Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Gaming, Travel and L ...

 Security

Despite the nature of recent cyberattacks, TransUnion's study found that fraudsters are shifting their attention away from financial services and towards the leisure, travel, and gambling industries.  According to the study's findings, approximately 36% of global respondents said they had been affected by   show more ...  

digital fraud scammers related to COVID-19. A large percentage of approximately 39% are from the United States. Melissa Gaddis, senior director of customer success, Global Fraud Solutions at TransUnion stated “One in three people globally have been targeted by or fallen victim to digital fraud during the pandemic, placing even more pressure on businesses to ensure their customers are confident in transacting with them”. The study shows the following key results: Phishing was the most common COVID-19 digital fraud worldwide in Q2 2021 More than one-third of global customers say they have been the victim of COVID-19 digital fraud

image for Transatlantic Cable ...

 News

This week on the Kaspersky Transatlantic Cable podcast, Ahmed, Dave, and I discuss John Oliver’s recent monologue on ransomware and why it’s a good PSA to share with friends and family. We then take a look at the world of malicious social media influencers — in this case from the United Kingdom, where an   show more ...  

investigative reporter identified an “influencer” who was selling phishing texts through his social networking accounts. From there, we jump into the world of crypto and a hacker stealing a boat-ton of coins … and then giving most of them back. The individual says it was to help with security. We debate the level of BS in that statement. Next, it’s back to the United Kingdom, where a commission has said people should not have to give up all of their personal data just to buy a beer at a pub. Ahmed and I had some trouble grasping that issue, so Dave filled us in on this UK peculiarity. In our next story, T-Mobile investigates an alleged data breach affecting more than 100 million users. Finally, we discuss a city in Louisiana that is using garbage trucks and Raspberry Pi units to help determine which areas are current dark spots for high-speed Internet connectivity. If you liked what you heard, please consider subscribing and sharing with your friends. For more information on the stories we covered, see the links below: Social media fraud: The influencers promoting criminal scams Cryptocurrency heist hacker returns $260m in funds No need to swap data for drinks, says privacy body T-Mobile investigating claims of massive customer data breach Hacking garbage trucks to bring broadband to those in need  

image for Wanted: Disgruntled ...

 Latest Warnings

Criminal hackers will try almost anything to get inside a profitable enterprise and secure a million-dollar payday from a ransomware infection. Apparently now that includes emailing employees directly and asking them to unleash the malware inside their employer’s network in exchange for a percentage of any   show more ...  

ransom amount paid by the victim company. Image: Abnormal Security. Crane Hassold, director of threat intelligence at Abnormal Security, described what happened after he adopted a fake persona and responded to the proposal in the screenshot above. It offered to pay him 40 percent of a million-dollar ransom demand if he agreed to launch their malware inside his employer’s network. This particular scammer was fairly chatty, and over the course of five days it emerged that Hassold’s correspondent was forced to change up his initial approach in planning to deploy the DemonWare ransomware strain, which is freely available on GitHub. “According to this actor, he had originally intended to send his targets—all senior-level executives—phishing emails to compromise their accounts, but after that was unsuccessful, he pivoted to this ransomware pretext,” Hassold wrote. Abnormal Security documented how it tied the email back to a young man in Nigeria who acknowledged he was trying to save up money to help fund a new social network he is building called Sociogram. Image: Abnormal Security. Reached via LinkedIn, Sociogram founder Oluwaseun Medayedupin asked to have his startup’s name removed from the story, although he did not respond to questions about whether there were an inaccuracies in Hassold’s report. “Please don’t harm Sociogram’s reputation,” Medayedupin pleaded. “I beg you as a promising young man.” This attacker’s approach may seem fairly amateur, but it would be a mistake to dismiss the threat from West African cybercriminals dabbling in ransomware. While multi-million dollar ransomware payments are hogging the headlines, by far the biggest financial losses tied to cybercrime each year stem from so-called Business Email Compromise (BEC) or CEO Scams, in which crooks mainly based in Africa and Southeast Asia will spoof communications from executives at the target firm in a bid to initiate unauthorized international wire transfers. According to the latest figures (PDF) released by the FBI Internet Crime Complaint Center (IC3), the reported losses from BEC scams continue to dwarf other cybercrime loss categories, increasing to $1.86 billion in 2020. Image: FBI “Knowing the actor is Nigerian really brings the entire story full circle and provides some notable context to the tactics used in the initial email we identified,” Hassold wrote. “For decades, West African scammers, primarily located in Nigeria, have perfected the use of social engineering in cybercrime activity.” “While the most common cyber attack we see from Nigerian actors (and most damaging attack globally) is business email compromise (BEC), it makes sense that a Nigerian actor would fall back on using similar social engineering techniques, even when attempting to successfully deploy a more technically sophisticated attack like ransomware,” Hassold concluded. DON’T QUIT YOUR DAY JOB Cybercriminals trolling for disgruntled employees is hardly a new development. Big companies have long been worried about the very real threat of disgruntled employees creating identities on darknet sites and then offering to trash their employer’s network for a fee (for more on that, see my 2016 story, Rise of the Darknet Stokes Fear of the Insider). Indeed, perhaps this enterprising Nigerian scammer is just keeping up with current trends. Several established ransomware affiliate gangs that have recently rebranded under new banners seem to have done away with the affiliate model in favor of just buying illicit access to corporate networks. For example, the Lockbit 2.0 ransomware-as-a-service gang actually includes a solicitation for insiders in the desktop wallpaper left behind on systems encrypted with the malware. “Would you like to earn millions of dollars? Our company acquires access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company,” LockBit’s unusual ad reads. “You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. Companies pay us the foreclosure for the decryption of files and prevention of data leak.” Image: Sophos. Likewise, the newly formed BlackMatter ransomware gang kicked off its presence on the cybercrime forums with the unassuming thread, “Buying/monetizing your access to corporate networks.” The rest of the post reads: We are looking for access to corporate networks in the following countries: – the USA – Canada – Australia – the UK All lines of business except for: – Healthcare – Government entities. Requirements: – Revenue according to ZoomInfo: over 100 million. – Number of hosts: 500 to 15,000. – We do not accept networks that anybody else has already tried to work on. Two options of cooperation: – We buy networks: 3 to 100k. – We monetize them (subject to negotiation on a case-by-case basis). How we work: You select an option of cooperation. -> You provide access to the network. -> We check it. -> We take it or not (depending on whether it meets the requirements).

