Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Australia Faces Cybe ...

 Dark Web News

Lulz Security Indonesia, a hacktivist group, has made bold claims regarding a cyberattack on the Australian PM website. Despite providing no concrete evidence beyond Linux screenshots, the group alleges that they successfully breached the security of the official website, https://www.pm.gov.au.  However,   show more ...  

cybersecurity experts question the validity of this assertion, suggesting it may be an attempt to instill fear rather than an actual compromise. The intent behind the cyberattack on the Australian PM’s website is clear – a move to further the hacktivist group’s cause. The threat actor, known as Lulz Security Indonesia, claims responsibility for the attack and expresses sentiments against Israel.  Cyberattack on the Australian PM and #opaustralia Campaign Source: Twitter Notably, these cyberattacks on Australia coincide with the country’s implementation of a “game-changing” cybersecurity plan. The Australian government, led by Clare O’Neil, the Minister for Home Affairs and Cybersecurity, unveiled a comprehensive strategy to combat the rising threat of cyberattacks.  The plan encompasses various initiatives, including awareness programs for businesses and the wider community, measures to ensure safe technology, and coordination efforts for critical infrastructure resilience. The timing of these cyber incidents, following the announcement of the cybersecurity plan, highlights the severity of the challenges faced by Australia in the digital realm. O’Neil emphasizes the dual nature of cyberspace, stating, “We have a cyber threat in front of us, but we also have a cyber opportunity.” The acknowledgment of a looming threat highlights the need for a proactive and collaborative approach to cybersecurity. Australia Strengthens Cybersecurity Defenses The Australian government’s strategy aims to enhance coordination between the public and private sectors in combating cybercrime over the next two years. Additionally, the plan includes measures to promote “cyber maturity” across the entire economy. One innovative proposal involves obliging telecommunications companies to allow “data roaming,” enabling customers affected by a data outage to temporarily switch to a competitor’s network, thereby minimizing the impact of such incidents. In financial terms, the Australian government is committing a substantial budget of 587 million Australian dollars ($385 million) to bolster its cybersecurity initiatives. This investment is part of a broader commitment of 2.3 billion Australian dollars through 2030, as announced by Prime Minister Anthony Albanese’s government. As Australia confronts the challenges posed by cyber threats, the alleged cyberattack on the Australian Prime Minister’s website is a wake-up call for a larger cyber campaign against the country — orchestrated by the Lulz Security Indonesia hacker group.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for R00TK1T Announces Cy ...

 Firewall Daily

The notorious cybercriminal group R00TK1T has alleged a cyberattack on Sanofi. Renowned for its groundbreaking contributions to healthcare, Sanofi has become the first French entity to fall victim to this criminal group’s digital onslaught. The group made its intentions clear on its Telegram channel, announcing   show more ...  

their successful infiltration of Sanofi’s database and hinting at potential repercussions for the company’s stock value. Of particular concern is R00TK1T’s bold assertion that Sanofi is involved in conducting human experiments, a claim that has yet to be substantiated or confirmed by any reliable source. Cyberattack on Sanofi and Allegations of Human Experiments Source: Twitter Sanofi, headquartered in the picturesque city of Paris, stands as a pharmaceutical powerhouse with a big presence in developing countries. Its stocks are actively traded on both the Euronext and NYSE exchanges, holding a coveted position in the “Euro Stoxx 50” index. The cybercriminal group has vowed to expose the alleged dark secrets within Sanofi’s operations, specifically focusing on the unverified allegations of human experiments. As of now, these claims remain unverified, and the authenticity of the information provided by R00TK1T is yet to be established. The Cyber Express, in pursuit of clarity and facts, has reached out to the organization for an official statement regarding the alleged Sanofi cyberattack. However, at the time of writing, no response or statement has been received from the pharmaceutical giant. Unverified Claims Persists Adding to the uncertainty, R00TK1T has not provided any concrete evidence or documentation to support its claims, leaving the allegations hanging in the balance. The situation is dynamic and continues to unfold, with The Cyber Express closely monitoring developments. It is crucial to highlight that the attack and the associated claims of human experiments are speculative at this point. The National Center for Biotechnology Information notes that clinical trials and experiments, as per French law, aim to acquire new biological or medical knowledge. However, the distinction between scientific research and medical care requires careful consideration and adherence to legal and scientific requirements. As this story develops, The Cyber Express remains committed to providing accurate and timely updates. The claims surrounding the cyberattack on Sanofi and the allegations of human experiments will be thoroughly investigated, and any official statements or responses from Sanofi will be reported promptly. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Operation Triangulat ...

