Darwinium Raises $18 Million for Edge-Based Fraud Prevention Tech

Darwinium, a San Francisco startup in the fraud prevention space, has nabbed $18 million in new capital to build technology to help businesses deal with the deluge of bots, scams and online abuse.

The company, which has roots in Australia, said the $18 million Series A round was led by U.S. Venture Partners (USVP). Darwinium’s seed-stage investors Blackbird, Airtree Ventures and Accomplice also took new equity positions.

Since its launch in 2021, Darwinium has raised $26 million to work on a digital security and fraud prevention platform running on the perimeter edge.

The company is boasting that its platform combines digital security with fraud prevention to create a single view of customer journeys across the web, mobile apps and APIs and provide fraud analytics with customer journey orchestration tooling.

Darwinium argues that its unique integration point — running on the perimeter edge via Content Delivery Networks (CDNs) — gives businesses a continuous view of user behavior, from pre-authentication, through account creation, login, change-of-details, and payments, all via one deployment.

“Moving fraud and risk decisions to the perimeter edge is privacy preserving and low latency. It also removes the reliance on ‘point-in-time’ API-based solutions that are vulnerable to exploitation via operational silos and disjointed risk assessments,” the company added.

Darwinium said customers are using its platform to separate human and bot traffic, add downstream context from upstream user behavior, protect customers from account takeover and identity spoofing, identify scams and social engineering behaviors, block content and promo abuse, and detect fraudulent payments.

Advertisement. Scroll to continue reading.

Last November, Darwinium announced a $10 million seed round and said its product had already been adopted by organizations in the banking, ecommerce, gaming, payments, and travel sectors.

The company is founded by Alisdair Faulkner, who previously founded and scored an exit with ThreatMetrix, a fraud detection firm that was acquired for $817 million in 2018.

https://www.securityweek.com/darwinium-raises-18-million-for-edge-based-fraud-prevention-tech/

WordPress Websites Hacked via Royal Elementor Plugin Zero-Day

Security researchers are warning of a critical-severity vulnerability in the Royal Elementor Addons and Templates WordPress plugin that has been exploited as a zero-day for more than a month.

Developed by WP Royal, the plugin helps domain admins build their websites without any coding experience. Royal Elementor has more than 200,000 active installations on the WordPress marketplace.

The exploited bug, tracked as CVE-2023-5360 (CVSS score of 9.8), is described as an insufficient file type validation in the plugin’s upload function, allowing unauthenticated attackers to upload arbitrary files to vulnerable sites, leading to remote code execution.

The flaw impacts all Royal Elementor versions prior to 1.3.79 and, according to WordPress security firm Defiant, has been exploited in malicious attacks since at least August 30.

To date, the security firm has seen more than 46,000 attacks attempting to exploit this vulnerability, with an increase in activity observed on October 3.

Most attacks, Defiant says, came from three different IP addresses and were aimed at deploying specific files on the target sites, to create a malicious administrator account.

According to Automattic’s WPScan team, which identified and reported the vulnerability, the attackers were seen deploying at least one malicious file into the /wpr-addons/forms/ directory.

Advertisement. Scroll to continue reading.

The plugin, Automattic explains, relied on a simple extension validation to ensure that only certain file types could be uploaded, but which allowed unauthenticated users to manipulate the list of allowed extensions.

“Upon investigation we found that wp_unique_filename WordPress function performs file name and extensions sanitization and, when combined with the file_validity function, would enable bad actors to manipulate the input and bypass the checks,” Automattic notes.

Site admins should check the /wpr-addons/forms/ directory for the presence of malicious PHP files, including one file creating a user account named ‘wordpress_administrator’.

Automattic also observed that threat actors have been exploiting the vulnerability to upload malware to the compromised websites.

Administrators and site owners are advised to update to Royal Elementor version 1.3.79, which patches the vulnerability. The patched version has been available since October 6.

https://www.securityweek.com/wordpress-websites-hacked-via-royal-elementor-plugin-zero-day/

Cable Giant Volex Targeted in Cyberattack

UK-based cable manufacturing giant Volex (AIM: VLX) has been targeted in a cyberattack that involved unauthorized access to some of the company’s IT systems and data.