 Trends, Reports, Analysis

AI security isn’t going to replace CISOs and security teams in the war against data breaches. Instead, it will work with humans as a way to address potential threats at the earliest stages.

 Trends, Reports, Analysis

Declan Harrington, 21, pleaded guilty last week to five counts of wire fraud and one count each of conspiracy, computer fraud and abuse, and aggravated identity theft, federal prosecutors say.

 Malware and Vulnerabilities

Networking equipment vendor Cisco said today that some of its security products fail to detect and stop traffic to malicious servers that abuse a technique called SNIcat to covertly steal data.

 Identity Theft, Fraud, Scams

Cybercriminals use SEO poisoning to ensure that links to phishing sites and other malicious sites are displayed at the top of search results pages when searching for Olympic-related keywords.

 Companies to Watch

Headquartered in Sydney with offices in Melbourne and Brisbane, Loop Secure specialises in managed security, governance, risk and compliance (GRC) and offensive security services.

 Trends, Reports, Analysis

A group of academics stated that network middleboxes such as firewalls, Network Address Translators (NATs), load balancers, and Deep Packet Inspection (DPI) boxes can be weaponized to launch more sophisticated DDoS reflection amplification attacks.

 Malware and Vulnerabilities

FluBot was found targeting finance apps belonging to Polish and German banks by impersonating the app's login form in a new overlay attack. Earlier, in the month of June, this malware was seen imitating postal and logistic service apps to lure its victims. While smartphone users must restrict access to known   show more ...  

FluBot lure sites, users should refrain from downloading apps from message links or third-party sources.

 Malware and Vulnerabilities

IBM X-Force Threat Intelligence studied different versions of the Diavol ransomware whose code configuration hinted at a possible link to the TrickBot group. TrickBot has been observed using group and campaign IDs, which are used by Diavol as well. Experts say, sharing threat intelligence between organizations can be a good way to stop such threats.

 Threat Actors

Check Point Research said the Indra APT group was behind crippling Iran’s transport ministry and national train system in a cyberattack recently. Attackers disseminated three different versions of Meteor, Stardust, and Comet wipers into the victim's network. Even though the group has not taken   show more ...  

responsibility for the recent attack on Iran, the multiple similarities in tactics and techniques indicate otherwise.

 Feed

Red Hat Security Advisory 2021-3219-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 7 and 8. Issues addressed include a denial of service vulnerability.

 Feed

Red Hat Security Advisory 2021-3217-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8. Issues addressed include a denial of service vulnerability.

 Feed

Red Hat Security Advisory 2021-3218-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4. Issues addressed include a denial of service vulnerability.

 Feed

Red Hat Security Advisory 2021-3216-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.3. Issues addressed include a denial of service vulnerability.

 Feed

Cybersecurity researchers have disclosed details about an early development version of a nascent ransomware strain called Diavol that has been linked to threat actors behind the infamous TrickBot syndicate. The latest findings from IBM X-Force show that the ransomware sample shares similarities to other malware that has been attributed to the cybercrime gang, thus establishing a clearer

 Hacked celebrities

The Great Londini has gathered a two million strong army to out TikTok trolls, there's a bad supply chain vulnerability in many IoT devices, and how did Wikipedia pages end up covered in Nazi swastikas? All this and much more is discussed in the latest edition of the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by John Hawes.

2021-08
Aggregator history
Thursday, August 19
SUN
MON
TUE
WED
THU
FRI
SAT
AugustSeptemberOctober