 Business

At the 37th Chaos Communication Congress (37C3) held right now in Hamburg, our experts from the Kaspersky Global Research and Analysis Team (GReAT) Boris Larin, Leonid Bezvershenko and Grigoriy Kucherin gave a talk called Operation Triangulation: what you get when attack iPhones of researchers. They described the   show more ...  

chain of the attack in detail and talked about all of the vulnerabilities involved in it. Among other things, they for the first time presented exploitation details of the CVE-2023-38606 hardware vulnerability. We will not repeat all the nuts and bolts of this report — you can find technical details in a post on the Securelist blog or you can listen the recording of the talk on the conferences official website. Here we will briefly describe the main points. As we already have written in the beginning of this summer, the attack started with an invisible iMessage, which contained a malicious attachment that was processed without the users knowledge. This attack did not require any actions from the user at all. Our experts were able to detect the attack by monitoring a corporate Wi-Fi network using our own SIEM system Kaspersky Unified Monitoring and Analysis Platform (KUMA). The attack employed four zero-day vulnerabilities that affected all iOS devices up to version 16.2: CVE-2023-32434, CVE-2023-32435, CVE-2023-41990 and the aforementioned CVE-2023-38606. The obfuscated Triangulation exploit could work both on modern versions of the iPhone and on fairly old models. And if attacking newer iPhones it could bypass Pointer Authentication Code (PAC). The CVE-2023-32434 vulnerability used by this exploit, allowed attackers access to the entire physical memory of the device at the user level, both for reading and writing. Thanks to the exploitation of all four vulnerabilities, the malware could gain full control over the device and run any malware needed, but instead it launched the IMAgent process and used it to remove all traces of the attack from the device. It also launched the Safari process in the background and redirected it to the attackers web page with exploit for Safari. This Safari exploit got root rights and launched further stages of attacks (which we already talked about them in our previous publications). Vulnerability CVE-2023-38606 allowed bypassing of the built-in memory protection mechanism using undocumented and unused in the firmware processor registers. According to our experts, this hardware function probably was created for debugging or testing purposes, and then for some reason remained enabled. The only remaining mystery — how exactly did the attackers knew how to use this undocumented function and where did they find information about it at all.

image for Anonymous Sudan’s ...

 Firewall Daily

Pinterest has become the latest target of a disruptive Distributed Denial of Service (DDoS) attack, allegedly orchestrated by Anonymous Sudan. The front end of Pinterest’s website is experiencing significant issues due to the Pinterest cyberattack, which appears to be conducted in a cyclical and sophisticated   show more ...  