In a statement issued on Monday, the power and data transmission product manufacturer said all of its sites remain operational and it does not expect any financial impact caused by the incident to be material.

However, it did admit that there has been some “minimal disruption to global production levels”.

“On becoming aware of the incident, the Group enacted its established IT security protocols and took immediate steps to stop the unauthorised access to its systems and data. Specialist, third party consultants have been engaged to investigate the nature and extent of the incident, and to implement the incident response plan,” Volex said.

Volex has not responded to SecurityWeek’s request for additional information, but based on the company’s brief description of the incident, it may have been targeted in a ransomware attack that was either discovered early or that did not involve the deployment of file-encrypting malware, which can typically cause significant disruption in an organization.

SecurityWeek has checked the leak websites of several major ransomware groups, but found no mention of Volex on any of them.

Advertisement. Scroll to continue reading.

Volex shares on the Alternative Investment Market (AIM) of the London Stock Exchange dropped slightly after news of the breach broke.

Volex provides power cords, plugs, connectors, electric vehicle charging solutions, consumer cable harnesses, data transfer cables, and data center power cables. The firm has 27 manufacturing locations and a global workforce of more than 11,500 across 24 countries.

https://www.securityweek.com/cable-giant-volex-targeted-in-cyberattack/

Android Devices With Backdoored Firmware Found in US Schools

Tens of thousands of Android devices have been shipped to end-users with backdoored firmware, according to a warning from cybersecurity vendor Human Security.

As part of the global cybercriminal operation called BadBox (PDF), Human Security found a threat actor relied on supply chain compromise to infect the firmware of more than 70,000 Android smartphones, CTV boxes, and tablet devices with the Triada malware.

The infected devices come from at least one Chinese manufacturer but, before they are delivered to resellers, physical retail stores, and e-commerce warehouses, a backdoor was injected into their firmware.

“Products known to contain the backdoor have been found on public school networks throughout the United States,” Human says.

Discovered in 2016, Triada is a modular trojan residing in a device’s RAM, relying on the Zygote process to hook all applications on Android, actively using root privileges to substitute system files. Over time, the malware went through various iterations and was found pre-installed on low-cost Android devices on at least two occasions.

As part of the BadBox operation that Human Security discovered, the infected low-cost Android devices allow threat actors to carry out various ad-fraud schemes, including one named PeachPit, which at its peak relied on 121,000 Android and 159,000 iOS devices infected with malware, and on 39 Android, iOS, and CTV-centric apps designed to connect to a fake supply-side platform (SSP).

One of the modules delivered to the infected devices from the command-and-control (C&C) server allows the creation of WebViews that are fully hidden from the user, but which “are used to request, render, and click on ads, spoofing the ad requests to look like they’re coming from certain apps, referred by certain websites, and rendered” on specific devices.

Advertisement. Scroll to continue reading.

BadBox, Human Security notes, also includes a residential proxy module that allows the threat actors to sell access to the victim’s network. Furthermore, they can create WhatsApp messaging accounts and Gmail accounts they can then use for other malicious activities.

“Finally, because of the backdoor’s connection to C2 servers on BadBox-infected smartphones, tablets, and CTV boxes, new apps or code can be remotely installed by the threat actors without the device owner’s permission. The threat actors behind BadBox could develop entirely new schemes and deploy them on BadBox-infected devices without any interaction from the devices’ owners,” Human notes.

The cybersecurity firm says that it has managed to disrupt the PeachPit ad fraud scheme and that the BadBox operators have taken down their C&C servers, likely to adapt and circumvent the deployed defensive measures.

Human also warns that BadBox-infected devices cannot be cleaned by the end-users, since the backdoor resides in the firmware partition and that almost all infected devices are lower-price-point, recommending that users choose familiar brands when purchasing new products.

https://www.securityweek.com/android-devices-with-backdoored-firmware-found-in-us-schools/

Microsoft Releases New Report on Cybercrime, State-Sponsored Cyber Operations

The US, Ukraine, and Israel remain the most frequent targets of cyberespionage and cybercrime attacks out of a total of 120 attacked countries, Microsoft says in a new report.

