Welcome to the latest edition of The Week in Cybersecurity, which brings you the newest headlines from both the world and our team about the most pressing topics in cybersecurity. This week: Evidence has surfaced of cybercrime’s fast-paced growth in 2022, a new Google Chrome zero-day vulnerability is being exploited, and more.

This week’s top story

Cybercrime growth is outpacing the cybersecurity industry

Technology and innovation are driving change across our economy. But in one key area, experts say we shouldn’t expect to see much change in the near future: growing the cybersecurity workforce.

Today, in 2022, it’s estimated that there are 3.5 million unfilled cybersecurity positions. In 2025, experts expect that number to be unchanged, due largely to an acute shortage of cybersecurity professionals. The same can’t be said of things on the other side of the fence. In fact, the expected growth in the global population of cybercriminals could see cybercriminal activity outpacing the cybersecurity industry’s capabilities in just a few years.

As Security Boulevard reports, citing a new report from Fortinet’s FortiGuard Labs, there are worrying trends in the growth of cybercrime. For example, the report notes that the number of ransomware variants detected in the last 6 months has doubled, with 10,666 new variants being detected during this time period, compared to just 5,400 new variants detected in the second half of 2021.

Also in the counting are malware wipers, which are becoming more visible due to their use in Russia’s war on Ukraine. The report cites that there have been at least 7 new malware wipers in the first half of 2022, demonstrating a surge in these kinds of strains when compared to the small number of wipers detected since 2012. And 2022 is also on-pace to be a record-setting year for exploitation of zero-day vulnerabilities, Fortinet’s report concludes.

While this increase in activity comes as no surprise, the rate of growth here is concerning, according to Fortinet’s VP of Global Threat Intelligence Derek Manky. Based on Fortinet’s research and its estimated predictions for the near future, the cybersecurity industry lacks the bandwidth it needs to take on this expected growth. Mitigating new ransomware and malware wiper strains, shoring up defenses, and patching vulnerabilities will require trained professionals — and that demands that we put an end to cybersecurity’s major labor shortage.

News Roundup

Here are the stories we’re paying attention to this week…

New Google Chrome 0-day vulnerability being exploited in the wild (The Hacker News)

Google on Tuesday rolled out patches for Chrome browser for desktops to contain an actively exploited high-severity zero-day flaw in the wild. Tracked as CVE-2022-2856, the issue has been described as a case of insufficient validation of untrusted input in Intents.

Cybercriminals switch to LNK files to spread malware (Hewlett Packard)

A report by HP finds an 11% rise in archive files containing malware, including LNK files, as Microsoft drops support for macros in its Microsoft Office applications. The team also spotted LNK malware builders available for purchase on hacker forums, making it easy for cybercriminals to shift to this “macro-free” code execution technique by creating weaponized shortcut files and spreading them to businesses.

Security analysis leads to discovery of vulnerabilities in 18 electron applications (Security Week)

Security holes in the Electron cross platform development framework have been linked to exploitable holes in a wide range of applications developed using Electron including Microsoft Teams, Discord, Visual Studio Code, Basecamp, Mattermost, Element, Notion, JupyterLab, and Rocket.Chat, among others.

Two more malicious Python packages in the PyPI (Secure List)

"We used our internal automated system for monitoring open-source repositories and discovered two other malicious Python packages in the PyPI. They were masquerading as one of the most popular open-source packages named requests."

Ransomware attack blamed for closure of all 7-Eleven stores in Denmark (The State of Security)

Ransomware is to blame for the closure of all 175 7-Eleven stores in Denmark on Monday. The retailer closed all of its stores in Denmark after its cash registers and payment systems were brought down in the attack.

Janet Jackson music video declared a cybersecurity exploit (The Register)

The music video for Janet Jackson's 1989 pop hit Rhythm Nation has been recognized as a cybersecurity risk after Microsoft reported that playing the video can crash old laptop computers. The story of “how” describes one of the strangest exploits in a long time - and is worth reading.