Oktacron - Cyber Security RSS Feeds History

Have you revoked ex-employees’ access? | Kaspersky official blog

kaspersky Sep 27, 2022 Business

How confident are you that your former employees no longer have access to corporate information? As practice shows, this isnt an irrelevant question. Recently, our colleagues analyzed how well small and medium-sized businesses (SMBs) are prepared for cyberincidents in an unpredictable world. The study found that show more ...

nearly half of the SMBs surveyed were not 100 percent sure that dismissed employees could not still access their business data through cloud services or corporate accounts. What harm can an ex-employee with access to corporate data do? If an ex-employee still has access to work services or information systems, they could do plenty of harm to their former employer – should that float their boat. SMBs usually worry about fairly phantom threats, such as a former employee using corporate data to launch their own rival business or taking a job with a competitor and stealing the companys customers. But in terms of business damage, these are way down the list. If an ex-employee has access to a customer database that contains personal data, what they could do is leak it into the public domain (for example, as revenge for dismissal) or sell it on the dark web. For a start, that would damage the reputation of your business. Second, it could jeopardize your customers, who might take legal action – if not for damages, then at least for having their personal data leaked. Third, you could receive a hefty fine from the regulators. This latter one depends of course on the laws of the country where you operate, but theres a growing trend worldwide toward tightening the penalties for leaks of this kind. Potential problems without malicious intent Some issues are not the result of scheming ex-employees, or even direct leaks. An ex-colleague may not even remember they had access to such-and-such resource. But a routine check by those same regulators might reveal that unauthorized persons do in fact have access to confidential information, which would still result in a fine. And even if youre absolutely certain you parted ways on good terms with everyone, that doesnt mean youre out of the woods. Who can guarantee they didnt use a weak or non-unique password to access work systems, which attackers could brute-force or come across in an unrelated leak? Any redundant access to a system – be it a collaborative environment, work e-mail or virtual machine – increases the attack surface. Even a simple chat among colleagues about non-work issues could be used for social-engineering attacks. How to minimize the risks Most of the measures to combat data leaks through ex-employees accounts are organizational. Thus, we recommend: Minimizing the number of people with access to important corporate data. Setting strict access policies for corporate resources – including e-mail, shared folders and online documents. Keeping a strict access log: record what access was granted and to whom. Revoke it immediately if the employee leaves the company. Creating clear instructions for creating and changing passwords. Introducing regular cybersecurity awareness training for employees.

QUAD nations to assist each other in taking action against malicious cyber activities

cyware Sep 27, 2022 Geopolitical, Terrorism

In a stern warning to state-sponsored malicious cyber activities, the Quad grouping of India, Australia, Japan, and the United States has vowed to assist each other in ensuring the security and resilience of regional cyber infrastructure.

Metador: An Active Threat that Went Undetected for Years

cyware Sep 27, 2022 Threat Actors

Telecoms, Internet Services Providers (ISPs), and universities across the Middle East and Africa have been under attack by a sophisticated threat actor, dubbed Metador. The group uses two custom Windows malware frameworks with one finding its expertise in multi-layered obfuscation and the other being used for more hands-on activities, such as taking screenshots and recording keyboard actions.

Update: Hackers Leak French Hospital Patient Data in Ransom Fight

cyware Sep 27, 2022 Breaches and Incidents

The cyberattackers demanded a multimillion-dollar ransom from the Corbeil-Essonnes hospital near Paris a month ago, but the institution refused to pay. The hackers now dumped medical scans, lab analyses, and the national security numbers of patients.

New SEO Poisoning Campaign Spreads GootLoader Malware

cyware Sep 27, 2022 Malware and Vulnerabilities

Security experts laid bare an extensive SEO poisoning attack campaign targeting employees across industries as well the government sector for the search results of specific terms relevant to their work. Researchers have linked the recent campaign to a threat group, TAC-011, active for several years. It targeted hundreds of WordPress websites to produce thousands of individual blog posts for SEO.

New Erbium Password-stealing Malware Spreads as Game Cracks, Cheats

cyware Sep 27, 2022 Malware and Vulnerabilities

Researchers at Cluster25's team were the first to report on Erbium earlier this month, but a new report by Cyfirma shares further information on how the password-stealing trojan is distributed.

Sony Reintroduced a PS4 Bug on PS5 Which Could Have Led to a Jailbreak

cyware Sep 27, 2022 Trends, Reports, Analysis

Hackers could have jailbroken the PlayStation 5 thanks to a bug that was already discovered and patched on the PlayStation 4 in 2021, but then reappeared on the new console.

Researchers Identify Three Hacktivist Groups Supporting Russian Interests

cyware Sep 27, 2022 Threat Actors

Although some of these are quite certainly operating independently of the Russian state, Mandiant identified multiple hacktivist groups whose moderators are suspected to be either a front for, or operating in coordination with, the Russian state.

Canada: Yukon education department accidentally leaks student data

cyware Sep 27, 2022 Breaches and Incidents

"The breach involves a risk of significant harm to your privacy," reads the letter to affected students. The letter says names, phone numbers, email addresses, dates of birth, and social insurance numbers were all included.