The observed attacks, the tech giant says, were fueled by nation-state spying and influence operations, and more than 40% of the observed attacks targeted critical infrastructure organizations. At times, NATO member states were at the receiving end of half of the observed cyberattacks.

“While headline-grabbing attacks from the past year were often focused on destruction or financial gain with ransomware, data shows the predominant motivation has swung back to a desire to steal information, covertly monitor communication, or to manipulate what people read,” Microsoft notes.

According to the company’s latest Digital Defense Report (PDF – direct download), between July 2022 and June 2023, Russian spy agencies have intensified their attacks in support of the war in Ukraine, while Iranian threat actors have been amplifying manipulative campaigns and targeting sensitive networks for espionage.

Russia and China too have been increasing the scope of their influence operations, the former to intimidate global Ukrainian communities, and the latter to spread covert anti-US propaganda, directly targeting global Chinese-speaking and other communities.

According to the tech giant’s report, state-sponsored threat actors are increasingly employing propaganda to undermine democratic institutions and manipulate national and global opinion.

China has expanded state-sponsored cyberespionage campaigns fueling its Belt and Road Initiative or targeting US military, key facilities, and critical infrastructure, while North Korean hackers were seen targeting a submarine technology company, while continuing to engage in cryptocurrency theft.

Advertisement. Scroll to continue reading.

“While the US, Ukraine, and Israel continue to be most heavily attacked, the last year has seen an increase in the global scope of attacks. This is particularly the case in the Global South, especially Latin America and sub-Saharan Africa. Iran increased its operations in the Middle East. Organizations involved in policymaking and execution were among the most targeted, in line with the shift in focus to espionage,” Microsoft says.

According to the tech giant’s report, state-sponsored threat actors are increasingly employing propaganda to undermine democratic institutions and manipulate national and global opinion.

Microsoft also observed that threat actors are using AI to improve influence operations, but notes that the technology is crucial for defense and for automating and augmenting detection, analysis, response, and prediction.

Since September 2022, Microsoft says, there has been a 200% increase in human-operated ransomware attacks, targeting organizations with customized ransom demands. Since November 2022, the instances of data exfiltration following compromise have doubled, Microsoft’s report shows.

The tech giant also notes that more than 80% of all observed compromises originated from unmanaged or bring-your-own devices and that ransomware operators are exploiting flaws in less common software, to avoid prediction.

The report also shows that the number of password-based and multi-factor authentication (MFA) fatigue attacks has increased. Over the past year, Microsoft observed roughly 6,000 MFA fatigue attempts per day and, in 2023, an average of 4,000 password attacks per second.

https://www.securityweek.com/microsoft-releases-new-report-on-cybercrime-state-sponsored-cyber-operations/

AWS Using MadPot Decoy System to Disrupt APTs, Botnets

Cloud computing giant AWS says an internal threat intel decoy system called MadPot has been used successfully to trap malicious activity, including nation state-backed APTs like Volt Typhoon and Sandworm.

MadPot, the brainchild of AWS software engineer Nima Sharifi Mehr, is described as “a sophisticated system of monitoring sensors and automated response capabilities” that entraps malicious actors, watches their movements, and generates protection data for multiple AWS security products.

AWS said the honeypot system is designed to look like a huge number of plausible innocent targets to pinpoint and stop DDoS botnets and proactively block high-end threat actors like Sandworm from compromising AWS customers.

In a note describing MadPot, AWS said the sensors keep watch on more than 100 million potential threat interactions and probes every day around the world, with approximately 500,000 of those observed activities advancing to the point where they can be classified as malicious.

“That enormous amount of threat intelligence data is ingested, correlated, and analyzed to deliver actionable insights about potentially harmful activity happening across the internet. The response capabilities automatically protect the AWS network from identified threats, and generate outbound communications to other companies whose infrastructure is being used for malicious activities,” the company said.

In the case of Sandworm, AWS said the honeypot caught the actor attempting to exploit a security vulnerability affecting WatchGuard network security appliances. “With close investigation of the payload, we identified not only IP addresses but also other unique attributes associated with the Sandworm threat that were involved in an attempted compromise of an AWS customer,” it added.

