Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Kaspersky Threat Int ...

 Business

For many companies, threat intelligence means only indicators of compromise data and information on specific cybercriminal tools. But in fact, threat intelligence implies a much deeper knowledge about threat actors, including tracking their activity on the network. Sometimes this information allows you to not only to   show more ...  

get an idea of the criminal methods and tactics, but also to prevent a cybercrime. A vivid example is the recent case of a Latin American countrys central bank. What happened While studying cybercriminal activity, our experts learned that one group managed to access the banks network. Investigators immediately notified the victim, contacted Interpol and jointly conducted a thorough investigation into the incident. As a result, they managed to eliminate vulnerabilities in corporate infrastructure and prevent real financial losses. Unfortunately, we ?annot share the details of the incident and describe how the attackers penetrated the banks network. How our experts managed to detect the activity of intruders Not all cybercriminals are responsible for a full attack cycle — from initial studying the target to the final move (which is usually data or money exfiltration, or ransomware infection). There are groups that specialize exclusively in gaining access to the infrastructure of companies: having successfully penetrated the network, they try to sell access to those who can organize an attack on the dark web or on hacker forums. Moreover, there are so-called Initial Access Brokers that buy access and then resell it to other cybercriminals. While studying the activities of completely different criminals, our researchers discovered that someone is looking for partners to attack the bank in order to perform some kind of cyberfraud. They shared some information as a proof of access to the banks infrastructure, and it helped our experts to identify the victim and prevent the crime. How threat intelligence can help a particular company? In this case our experts were not searching for signs of an attack on a particular bank. This bank wasnt even our client. However, our instruments can allow you to track threats for a specific organization. Our Threat Intelligence portfolio includes a Digital Footprint Intelligence service that allows you to create a dynamic digital portrait of an organization, and then to track dangerous symptoms through open sources on the dark web and deep web. Sometimes this allows you to prevent quite serious cyber incidents. In addition, to protect against sophisticated attacks, we recommend using services such as Managed Detection and Response. It allows your cybersecurity team to employ the help of external experts to detect and stop complex attacks on company infrastructure at an early stage.

 Expert Blogs and Opinion

One company, stage, or process with insufficient security makes the entire chain more vulnerable to hackers and can open up a huge amount of risk when we consider the size and value of global chains.

 Security Tips and Advice

Cisco devices are used throughout the DoD, the defense industrial base, and national security systems, and any unsecured credentials on these devices could lead to entire networks getting compromised.

 Malware and Vulnerabilities

The master decryption keys for Maze, Egregor, and Sekhmet ransomware victims were released, as claimed, by one of the developers of the three ransomware. The poster on the forum said that this was a planned leak and did not have any relation to law enforcement operations. Though, experts suspect that the release of keys could be an attempt to trick law enforcement agencies.

 Malware and Vulnerabilities

Check Point disclosed that an updated version of the TrickBot malware is targeting customers of 60 financial and technology firms primarily located in the U.S. Researchers believe that the actual victims are not the brands themselves but their customers. The malware stands as a priority threat, requiring continuous monitoring and tracking by the security community around the globe.

 Threat Actors

Palo Alto Networks unearthed an ongoing email campaign by Emotet operators, which now propagates through malicious Excel files while also implementing other obfuscation techniques. For this, attackers have used email thread hijacking and some other attack tactics. Experts revealed they have been delivering an Excel file with an obfuscated Excel 4.0 macro via socially engineered emails since December 2021.

 Feed

Ubuntu Security Notice 5295-1 - It was discovered that the Packet network protocol implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Jann Horn discovered a race condition in the Unix domain socket   show more ...  

implementation in the Linux kernel that could result in a read-after-free. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 5292-3 - USN-5292-1 fixed several vulnerabilities in snapd. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. James Troup discovered that snap did not properly manage the permissions for the snap directories. A local attacker could possibly use this issue   show more ...  

to expose sensitive information. Ian Johnson discovered that snapd did not properly validate content interfaces and layout paths. A local attacker could possibly use this issue to inject arbitrary AppArmor policy rules, resulting in a bypass of intended access restrictions. The Qualys Research Team discovered that snapd did not properly validate the location of the snap-confine binary. A local attacker could possibly use this issue to execute other arbitrary binaries and escalate privileges. The Qualys Research Team discovered that a race condition existed in the snapd snap-confine binary when preparing a private mount namespace for a snap. A local attacker could possibly use this issue to escalate privileges and execute arbitrary code.