Bangladeshi hacktivist group targeting Indian government websites, servers

cyware Sep 27, 2022 Breaches and Incidents

The group called Mysterious Team Bangladesh (MT) is using DDoS attacks against domains and subdomains of several state governments and a web server hosted by the Indian government, according to the team from cybersecurity firm CloudSEK.

IBM expands HBCU cybersecurity center program to 20 schools

cyware Sep 27, 2022 Security Culture

IBM announced this week that it will be expanding its collaboration with Historically Black College and Universities (HBCUs), bringing its Cybersecurity Leadership Centers to 14 new schools across a total of 11 states.

APT41 Continues Targeting Healthcare, Pharma

cyware Sep 27, 2022 Threat Actors

A new alert by HC3 warned the healthcare sector against constant attacks by Chinese state-sponsored threat group, APT41. The group also targets pharmaceuticals and high-tech industries. It deploys multiple private and public malware to establish a foothold and custom tools to escalate privileges.

Update: Hacker Behind Optus Breach Releases 10,200 Customer Records in Extortion Scheme

cyware Sep 27, 2022 Breaches and Incidents

The Australian Federal Police (AFP) on Monday disclosed it's working to gather "crucial evidence" and that it's collaborating with overseas law enforcement authorities following the hack of telecom provider Optus.

Russian APT28 Hackers Use PowerPoint Files for 'Mouseover' Malware Delivery Technique

cyware Sep 27, 2022 Malware and Vulnerabilities

Hackers believed to work for Russia have started using a new code execution technique that relies on mouse movement in Microsoft PowerPoint presentations to trigger a malicious PowerShell script.

Two Remote Code Execution Vulnerabilities Patched in WhatsApp

cyware Sep 27, 2022 Malware and Vulnerabilities

WhatsApp only has three security advisories for 2022, with the first two released in January and February. The latest advisory, released this month, informs customers of two memory-related issues affecting the WhatsApp mobile applications.

Samsung Sued Over Recent Data Breaches

cyware Sep 27, 2022 Incident Response, Learnings

Represented by Clarkson Law Firm, two Samsung users have filed a class action lawsuit against the electronics manufacturer over the two data breaches the company suffered in 2022.

North Korea's Lazarus Hackers Targeting macOS Users Interested in Crypto Jobs

cyware Sep 27, 2022 Threat Actors

In the latest variant of the campaign observed by cybersecurity company SentinelOne last week, decoy documents advertising positions for the Singapore-based cryptocurrency exchange firm Crypto.com.

Ukraine warns of 'massive cyberattacks' coming from Russia on critical infrastructure sites

cyware Sep 27, 2022 Geopolitical, Terrorism

The Russian government is planning “massive cyberattacks” against Ukrainian critical infrastructure facilities to “increase the effect of missile strikes on electrical supply facilities,” the Ukrainian government said Monday.

85 Adware Applications on Google Play and Apple Store Installed 13 Million Times

cyware Sep 27, 2022 Malware and Vulnerabilities

Apart from flooding mobile users with advertisements, both visible and hidden, the fraudulent apps also generated revenue by impersonating legitimate apps and impressions.

Hacktivist Attacks Show Ease of Hacking Industrial Control Systems

cyware Sep 27, 2022 Trends, Reports, Analysis

It’s well known that ICS is often exposed to the internet and in many cases, these systems can be easily accessed via insecure configurations, vulnerabilities, and widely available tools.

How Underground Groups Use Stolen Identities and Deepfakes

cyware Sep 27, 2022 Trends, Reports, Analysis

The growing appearance of deepfake attacks is significantly reshaping the threat landscape for organizations, financial institutions, celebrities, political figures, and even ordinary people.

More Than Meets the Eye: Exposing a Polyglot File That Delivers IcedID

cyware Sep 27, 2022 Malware and Vulnerabilities

This particular attack chain was discovered in early August 2022 and delivered IcedID, also known as Bokbot, as the final payload. This information stealer, IcedID, is well-known malware that has been attacking users since 2019.

Global Firms Deal with 51 Security Incidents Each Day

cyware Sep 27, 2022 Trends, Reports, Analysis

Trellix found that the average SecOps team has to manage 51 incidents per day, with 36% of respondents claiming they deal with 50 to 200 daily incidents. Around half (46%) agreed that they are “inundated by a never-ending stream of cyber-attacks.”

Agent Tesla RAT Delivered by Quantum Builder With New TTPs

cyware Sep 27, 2022 Malware and Vulnerabilities

Zscaler ThreatLabz has observed a campaign that delivers Agent Tesla, a .NET-based keylogger and remote access trojan (RAT) active since 2014, using a builder named “Quantum Builder” sold on the dark web.

National Data Privacy Proposal May Shape Health Data Not Covered By HIPAA

packetstormsecurity Sep 27, 2022 headline,government,privacy,usa

Impact! NASA's DART Spacecraft Crashes Head-On Into Asteroid

packetstormsecurity Sep 27, 2022 headline,usa,space,cyberwar

Alleged Optus Hacker Apologizes For Data Breach

packetstormsecurity Sep 27, 2022 headline,hacker,privacy,phone,australia,