“MadPot’s unique ability to mimic a variety of services and engage in high levels of interaction helped us capture additional details about Sandworm campaigns, such as services that the actor was targeting and post-exploitation commands initiated by that actor. Using this intelligence, we notified the customer, who promptly acted to mitigate the vulnerability,” AWS said.

Advertisement. Scroll to continue reading.

In another high-profile case, AWS said the MadPot system was used to help government and law enforcement authorities to identify and disrupt Volt Typhoon, a Chinese state-backed hacking group caught siphoning data from critical infrastructure organizations in Guam, a U.S. territory in the Pacific Ocean.

“Through our investigation inside MadPot, we identified a payload submitted by the threat actor that contained a unique signature, which allowed identification and attribution of activities by Volt Typhoon that would otherwise appear to be unrelated,” AWS explained.

The company said MadPot’s data and findings is used to beef up the quality of its security tooling that include AWS WAF, AWS Shield, AWS Network Firewall, and Amazon Route 53 Resolver DNS Firewall, and detective and reactive services like Amazon GuardDuty, AWS Security Hub, and Amazon Inspector.

https://www.securityweek.com/aws-using-madpot-decoy-system-to-disrupt-apts-botnets/

In Other News: RSA Encryption Attack, Meta AI Privacy, ShinyHunters Hacker Guilty Plea

SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under the radar.

We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape.

Each week, we will curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports.

Here are this week’s stories:

Cybercriminals targeting hotels, booking sites and travel agents

Cybercriminals are deploying infostealer malware on the systems of hotels, booking sites and travel agents, and then use the access they have obtained to reach out to their customers through legitimate communication channels. The goal is to trick the targeted company’s customers to hand over payment card information, Akamai reported.

Diplomatic phishing operations of Russia’s APT29

Advertisement. Scroll to continue reading.

Mandiant has published a technical report describing the diplomatic phishing operations of Russia’s APT29 cyberespionage group since the start of the war in Ukraine. The cybersecurity firm has seen significant changes in the threat actor’s tooling and tradecraft.

Spanish aerospace company targeted by North Korean hackers

A Spanish aerospace company has been targeted by the North Korean hacker group Lazarus with a previously unknown backdoor named LightlessCan. The attackers gained initial access to the company’s systems after posing as a recruiter for Meta, ESET reported.

ShadowSyndicate working with various ransomware groups

Group-IB has analyzed the activities of a threat actor named ShadowSyndicate, which has worked with various ransomware groups and affiliates since July 2022. There is evidence that the group was involved in Quantum, Nokoyawa, ALPHV, Royal, Cl0p, Cactus, and Play ransomware operations.

APT and financial attacks on industrial organizations

Kaspersky has published a report summarizing the state-sponsored and financially motivated attacks launched against industrial organizations in the first half of 2023.

Fort Lauderdale loses $1.2 million in BEC attack

The city of Fort Lauderdale in Florida has lost $1.2 million in a BEC attack that involved the attackers posing as a construction company the city has been working with, CNN reported. The cybercriminals provided documents that made their request for the money seem legitimate.

French hacker pleads guilty in the US

Sebastien Raoult, aka Sezyo Kaizen, a French citizen and member of the notorious ShinyHunters cybercrime group, has pleaded guilty in a US court to fraud and identity theft charges. He was arrested last year in Morocco and extradited to the US in January. Authorities say Raoult and his accomplices stole hundreds of millions of user records and caused losses of over $6 million.

US sanctions Russian and Chinese firms over national security risks

The US has sanctioned companies in China, Russia and other countries, citing national security risks.

Marvin attack on RSA encryption

A researcher has disclosed the details of Marvin, a new attack method against RSA encryption that demonstrates Bleichenbacher-style attacks work against many software implementations of the PKCS#1 v1.5 padding scheme for RSA key exchange that were until now believed to be safe.

Meta describes privacy safeguards in new generative AI features

Meta has described the privacy safeguards implemented in its new generative AI features in an effort to protect users’ information. The new features include a conversational assistant, AI stickers, as well as 28 more AIs with unique personalities and interests.

https://www.securityweek.com/in-other-news-rsa-encryption-attack-meta-ai-privacy-shinyhunters-hacker-guilty-plea/

Progress Software Patches Critical Pre-Auth Flaws in WS_FTP Server Product

Enterprise technology vendor Progress Software on Thursday shipped patches for critical-level security flaws in its WS_FTP file transfer software, warning that a pre-authenticated attacker could wreak havoc on the underlying operating system.