manner, likely utilizing an advanced form of the Skynet botnet. The Pinterest cyberattack closely resembles the pattern of their previous attack on ChatGPT about a month ago, putting the popular image-sharing platform in a challenging position. The team at Cyber Express attempted to access the Pinterest website on their systems and discovered that it was not functioning properly. TCE has contacted Pinterest for confirmation of the cyber incident and will update this report on receiving an official statement. Pinterest Cyberattack Explained In a Telegram post, shared on X (formerly Twitter) by a cybersecurity research organization, Anonymous Sudan seems to have carried out the alleged Pinterest cyberattack to draw the attention of the entire world toward Sudan’s current situation. The post reads, “The reason for the attack: To attract attention and draw focus to the tragic situation in Sudan.” Credit: CyberKnow on “X” The dysfunctional Pinterest website displayed a blank page and displayed a message, “upstream connect error or disconnect/reset before headers. reset reason: connection timeout” The Pinterest cyberattack could potentially be the cause behind this error message on the website. Cyberattacks, such as Distributed Denial of Service (DDoS) attacks or other malicious activities, can overload servers, disrupt network connections, or cause timeouts in communication between different components of a web application. A DDoS attack involves multiple machines (or bots) working together to overwhelm a target’s infrastructure with huge internet traffic. Attackers carry out DDoS attacks in an attempt to disrupt the target’s normal traffic and make it unavailable to its intended users. The Pinterest cyberattack seems to have paralyzed the UK and the US version of the website and other versions, especially in the Asian region seem to be functionally normal. About Anonymous Sudan Anonymous Sudan, a politically and religiously motivated hacktivist group, emerged in early 2023, engaging in distributed denial-of-service (DDoS) attacks primarily against Western countries. The group surfaced on a Russian-speaking Telegram channel in response to a Quran-burning incident in Sweden. Claiming to be Sudanese grassroots hacktivists targeting perceived “anti-Muslim activity,” Anonymous Sudan has attacked websites in Sweden, Denmark, and Israel. Notably, the group collaborated with pro-Russian hacker groups to launch joint attacks. Despite claiming ties to Sudan, researchers suggest potential connections to Russia based on language use and attack infrastructure. Anonymous Sudan‘s tactics, including public warnings and propaganda, align with DDoS attacks, necessitating organizations to adopt standard mitigation practices. The Aftermath In the aftermath of the Pinterest DDoS attack, the platform should initiate a comprehensive post-incident response to both mitigate the immediate impact and fortify its defenses against future attacks. Pinterest should also conduct a thorough analysis of the alleged DDoS attack, identifying the attack vectors, patterns, and vulnerabilities that were exploited. Collaborating with DDoS mitigation services and reassessing the effectiveness of existing partnerships is essential. The alleged Pinterest cyberattack should prompt a review of the company’s overall cybersecurity posture, such as advanced intrusion detection systems and updated firewall configurations. Regular drills and simulations of DDoS scenarios can also help ensure that the incident response plan is effective and that the team is well-prepared to handle similar situations in the future. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Trends, Reports, Analysis

SE Labs has warned that multi-factor authentication (MFA) is not foolproof and can be bypassed by attackers using old-school methods such as social engineering, malware, and phishing.

 Trends, Reports, Analysis

Companies need to shift their focus from solely addressing threats to proactively mitigating risks by analyzing behaviors and implementing insider risk management solutions.

 Trends, Reports, Analysis

DDoS attacks have significant consequences, including financial losses, compromised data, and erosion of customer trust. Global events like the Russia-Ukraine war and NATO bids have fueled recent DDoS attack growth.

 Breaches and Incidents

The Albanian parliament and a telecom company were targeted by cyberattacks originating from outside Albania. The attacks, which attempted to interfere with infrastructure and delete data, have not been attributed to a specific threat actor.

 Feed

Debian Linux Security Advisory 5590-1 - Several vulnerabilities were discovered in HAProxy, a fast and reliable load balancing reverse proxy, which can result in HTTP request smuggling or information disclosure.

 Feed

Debian Linux Security Advisory 5589-1 - Multiple vulnerabilities were discovered in Node.js, which could result in HTTP request smuggling, bypass of policy feature checks, denial of service or loading of incorrect ICU data.

 Feed

Prior work from this researcher disclosed how PowerShell executes unintended files or BASE64 code when processing specially crafted filenames. This research builds on their PSTrojanFile work, adding a PS command line single quote bypass and PS event logging failure. On Windows CL tab, completing a filename uses double   show more ...  

quotes that can be leveraged to trigger arbitrary code execution. However, if the filename got wrapped in single quotes it failed, that is until now.

