger at any specific nation. Some have questioned whether the the attack was actually state sponsored or whether Yahoo is making that claim to hide the embarrassment of being breached by a less sophisticated group of cyber criminals.

The data breach included included names, addresses, dates of birth, passwords, and in some cases security questions and answers. Users of the company’s email, fantasy sport, and finance sites were all affected.

Yahoo reportedly launched the investigation into the breach beginning in July. The initial focus, however, was on a suspected data breach that occurred in 2012. At the start of the investigation Yahoo was negotiating with Verizon so sell of it’s core internet business for $4.8 billion. The breach was not immediately disclosed, and some have reported that it could reduce the sale price significantly.

The findings of security experts bolster the plaintiff claims that Yahoo misrepresented the safety of its systems and services. A company that specializes in securing cryptographic keys found several troubling flaws after auditing external Yahoo websites. More than a quarter of the certificates audited had not been updated since 2015, a serious lapse of security best practices. This lapse may not contributed to the data breach named in the lawsuits, but does indicate a corporate culture that failed to adequately prioritize data security.

If the number of lawsuits increases, it could continue to lower the sale price of Yahoo. The information revealed within these lawsuits could also reduce the already dwindling numbers of Yahoo users.

Cyber security researchers have discovered a new strain of malware that uses a novel technique to evade detection. The malware is able to detect when it is being accessed in a security testing environment and automatically suspends any planned attack.

The malware is document based. Once present on a computer, it analyzes how many other documents are present on that same computer. If a certain number are not present, the malware simply lies dormant.

Security testers typically used virtualized machines and testing environments to examine suspected malware. These environments replicate actual computing environments but are not as complete or detailed. Similar to a set in movie, they are similar but not exact copies. The developer of the malware realized that a sparse number of documents is a reliable indicator of a security testing environment and used that fact to avoid detection.

If malware does not do anything suspicious or malicious, it is unlikely that it will be identified or removed. That empowers it to lie in waiting until it can inflict the maximum amount of damage.

Once the malware has been downloaded, it checks the machine’s recent files folder. If the folder has less than two files listed, it is determined to be a virtualized machine. However, if more than two files are present the malware proceeds to download a keylogger.

The malware is also able to read a machine’s IP address and cross reference it against a list of IP addresses know to be used by security research firms. If the malware believes that it is being examined by a cyber security professional, it does not download the keylogger.

This form of evasion is not entirely new. Researchers have discovered other strains of malware that look for tell-tale signs of virtualized machines and the fingerprints of security researchers. This most recent stain is different, however, by relying on indicators that are uniquely simplistic. It also stands apart by being a relatively basic form of malware that incorporates sophisticated evasion strategies.

Experts caution that these types of strategies are likely to become increasingly common. And the longer a strain of malware is allowed to go undetected, the more damage it can do. It will be incumbent on security vendors and researchers to develop less conspicuous testing environments and more nuanced techniques for identifying malware. This is yet another frustrating example of cyber criminals outsmarting the people tasked with stopping them.

Officials from Yahoo announced on Thursday that information from at least 500 million user accounts was stolen in 2014. The information includes names, addresses and dates of birth. In some cases encrypted and unencrypted information like security questions and answers was also stolen. This ranks as one of the largest single data breaches in history.

Adding to the shock over the size of the attack is the belief that the attack was perpetrated by a state-sponsored network for hackers. Yahoo revealed this suspicion in its announcement but has yet to identify a specific culprit. The FBI is currently investigating the breach but has declined to offer comment.

The attack was first detected in August when a user identified as “Peace” attempted to sell information harvested from the accounts on the dark web – a secretive online marketplace for illicit and illegal materials.

Around 1 billion people currently use some sort of Yahoo property on a monthly basis. The company is contacting affected users and offering advice for securing their various accounts. Unencrypted security questions and answers will need to be changed, along with passwords that have not been reset since 2014. The largest number of affected users rely on Yahoo mail, but users of Yahoo Finance and Yahoo Fantasy Sports should also take precautions.

This data breach comes at an inopportune time for Yahoo. Reeling form multiple quarters of stagnant growth, the internet giant is currently in negotiations to sell its core business properties to Verizon Wireless. The sale is valued at $4.8 billion. Experts have warned that with Yahoo in a state of flux it may be difficult for officials within the company to take full responsibility for responding to the data breach.

