A lot has happened this week in the cybersecurity world. A Russian cyber-criminal has been jailed in the U.S; two Asian superpowers are worsening their already rigid relations, while Microsoft has released new patches.

1. A Russian cybercrime boss who has been described to be an asset of supreme importance to Moscow has been convicted to 9 years in a U.S. prison after being arrested for running a site that sold stolen payment card data. Aleksei Burkov was arrested in 2015 while visiting Israel where he stayed until his extradition to the U.S. four years later.  During that time, Russia was continually pressuring the Israeli authorities to send him back supposedly to face separate hacking charges.

2. In another escalation of the relations between China and India, India has banned over 50 Chinese made smartphone apps, including Tik-Tok over concerns that they may be stealing user data. Although the concerns may not be genuine, it surely adds to the rising tensions between the two countries after a border clash left 20 Indian soldiers dead.

‍

3. A pair of out of band patches for Microsoft this week to fix two RCE vulnerabilities. The vulnerabilities which are rated critical and important, are hard to be exploited since the attacker would need to deliver a specially crafted image file, and convince the target to open it, which will result in arbitrary code execution on the endpoint. The patches are available for Windows 10, Windows Server 2019 and Windows Server core, and it is recommended that people install them to protect their systems.

‍

4. The University of California, San Fransisco(UCSF) decided to pay $1.4 million to hackers to retrieve data encrypted during a ransomware attack. The attack only affected a limited number of servers in the School of Medicine. Nevertheless, the data was significantly important, which resulted in the difficult decision made by the faculty, to pay the ransom. For the attack, the hackers used the well known NetWalker malware, but they must have also taken advantage of the lack of IT asset visibility, improperly implemented security monitoring or patch management.

‍

5. The cyber gang responsible for the ransomware attack at a New York-based law firm begins auctioning the stolen data in the dark web. Clients of the law firm include Nicki Minaj, Lebron James and U.S President Donald Trump. Starting prices for the data of a high-status celebrity begin at $600k and carries out a buyout price of $1.5 million.