 Feed

Ubuntu Security Notice 5292-2 - USN-5292-1 fixed vulnerabilities in snapd. This update provides the corresponding update for the riscv64 architecture. James Troup discovered that snap did not properly manage the permissions for the snap directories. A local attacker could possibly use this issue to expose sensitive information.

 Feed

Ubuntu Security Notice 5294-1 - It was discovered that the Packet network protocol implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Szymon Heidrich discovered that the USB Gadget subsystem in the   show more ...  

Linux kernel did not properly restrict the size of control requests for certain gadget types, leading to possible out of bounds reads or writes. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 5292-1 - James Troup discovered that snap did not properly manage the permissions for the snap directories. A local attacker could possibly use this issue to expose sensitive information. Ian Johnson discovered that snapd did not properly validate content interfaces and layout paths. A local   show more ...  

attacker could possibly use this issue to inject arbitrary AppArmor policy rules, resulting in a bypass of intended access restrictions.

 Feed

Red Hat Security Advisory 2022-0580-01 - Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications. Issues addressed include a traversal vulnerability.

 Feed

A "potentially destructive actor" aligned with the government of Iran is actively exploiting the well-known Log4j vulnerability to infect unpatched VMware Horizon servers with ransomware. Cybersecurity firm SentinelOne dubbed the group "TunnelVision" owing to their heavy reliance on tunneling tools, with overlaps in tactics observed to that of a broader group tracked under the moniker Phosphorus

 Feed

These days, businesses all around the world have come to depend on cloud platforms for a variety of mission-critical workflows. They keep their CRM data in the cloud. They process their payrolls in the cloud. They even manage their HR processes through the cloud. And all of that means they're trusting the bulk of their privileged business data to those cloud providers, too. And while most major

 Feed

Cisco has released security updates to contain three vulnerabilities affecting its products, including one high-severity flaw in its Email Security Appliance (ESA) that could result in a denial-of-service (DoS) condition on an affected device. The weakness, assigned the identifier CVE-2022-20653 (CVSS score: 7.5), stems from a case of insufficient error handling in DNS name resolution that could

 Feed

Adobe on Thursday updated its advisory for an actively exploited zero-day affecting Adobe Commerce and Magento Open Source to patch a newly discovered flaw that could be weaponized to achieve arbitrary code execution. <!--adsense--> Tracked as CVE-2022-24087, the issue – like CVE-2022-24086 – is rated 9.8 on the CVSS vulnerability scoring system and relates to an "Improper Input Validation" bug

 Feed

Multiple security vulnerabilities have been disclosed in Canonical's Snap software packaging and deployment system, the most critical of which can be exploited to escalate privilege to gain root privileges. Snaps are self-contained application packages that are designed to work on operating systems that use the Linux kernel and can be installed using a tool called snapd. <!--adsense--> Tracked

 Feed

Microsoft has warned of emerging threats in the Web3 landscape, including "ice phishing" campaigns, as a surge in adoption of blockchain and DeFi technologies emphasizes the need to build security into the decentralized web while it's still in its early stages. The company's Microsoft 365 Defender Research Team called out various new avenues through which malicious actors may attempt to trick

 Feed

Numerous Windows machines located in South Korea have been targeted by a botnet tracked as PseudoManuscrypt since at least May 2021 by employing the same delivery tactics of another malware called CryptBot. "PseudoManuscrypt is disguised as an installer that is similar to a form of CryptBot, and is being distributed," South Korean cybersecurity company AhnLab Security Emergency Response Center (

2022-02
Aggregator history
Friday, February 18
TUE
WED
THU
FRI
SAT
SUN
MON
FebruaryMarchApril