 Dark Web News

Russian-speaking BlackCat/ALPHV ransomware group has claimed to have carried out a cyberattack on Ultra Intelligence and Communications, a US-based company specializing in intelligence and communication technologies. BlackCat or ALPHV ransomware group alleged the Ultra Intelligence and Communications cyberattack in a   show more ...  

dark web post, listing the company as its victim. The Cyber Express team has reached out to Ultra Intelligence and Communications to confirm the details of the alleged cyberattack but an official comment was not available at the time of writing this report. Despite the attack claims, the company’s website appeared functional and didn’t show any signs of the attack. Cyberattack on Ultra Intelligence and Communications The alleged cyberattack took place on December 27, 2023. After this, the website of Ultra Intelligence and Communications was listed on the dark web. The extent of the cyberattack on Ultra Intelligence and Communications and the specific ransom demands of the ALPHV group are currently under investigation. It is essential to note that Ultra Intelligence and Communications provides critical tactical capabilities, including cybersecurity and remote cryptographic management systems for mostly government agencies as its clients, including the DoD, FBI, DEA, NATO, and AT&T, among several others. Ultra I&C’s advanced command, control, and intelligence (C2I) capabilities help military organizations achieve better situational awareness, seamless communication, and streamlined decision-making. Prevention and Future Preparedness Companies like Ultra Intelligence and Communications can enhance their cybersecurity readiness by going through regular risk assessments, creating a culture of awareness among employees in training classes and implementing next-generation threat detection. Software and systems must be kept up-to-date, access controls need to be stricter, and information sharing within industries has to become more open. Different layers of security are provided by multi-factor authentication and frequent audits of user privileges. A more active approach than passive defense should be taken toward threat intelligence, to smartly handle new threats that emerge in the cyber environment. Testing incident response plans can help in the effective handling of cybersecurity threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Data Breach News

Cybercriminal group Anonymous Central has claimed to have carried out a cyberattack on The State Service for Maritime, Inland Waterway Transport and Shipping of Ukraine. The group has also claimed to have leaked the database of the Ukrainian government-owned service. The alleged Ukrainian Water Transport breach has   show more ...  

been posted by the threat actor named Anonymous Central on a Telegram channel and the dark web. The Cyber Express Team has reached out to the State Service for Maritime, Inland Waterway Transport, and Shipping to gather details regarding the alleged Ukrainian Water Transport breach, but an official response was not available at the time of writing this report. We also tried to load the website on our systems and found it functioning normally. Ukrainian Water Transport Breach The message posted by Anonymous Central reads, “Database of sea transport vessels: Cargo delivery. Look, do you still have sea routes? Well, it won’t last long! Website – https://marad.gov.ua/” The incident has been reported by a threat research organization on “X” (formerly Twitter) just a day after Christmas and a screenshot attached with the post reads “PS DB FRESH 2023! MERRY CHRISTMAS TO YOU GUYS! (Heart Emoji)”, which means that the alleged Ukrainian Water Transport breach has recently happened. No additional details of the alleged breach were available at the time of writing this report. About The State Service for Maritime, Inland Waterway Transport and Shipping of Ukraine Under the Ministry of Infrastructure, the State Service of Maritime and River Transport of Ukraine is an agency of the Ukrainian government whose responsibilities include carrying out government policies in the field of merchant shipping, inland waterway navigation, hydrographic support of navigation, and safety in sea and river transport. Its headquarters are in Kyiv. Possible Outcome The alleged data breach within the State Service of Maritime and River Transport of Ukraine, an agency under the Ministry of Infrastructure, can have serious consequences. The agency, based in Kyiv, holds sensitive information related to maritime and river transport, including personal data and confidential government information. Alleged Ukrainian Water Transport breach could compromise the safety of maritime and river transport by exposing critical navigation details and safety protocols. The potential leak of sensitive information, especially regarding defense or security measures, might have implications for national security. Moreover, as the State Service for Maritime, Inland Waterway Transport and Shipping of Ukraine is tasked with implementing government policies in merchant shipping and inland waterway navigation, a breach could disrupt policy implementation and lead to regulatory challenges. The alleged data breach could also lead to reputational damage, legal consequences, operational disruptions, and the necessity for increased cybersecurity measures. Addressing these risks requires a robust cybersecurity framework, regular audits, and a well-prepared incident response plan to safeguard sensitive data and maintain the effective functioning of the maritime and river transport sector. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Firewall Daily