The breach itself is not expected to derail the sale. But if a large number of users elect to cancel their Yahoo accounts over security concerns it could lower the sale price. By some estimates, the price could drop $100 million to $200 million.

Users with older and inactive Yahoo accounts may be unconcerned by the breach. Experts warn, however, that there could be wide ranging consequences. For instance, if the username and password used to login to a Yahoo Mail account are the same credentials used to login to other non-Yahoo accounts, hackers may have unrestricted access. This is a technique called credential stuffing, and it has become extremely common in recent years.

Once hackers have access to current accounts they begin assembling a profile of each user incorporating all available information. This profile is known as a “fullz”, and experts warn that profiles already exist for a large percentage of the US population. The data breach at Yahoo potentially exposes vast streams of data for cyber criminals to exploit.

A growing chorus of cybersecurity experts is warning that fantasy sports websites represent a prime target for hackers. The volume and sensitivity of data on these sites is significant. And many have failed to put expansive data protection measures into place.

The internet is rife with fantasy sport sites. However, just two – DraftKings and Fan Duel – share the bulk of the traffic. These sites allow users to predict the performance of individual athletes and compete against other users for cash prizes. Fantasy football is the biggest draw, but most major sports now have pay-to-play fantasy options available.

These sites do million of dollars in transactions in a short period of time. The daily fantasy industry netted $290.7 million in revenue just in the US in 2015. DraftKings accounted for $174 million of that revenue and FanDuel for $106 million. It is predicted that growing competition in the market will push the total revenue for daily fantasy sports into the billions in the near future.

In addition to the money itself, these sites store the personal and financial data of million of users. These sites may not rank in the Top 10 of consumer-facing websites, but their appeal as targets for hackers is significant.

Theft is not the only concern. Experts have also warned that hackers could manipulate the data used to determine winners and losers to award legitimate prizes to fraudulent users. The explosion in traffic these sites face on the Sunday morning before most football games also puts them at risk of denial-of-service and zero day attacks.

Both FanDuel and DraftKings have stood behind the depth and breadth of the security measures they have in place. DraftKings in particular has said that access to sensitive information is strictly limited and only authorized on a case-by-case basis after thorough vetting.

Despite these assertions, experts have encouraged both sites to update and expand their security protocols. They call for transparency and disclosure in regards to where, what, and how data is stored. These experts have also warned that if a data breach were to occur it would likely subject any daily fantasy provider to a wave of lawsuits.

Both websites have previously faced lawsuits accusing them of false advertising and fraud after it was discovered that employees were placing bets using information not available to the public. This practice is not illegal, but by doing it the companies put sensitive information at risk that could have led to losses for public players totaling millions.

A recent report by Cybersecurity Ventures reveals that the current unemployment rate for cybersecurity professionals stands at 0%. In fact, there are as many as 1 million cyber security positions currently going unfilled.

This news is notable, but hardly shocking for cybersecurity insiders. The number of unfilled positions is largely unchanged from the same time last year, underscoring the challenges of making forward progress in terms of hiring. The gulf is expect to increase to 1.5 million unfilled positions by 2019, with the need for cybersecurity professionals reaching 6 million worldwide.

Experts from throughout the tech industry have commented on the challenges of recruiting and retaining required cyber security talent. Some point to a lack of quality education and training. Until the number of available cyber security programs and graduates begins to increase significantly, there will never be enough qualified candidates available to adequately respond to the threat of cyber crime.

Part of the blame is also placed on the employers. In the rush to fill vacant roles, many have tried to recruit one professional to fill multiple vacant positions. That requires an unrealistic skill set while creating an unmanageable workload for anyone occupying these positions. As a result, turnover is high and security suffers.

In order to combat the talent gap, companies have begun increasing salary and benefits for cybersecurity professionals while prioritizing training and professional development in entry-level positions. Until academia is able to meet the recruiting demand, companies will need to develop their own talent.

Experts also point to the granulated nature of cyber crime as an employment challenge. There is not a single skill set necessary to be successful in one of these roles. And often professional who excel in one area struggle in another. Recruiting needs to acknowledge these differences and narrow the list of required hard and soft skills in order to find talent that is poised to succeed and able to commit long term.