An urgent bulletin from the Burlington, Mass. company documented at least eight security defects that could be exploited remotely and urged business customers to immediately upgrade to WS_FTP Server 2020.0.4 (8.7.4) and WS_FTP Server 2022.0.2 (8.8.2).

Progress Software said two of the vulnerabilities — CVE-2023-40044 and CVE-2023-40045 — are rated critical because of the risk of pre-auth remote command execution attacks.

From the Progress Software bulletin:

CVE-2023-40044 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system. Critical — CVSS: 10/10.
CVE-2023-42657 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path. Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system. Critical — CVSS: 9.9/10.

The company also called attention to a trio of high-severity bugs that could lead to reflected cross-site scripting (XSS) and SQL injection attacks.

Progress Software’s security response team has found itself scrambling to respond to a wave of debilitating ransomware attacks that exploited zero-day flaws in its MOVEit managed file transfer software produyt.

Earlier this year, the company rushed out patches to cover at least three critical vulnerabilities and announced plans to release regular service packs with a “predictable, simple and transparent process for product and security fixes.”

“We have heard from you that a regular cadence and predictable timeline will enable you to better plan your resources and make it easier to adopt new product updates and fixes. As a part of these Service Packs, we will also be optimizing the installation process to make the upgrade process simpler,” Progress said in a note posted with the first service pack.

Advertisement. Scroll to continue reading.

Software vendors typically use a service pack to deliver a collection of updates, fixes, features or enhancements to an application. Service packs are delivered in the form of a single installable package.

https://www.securityweek.com/progress-software-patches-critical-pre-auth-flaws-in-ws_ftp-server-product/

Nigerian Pleads Guilty in US to Million-Dollar BEC Scheme Role

A Nigerian national residing in South Africa last week pleaded guilty in court in the United States to his role in a million-dollar business email compromise (BEC) fraud scheme.

The man, Kosi Goodness Simon-Ebo, 29, was extradited to the US from Canada in April 2023.

According to the plea agreement and other court documents, Simon-Ebo was involved in a conspiracy to commit BEC fraud and money laundering with total intended losses of close to $7 million.

Simon-Ebo admitted in court to gaining unauthorized access to the email accounts of targeted individuals and organizations and to sending email messages from spoofed accounts, to trick victims into making money wire transfers to bank accounts controlled by Simon-Ebo and his co-conspirators.

Between February 2017 and at least July 2017, the defendant admitted, he and his accomplices also conspired to commit money laundering by distributing the funds sent by the victims to other accounts they controlled.

The perpetrators also conspired to withdraw the money from those accounts, obtain cashier’s checks, and write checks to other entities, to hide the source of the funds.

According to the plea agreement, the intended losses for the fraudulent transactions the defendant was directly involved in were of close to $7 million. The actual loss from the scheme, however, was of just over $1 million.

Advertisement. Scroll to continue reading.

Simon-Ebo admitted to having direct control of more than $45,000 of the funds fraudulently obtained from the victims.

Per the plea agreement, “Simon-Ebo will be required to pay a money judgment in the amount of $45,925 and pay restitution in the full amount of the victims’ losses, which the parties agree is at least $1,072,306,” the Department of Justice announced.

Simon-Ebo is scheduled for sentencing on November 29. He faces up to 20 years in prison for his involvement in wire fraud and money laundering conspiracies.

https://www.securityweek.com/nigerian-pleads-guilty-in-us-to-million-dollar-bec-scheme-role/

MGM Resorts Computers Back Up After 10 Days as Analysts Eye Effects of Casino Cyberattacks

MGM Resorts brought to an end a 10-day computer shutdown prompted by efforts to shield from a cyberattack data including hotel reservations and credit card processing, the casino giant said Wednesday, as analysts and academics measured the effects of the event.

“We are pleased that all of our hotels and casinos are operating normally,” the Las Vegas-based company posted on X, the platform formerly known as Twitter. It reported last week that the attack was detected Sept. 10.