A cyberattack has affected the networks and business activities of First American Financial Corporation and a number of its subsidiaries. The bank has also filed an update of the cyberattack on First American Financial Corporation to the Securities and Exchange Commission of the US. The bank’s filing can be   show more ...  

fetched from the website of SEC in which they have stated, “First American Financial Corporation (the “Company”) recently identified unauthorized activity on certain of its information technology systems. Upon detection of the unauthorized activity, the Company took steps in an effort to contain, assess, and remediate the incident.” Cyberattack on First American Financial Corporation On December 20, 2023, First American decided to take its systems offline. The company is currently trying to restore its systems and resume with normal business operations at the soonest. First American did not give an estimate of the duration or extent of the disruption, stated its filing to the SEC. The filing further explained that the company is working with leading experts and law enforcement and has also notified relevant regulatory authorities. Due to the disruption, First American’s primary website may also be inaccessible to some users. Leading financial company First American Financial Corporation was the target of a cyberattack on Wednesday, which forced the organization to temporarily shut down a number of its systems. The organization offers settlement services and title insurance to the mortgage and real estate sectors. It’s among the biggest title insurance providers in the country. The corporation confirmed the First American cyberattack last week and stated that it was trying to quickly get back to normal commercial operations. The business has been regularly providing updates about the First American cyberattack to keep stakeholders informed. The latest update about the cyberattack on First American Financial Corporation stated, “Despite the regrettable disruption to normal business operations, First American continues to close loans safely and securely.” The bank is still accepting payments and its partners too are safe after the incident. The update further read, “Our bank, First American Trust, continues to accept incoming wires, and all funds at First American Trust and our third-party partner banks remain secure.” Incidents Similar To the Cyberattack on First American The cyberattack on First American Financial Corporation is part of a pattern of financial industry security lapses. Significantly, First American Title Insurance Co., a subsidiary of First American Financial Corporation, reached a $1 million settlement with the New York State Department of Financial Services in November to resolve violations arising from a data leak that occurred in 2019. Similar events have happened at Mr. Cooper Group and Fidelity National Financial (FNF), among other financial institutions. The frequent cyberattacks on well-known financial institutions raise questions about how vulnerable the industry is to these kinds of attacks. Strong cybersecurity measures must be given top priority by the financial sector to protect sensitive data and keep investors’ and customers’ trust. In order to safeguard its assets and guarantee the stability of the world economy, the financial industry must adopt a proactive approach to cybersecurity as cyber threats continue to grow. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Firewall Daily

Albania’s Parliament faced a cybersecurity threat as it allegedly fell victim to a cyberattack. The intrusion temporarily disrupted parliamentary services as hackers attempted to breach the data system, raising concerns about the potential consequences of Albania Parliament cyberattack. In a statement released   show more ...  

on Tuesday, Albania’s Parliament assured the public that the cyberattack had not compromised the integrity of its data system. However, experts are diligently investigating the cyberattack on Albania’s parliament to assess the extent of the potential repercussions. The statement also confirmed that services would resume once the necessary security measures were in place. Decoding the Albania Parliament Cyberattack This recent incident follows reports of cyberattacks on a local cell phone provider and an air flight company on the same day. While these attacks were allegedly attributed to Iranian-based hackers known as Homeland Justice, independent verification remains elusive. In July 2023, Albania experienced a cyber assault, which was attributed to Iran and led to the shutdown of online public services and various government websites. The responsibility for this attack was also claimed by the Homeland Justice hackers. Research from Mandiant confirmed a lack of evidence of the attack to any specific threat actor, raising concerns about the threat actor and their origins. The cyberattack in July was perceived as retaliation for Albania providing shelter to members of the Iranian opposition group Mujahedeen-e-Khalq (MEK). The fallout from the attack prompted the Albanian government to sever diplomatic ties with Iran two months later. Cyberattack on Albania’s Parliament, Government, and More In response to accusations, the Iranian Foreign Ministry denied involvement in the cyberattack on Albanian government websites, emphasizing that Iran itself had been a target of cyberattacks from the MEK. Tensions escalated when Albanian authorities raided a camp for exiled MEK members in June, seizing computer devices allegedly linked to prohibited political activities. Albania has been hosting around 2,500 Iranian exiles since 2013, with strict conditions prohibiting any political activities that go against the country’s laws. In a move supported by the United States, NATO, and the European Union, the Albanian government took measures against the perceived threat posed by the MEK. MEK’s media spokesperson, Ali Safavi, refuted claims that the reported cyberattacks in Albania were connected to the presence or activities of MEK members. Safavi also criticized the notion that MEK members in Albania should refrain from engaging in political activities, asserting that they should enjoy all rights, including freedom of expression and assembly. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Firewall Daily