The consensus, however, is that the single biggest obstacle to recruiting is the evolving nature of cyber crime itself. With new advanced threats appearing regularly and wreaking havoc across enterprises and industries, hiring is often reactive by necessity and ineffective as a result.

By some estimates cyber crime will cost the world $6 trillion annually by 2021. In 2015 the estimated cost was $3 trillion. Spending on products and services meant to combat the threat will also increase to $1 trillion annually by 2021. By all accounts, the demand for cybersecurity professional will continue to outpace supply into the foreseeable future.

Google has announced plans to offer a significant reward to anyone capable of uncovering severe vulnerabilities on Android mobile devices. The Project Zero Prize is worth up to $200,000

The prize was first offered on September 13 and will be available until March 14. Anyone with research expertise is invited to search for critical Android bugs, particularly as they apply to Nexus 6P and Nexus 5x devices running the most current builds.

Bounty bug programs of this sort are not unique, however the amount that Google is offering is significantly larger than normal. The tech giant is also taking the unusual step of requesting that vulnerabilities be reported immediately even if they are not yet fully understood. If the issue exposed is found to contribute to vulnerabilities exposed by other researchers, only the first person/team to claim it will receive credit. The goal of this approach is to expedite the resolution process and prevent the issue of “bug hoarding” in which researchers wait to disclose vulnerabilities in order to claim a larger bounty.

A prize of $200,000 will be given to the first winning entry, with $100,000 going to the second and an undisclosed number of $50,000 prizes being awarded though the Android Security Rewards program.

Google Staffer Natalie Silvanovich said in a press release announcing the Project Zero Prize that “Our main motivation is to gain information about how these bugs and exploits work. There are often rumors of remote Android exploits, but it’s fairly rare to see one in action. We’re hoping this contest will improve the public body of knowledge on these types of exploits. Hopefully this will teach us what components these issues can exist in, how security mitigations are bypassed and other information that could help protect against these types of bugs.”

After a bug has been found and claimed, the researcher will be required to demonstrate it in a live settings. The bug must allow the researchers to access a specific file on the device, and the only interaction allowed with the device will be opening Gmail or Messanger. Guideline for the prize winners state that the exploits must take a limited amount to time to initiate, not interfere with the function of the device, and not give clear indication that the device is being exploited.

Apple announced a similar program with an identical top prize in early August. The only major difference is that the Apple bounty program is only open to a select number of researchers who have received an explicit invitation.

Researchers have shown that a theoretical botnet requiring a limited number of resources could potentially disable the ability to access the 911 emergency services network. Though this type of attack has yet to be seen, it could have catastrophic consequences were it ever carried out.

The research was conducted by experts at the Cyber-Security Research Center at the Ben-Gurion University of the Negev in Israel.

When anyone anywhere in the U.S. calls 911, the call is is automatically connected to the enhanced 911 (e911) network. The call is then routed to the nearest public answering point that dispatches police, firefighters, and EMTs.

In the scenario described by researchers, a network of phones infected with a specific type of malware would be triggered to automatically call 911 on repeat. The volume of calls would quickly overwhelm one or multiple public answering points and essentially make it impossible for anyone else to contact emergency responders to request assistance.

Several features of this kind of distributed denial of service (DDoS) attack exacerbate the threat. First and foremost is the relatively small number of phones required to mount the attack. The researchers estimate that it would only take 6,000 infected phones to seriously disrupt services state wide in an area the size of North Carolina. It would only take an estimated 200,000 phones to disrupt the entire nationwide network.

Recognizing and stopping this type of attack is a challenge due to specific FCC regulations that require wireless carriers to automatically forward 911 calls without first identifying the caller and verifying their subscription status. It is also possible to integrate audio into the malware so that dispatchers don’t immediately know if a call is real or fake. As a result, it is very difficult to blacklist phones determined to be infected.

Finally, the particular type of malware used resides in the phone’s baseband processor. This makes it especially difficult to detect and remove. Anyone willing to carry out this type of attack could begin systematically infecting phones with little risk of being caught.

This is not the first time this type of attack has been acknowledged, and some experts are quick to point out that while it is possible, it is neither eminent nor likely. Motivated attackers would need to carry out a coordinated long-term strategy in order to make it viable.