Rival casino owner Caesars Entertainment also disclosed last week to federal regulators that it was hit by a cyberattack Sept. 7. It said that its casino and online operations were not disrupted but it could not guarantee that personal information about tens of millions of customers, including driver’s licenses and Social Security numbers of loyalty rewards members, had not been compromised.

Caesars, based in Reno, is widely reported to have paid $15 million of a $30 million ransom sought by a group called Scattered Spider for a promise to secure the data.

Details about the extent of the MGM breach were not immediately disclosed, including the kind of information that may have been compromised and how much it cost the company.

Gregory Moody, professor and director of the cybersecurity program at the University of Nevada, Las Vegas, pointed to quoted estimates that the computer shutdown cost the company up to $8 million per day, which could put the cumulative effect at $80 million. But Moody also noted that MGM Resorts reports annual revenues above $14 billion, which would mean it averages at least $270 million in revenues per week.

The company reported Wednesday that systems handling resort services, dining, entertainment, pools and spas were operational and its website and app were taking dining and spa reservations while the company worked to restore hotel booking and loyalty reward functions.

Advertisement. Scroll to continue reading.

“MGM Resorts properties in Las Vegas and throughout the country are back to normal operations,” spokesman Brian Ahern told The Associated Press. MGM also has properties in Maryland, Massachusetts, Michigan, Mississippi, New Jersey, New York and Ohio.

FBI spokeswoman Sandra Breault in Las Vegas declined to comment and referred to a previous statement by the agency saying an investigation was ongoing.

Experts said the attacks exposed critical cybersecurity weaknesses at MGM and Caesars and shattered an image of casino invulnerability.

“At this point, all casinos should be moving to the highest defensive posture possible and taking active measures to verify the integrity of their systems and environment, and reviewing — if not activating — their incident response processes,” said Christopher Budd, a director of threat research at cybersecurity firm Sophos X-Ops. “There’s been attacks against multiple casinos, and it’s possible we’ll see more.”

Caesars Entertainment is the largest casino owner in the world, with more than 65 million rewards members and properties in 18 states and Canada under the Caesars, Harrah’s, Horseshoe and Eldorado brands. It also has mobile and online operations and sports betting.

MGM Resorts is the largest private employer in Nevada, operating tens of thousands of hotel rooms in Las Vegas at its flagship MGM Grand and properties including Bellagio, Aria, New York-New York and Mandalay Bay. It also operates resorts in China and Macau. It employees 75,000 people in the U.S. and abroad.

Caesars stock traded Wednesday at $50.17 per share, up 36 cents for the day. MGM shares were at $38.77, down 43 cents. Both companies are expected to disclose effects of the attacks in quarterly reports next month to the Securities and Exchange Commission.

The attack on MGM also has been attributed to Scattered Spider, a group of English-speakers also sometimes known as Øktapus operating under a Russia-based operation called ALPHV or BlackCat.

“But there are a lot of conflicting reports,” said David Richardson, an executive at cybersecurity firm Lookout. “You have Scattered Spider claiming that they’ve done both in various forums, and ALPHV, saying that Scattered Spider wasn’t involved with the other. But there’s a lot of technical evidence that shows that there’s a relationship between the two.”

Lisa Plaggemier, executive director at the nonprofit National Cybersecurity Alliance, called MGM’s decision to shut down vulnerable systems to prevent intrusion a positive step but said it highlighted “significant” security gaps and an urgent need for substantial investment in employee training and cybersecurity. The risk, she said, is ”downtime and financial losses.”

“Caesars Entertainment’s decision to pay the ransom highlighted a lack of confidence and investment in their cyber defenses,” Plaggemier said.

Moody, at UNLV, said via email that the attacks showed that even for well-prepared or technically advanced companies, “it is not a matter of if you get attacked, but when you get attacked.”

“Any target can be breached, as defense cannot win 100% of the time,” he said. “It is not that MGM did ‘bad’ or was negligent. If an advanced persistent threat, defined by its heightened skills, resources and time, targets you, they will find a way to access what they should not.”

https://www.securityweek.com/mgm-resorts-computers-back-up-after-10-days-as-analysts-eye-effects-of-casino-cyberattacks/