The Snatch ransomware group, following the claim of Tyson Foods cyberattack, has started to release personal information of the company’s senior executives. This leaked data includes names, personal and work email addresses, passwords, phone numbers, and residential addresses. The initial cyberattack on Tyson   show more ...  

Foods, a global leader in processing chicken, beef, and pork, took place in November. However, the disclosure of this sensitive data in December indicates that talks between the hackers and the American multinational may have failed. “We continue publishing private information about people that influence millions of people. Welcome Tyson Foods top management and their personal history,” read the post on the group’s Telegram channel. The details on this message include the names of Group President Noelle O’Mara, Chief Customer Officer Jason Nichol, Vice President Suzanne Finstad among others. The cybercriminals claim that they executed a preliminary Tyson Foods cyberattack in November 2023, as reported by TCE, successfully obtaining primary information from Tyson Foods. Furthermore, the group implies having engaged in negotiations with the company, alerting Tyson’s IT service to the possibility of expanding the attack to encompass main servers. This recent breach has stirred concerns surrounding Tyson Foods, a global powerhouse in the food industry boasting an impressive US$53 billion in revenue and a workforce of 142,000 employees. The full scope of the data breach remains elusive, with the perpetrators withholding details about the nature of the accessed data during the prior Tyson Foods cyberattack on the company. Silence from Officials on Tyson Foods Cyberattack Claim The Cyber Express Team, seeking verification of the Tyson Foods cyberattack claim, reached out to officials, but as of the time of reporting, no official response has been received. Interestingly, Tyson Foods’ official website continues to operate without disruption, prompting questions about the authenticity of the cyber threat. Whether the Tyson Foods cyberattack claim is a mere attention-seeking tactic or harbors a different motive remains unknown until an official statement is released by the company. As a major supplier for renowned fast-food chains including KFC, Taco Bell, McDonald’s, Burger King, and Wendy’s, Tyson Foods occupies a critical position in the meat industry. The potential impact of a claimed cyberattack on Tyson Foods and its operations could have far-reaching consequences. Tyson Foods Cyberattack, Not the First Incident This cyberattack on Tyson Foods also sheds light on the broader issue of cybersecurity vulnerabilities in major meat producers, echoing the recent ransomware attack on JBS, the world’s largest meat processing company. JBS faced a temporary halt in its US slaughtering plant operations after succumbing to a ransomware attack orchestrated by the now-defunct REvil group. Only after paying a hefty ransom of approximately US$11 million did JBS manage to bring an end to the cyber assault. In November 2022, Maple Leaf Foods, a major Canadian producer of packaged meat products, experienced a system outage due to a cybersecurity incident. The company promptly engaged cybersecurity and recovery experts, implementing business continuity plans to minimize operational and service disruptions. Looking Ahead The Tyson Foods cyberattack serves as a reminder of the evolving cyber threats faced by critical industries. It highlights the urgent need for enhanced cybersecurity measures and proactive response strategies to safeguard against potential disruptions and protect sensitive information. As the company grapples with the aftermath of the alleged cyber intrusion, stakeholders in the food industry are left vigilant and contemplating the broader implications of such attacks on global supply chains. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Feed