However, the risk is great enough that the Department of Homeland Security awarded the University of Houston a $2.6 million grant last year to develop technology designed to insulate emergency responder networks from DDoS attacks.

Retired Brigadier General Gregory J. Touhill has been appointed as the Federal Chief Information Security Officer (CISO). This is the first time an appointee has held this position.

In February, President Barack Obama outlined a “national attack plan” for cybersecurity. Details included updating aging government networks and developing a high-level commission tasked with improving and monitoring national cybersecurity. The plan also called for the appointment of a senior official tasked with directing cybersecurity efforts across government agencies.

The U.S. already has a Federal CIO, Tony Scott, who is responsible for the management of digital government data. In a blog post authored in collaboration with Cybersecurity Coordinator J. Michael Daniel, Scott wrote that General Touhill would “leverage his considerable experience in managing a range of complex and diverse technical solutions at scale with his strong knowledge of both civilian and military best practices, capabilities, and human capital training, development and retention strategies.”

As Federal CISO, General Touhill will oversee a team within the Office of Management and Budget responsible for developing national policies regarding cybersecurity, implementing best practices across agencies, and conducting audits to confirm that cybersecurity is as ironclad as possible in all corners of government.

General Touhill previously served at Deputy Assistant Secretary for Cybersecurity and Communications in the Office of Cybersecurity and Communications, a division within the Department of Homeland Security. The White House also appointed a former Director for Cybersecurity Policy on the National Security Council to serve as acting Deputy CISO.

Data breaches have plagued the national government in recent years. A high-level hack of the Office of Personnel Management in 2015 exposed the personal information of over 20 million government employees. The attack has been blamed on a culture and leadership that dismissed the risk posed by cyber criminals, rather than on distinct technological failures.

A major responsibility of the CISO will be to recruit, train, and retain cybersecurity professionals who can handle the herculean task of safeguarding government networks against advanced and evolving threats. Historically, the government has faced stiff competition from the private sector to hire top security experts.

Another major responsibility will be to reconfigure national cybersecurity strategies to be more proactive. Currently, most rely on an alert system which only activates preceding an attack. General Touhill and his staff will spearhead an effort to anticipate threats in advance and neutralize them before they can affect data and applications.

FBI officials have offered recommendations to victims of ransomware designed to minimize the severity of the problem while improving the agency’s ability to investigate and prosecute the perpetrators.

First and foremost, the agency recommends not paying the ransom and immediately contacting the Bureau or filing a report at http://www.ic3.gov – the federal government’s website for tracking instances of cyber crime nationally. Officials note that any piece of information from transaction data to a Bitcoin wallet address to the hashtag of the malware or email correspondence could potentially aid the investigation.

Agent Will Bales, the supervisory special agent for the FBI’s Cyber Division, said in a recent panel discussion “People have to remember that ransomware does not affect just one person or one business. It will more than likely move on and affect somebody else. And for those who pay the ransom, it only encourages them to extort the next person.”

Federal Trade Commission Chariwoman Edith Ramirez was also a part of that panel and noted how significantly the threat of ransomware has increased in the past year. She cited Justice Department data noting that 4,000 known ransomware attacks have been perpetrated since the start of 2016. An estimated 93% of phishing emails now also contain some form of ransomware.

Describing the scope of the problem Ramirez commented “Ransomware attackers can access extremely sensitive personal information such as medical data, financial account numbers, and the contents of private communications, some of which may be sold on the dark web.”

The chairwoman also noted that responsibility for the attacks lies not only with the perpetrators but also with the companies tasked with storing and protecting sensitive data. The commission has already made more than 60 enforcement actions around companies found to provide inadequate protection of consumer data. Though still under debate, failing to protect against ransomware may be a violation of federal law.

Agent Biles said that the FBI has made progress in combating ransomware attacks by working in conjunction with local law enforcement agencies but offered no further details. Specific information about these victories was promised in the coming months.

Ransomware has become one of the most consistently lucrative forms of cyber attack in recent years. Trend Micro estimates that ransomware attacks cost enterprises $209 million just in the first half of 2016. This figure does not include the amounts paid by individuals, or instance of ransomware that were paid but went unreported.