Federal authorities have brought civil and criminal actions related to a cyberattack on the Securities and Exchange Commission.
The Washington Post reports:
[T]he Securities and Exchange Commission alleged that the defendants launched a sophisticated cyberattack against the agency starting in 2016. Once they penetrated the SEC’s system, the hackers stole thousands of documents with sensitive, confidential information about corporations’ financial conditions. They used that information to make a profit from illegal trading, prosecutors said.
The indictment provides the details on what a sophisticated cyberattack includes:
7. It was further part of the conspiracy that the defendants and others employed phishing attacks to send malicious emails to SEC employees that were made to falsely appear as though they originated from actual SEC employees. As a result of the co-conspirators’ phishing attacks, which misrepresented their identities, the co-conspirators successfully infected a number of SEC computers with malware. Once these computers were infected, the co-conspirators used them to probe the SEC’s network and to steal information to use in their ongoing efforts to gain unauthorized access to Test Filings.
Test Filings are drafts corporations file with the SEC. These drafts contain information before the information is made public.
SP Guard from Iconix disrupts the misrepresentation required to perpetrate phishing.