The impact of a recently patched security flaw in a widely used file-transfer tool will likely linger across North America for months to come.

Why it matters: Since Progress Software Corp. first uncovered a flaw in the popular file-transfer program MOVEit Transfer, a handful of high-profile organizations — including the BBC, British Airways and the government of Nova Scotia — have publicly warned that hackers have used the flaw to target their systems.

• Cybersecurity company Rapid7 estimates that the majority of the roughly 2,500 online instances of MOVEit are running in the U.S.
• Other firms are reporting that they've heard from dozens of organizations affected by MOVEit-related breaches.

Catch up quick: Last week, Progress warned it had uncovered a critical security flaw in the file-transfer tool that would allow hackers to gain unauthorized access to customers' networks.

• Hackers could then use that access to steal sensitive customer data or run commands on a company's network.
• While Progress released a fix a few days later, the Cl0p ransomware gang has continued to target systems that still aren't patched, according to a U.S. government advisory.

The big picture: The attacks uncovered in the last week are likely only a small fraction of what's to come.

• Typically in this type of attack — known as a supply chain attack — affected organizations aren't fully aware of their exposure to the flaw or put off patching their systems until it's too late.
• This happened following the 2021 discovery of a vulnerability in open-source logging tool Log4j. Even a year after its discovery, nearly three-fourths of affected organizations were still vulnerable.

What they're saying: "This is one that you can think of more as a tornado than a hurricane," Christopher Budd, head of Sophos' X-Ops team, told Axios. "It's not going to hit everyone, but where it is hitting, it's having a significant impact."

Between the lines: One of the biggest obstacles with the MOVEit incident is understanding how attackers exploited the flaw before it was publicly reported.

• Researchers, including those at Sophos, have seen malicious hackers targeting the flaw as early as May 27 — about four days before Progress started warning about the insecurity.

The intrigue: Some organizations might not even know whether they're running the program, Budd said.

• "When you run networks, you've got hundreds, thousands, tens of thousands, hundreds of thousands of systems, and it's hard to know what you're running," Budd said.
• Sometimes departments and individual employees run programs like MOVEit on their devices without getting IT's approval — leaving the IT and security teams with an imperfect picture of what's running on their networks, he added.

Zoom out: The Cl0p ransomware gang, in particular, has made targeting vulnerable file-transfer tools a go-to part of its strategy, the government advisory noted.

• The group also attacked organizations through flaws in Accellion's file transfer tool in 2020 and 2021 and targeted a flaw in Fortra's GoAnywhere file transfer tool earlier this year.

Be smart: All organizations should study their systems to see whether MOVEit is running on their network — and ask their tech vendors to do the same, Budd said.

• If there's no sign, organizations should double-check with all departments and employee devices to make sure no one has downloaded the program without their knowing.
• And if there is a sign of MOVEit on the networks, they should follow the mitigation guidelines on Progress's website and initiate an investigation for evidence of any attack.

Google has a new plan to help organizations apply basic security controls to their artificial intelligence systems and protect them from a new wave of cyber threats.

Why it matters: The new conceptual framework, first shared with Axios earlier this week, could help companies quickly secure AI systems against hackers trying to manipulate AI models or steal the data the models were trained on.

The big picture: When a new emerging tech trend takes hold, cybersecurity and data privacy are often an afterthought for businesses and consumers.

• One example is social media, where users were so eager to connect with one another on new platforms that they paid little mind to how user data was collected, shared or protected.
• Google worries the same thing is happening with AI systems, as companies quickly build and integrate these models into their workflows.

What they're saying: "We want people to remember that many of the risks of AI can be managed by some of these basic elements," Phil Venables, CISO at Google Cloud, told Axios.

• "Even while people are searching for the more advanced approaches, people should really remember that you've got to have the basics right as well."

Details: Google's Secure AI Framework pushes organizations to implement six ideas:

• Assess what existing security controls can be easily extended to new AI systems, such as data encryption.
• Expand existing threat intelligence research to also include specific threats targeting AI systems.
• Adopt automation into the company's cyber defenses to quickly respond to any anomalous activity targeting AI systems.
• Conduct regular reviews of the security measures in place around AI models.
• Constantly test the security of these AI systems through so-called penetration tests and make changes based on those findings.
• And, lastly, build a team that understands AI-related risks to help figure out where AI risk should sit in an organization's overall strategy to mitigate business risks.

Go deeper

The number of cyber incidents involving a fake story or other pretext to lure in victims has more than doubled in the last year, according to a report from Verizon this week.

Why it matters: Pretexting typically involves scammers sending emails, texts or social media messages that purport to be from a family member, boss or client — making it much easier for victims to fall for and harder for company IT teams to detect.

By the numbers: Pretexting was involved in 4.1% of the 16,312 security incidents between November 2021 and October 2022 that Verizon studied for its report.

• That's nearly double the 2.4% share that involved pretext in last year's analysis.

The big picture: Three-fourths of all breaches started with humans, according to Verizon's 2023 report.

• That included incidents where people fell for socially engineered messages or phishing emails, misused their network access, or continued to use leaked passwords.

The intrigue: Pretext-based attacks were responsible for some of the biggest security headlines in the last year.

• A breach at Uber in September started when an employee sent their login credentials to someone claiming to be in the company's IT department.
• And an attack on Twilio involved a similar scheme in which hackers pretended to be the company's IT team and texted employees that their passwords had expired.

Yes, but: Attacks involving pretext still make up a small sliver of all cyber incidents.

What's next: The generative AI boom is handing scammers the tools to customize pretext-based attacks with voice-message impersonations, faked images and other forgeries.

@ D.C.

🏛️ A report from a key policymaking group warns that the U.S. government's current system for managing cyber risk is "outdated" and "cumbersome." (Wall Street Journal)

🕵🏻‍♂️ President Joe Biden has nominated Michael Casey, Democratic staff director of the Senate Intelligence Committee, to lead the intelligence community's National Counterintelligence and Security Center. (The Record)

@ Industry

⚠️ Barracuda is urging customers to physically remove and decommission its Email Security Gateway devices after discovering a zero-day vulnerability. (Krebs on Security)

🧳 Critical infrastructure cybersecurity firm Dragos is cutting 9% of its workforce amid a sales slowdown. (Cybersecurity Dive)

🎓 Universities are increasingly opening cybersecurity centers modeled after law school legal clinics to help small businesses defend against cyberattacks. (Wired)

@ Hackers and hacks

🇰🇵 North Korea's Lazarus Group has been linked to the recent breach of crypto wallet Atomic Wallet. (CoinDesk)

💻 The City of Dallas says it has restored more than 90% of its systems and services following a ransomware attack in early May. (Cybersecurity Dive)

🧩 Google has released a fix for a recently discovered security flaw in the Chrome browser that hackers had recently started targeting. (BleepingComputer)

A moment of levity for our East Coast readers still navigating the hazy, smoke-filled skies. Stay safe out there, everyone.