A new malware loader is being used by threat actors to deliver a wide range of information stealers such as Lumma Stealer (aka LummaC2), Vidar, RecordBreaker (aka Raccoon Stealer V2), and Rescoms. Cybersecurity firm ESET is tracking the trojan under the name Win/TrojanDownloader.Rugmi. "This malware is a loader with three types of components: a downloader that downloads an

 Feed

Google Cloud has addressed a medium-severity security flaw in its platform that could be abused by an attacker who already has access to a Kubernetes cluster to escalate their privileges. "An attacker who has compromised the Fluent Bit logging container could combine that access with high privileges required by Anthos Service Mesh (on clusters that have enabled it) to

 Feed

The Operation Triangulation spyware attacks targeting Apple iOS devices leveraged never-before-seen exploits that made it possible to even bypass pivotal hardware-based security protections erected by the company. Russian cybersecurity firm Kaspersky, which discovered the campaign at the beginning of 2023 after becoming one of the targets, described it as

 CISOs

Source: www.darkreading.com – Author: Rob Jenks Source: Olekcii Mach via Alamy Stock Photo In the current threat landscape, the relationship between cyber-insurance providers and potential (or even current) policyholders is often strained, at best. Organizations may perceive the lengthy and involved process,   show more ...  

paired with rising premiums, as insurance companies taking advantage of them. Insurance companies, […] La entrada Why CISOs Need to Make Cyber Insurers Their Partners – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer Source: Casimiro PT via Shutterstock Foreign interference actors, mostly operating out of Russia, Iran, and China, are ramping up efforts to influence US audiences ahead of 2024’s national elections. One prime example is Doppelganger,   show more ...  

a Russia-based influence operation that has established several inauthentic news sites and social […] La entrada How Cybercriminals Will Sway 2024 US Elections, Or Try To – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chain

Source: www.darkreading.com – Author: Jonathan Care, Contributing Writer Source: THANANIT SUNTIVIRIYANON via Alamy Stock Photo The past year has been a busy one for startups, with investors reevaluating their rules on what kind of companies to invest in and larger companies going shopping for innovative   show more ...  

technologies. However, focusing on individual acquisitions or startup launches makes […] La entrada AI, Supply Chain Are Fertile Areas for Cybersecurity Investment – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 attacks

Source: www.darkreading.com – Author: Microsoft Security Source: Aleksey Funtap via Alamy Stock Photo Threat groups are constantly getting more sophisticated in their attempts to evade detection and enact harm. One common tactic that many security practitioners have witnessed is carrying out distributed   show more ...  

denial-of-service (DDoS) attacks during peak business times, when companies are more likely to be […] La entrada How to Prepare for DDoS Attacks During Peak Business Times – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Critical

Source: thehackernews.com – Author: . Dec 27, 2023NewsroomZero-Day / Vulnerability A new zero-day security flaw has been discovered in the Apache OfBiz, an open-source Enterprise Resource Planning (ERP) system that could be exploited to bypass authentication protections. The vulnerability, tracked as   show more ...  

CVE-2023-51467, resides in the login functionality and is the result of an incomplete patch […] La entrada Critical Zero-Day in Apache OfBiz ERP System Exposes Businesses to Attack – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chinese

Source: thehackernews.com – Author: . Dec 27, 2023NewsroomZero-Day / Email Security Barracuda has revealed that Chinese threat actors exploited a new zero-day in its Email Security Gateway (ESG) appliances to deploy backdoors on a “limited number” of devices. Tracked as CVE-2023-7102, the   show more ...  

issue relates to a case of arbitrary code execution that resides within a […] La entrada Chinese Hackers Exploited New Zero-Day in Barracuda’s ESG Appliances – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team By Milica D. Djekic The role of this case study is to explain how it’s feasible to exploit some business assets using the IoT search engines and some hacking tools. As it’s known – the IoT crawlers give us back the IP addresses and some additional   show more ...  

information for a […] La entrada The Case Study: The Exploitation of Business Assets – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team By Saeed Valian, Chief Information Security Officer, symplr In the era of modernization, healthcare organizations are pushing for digitalization in their EMR’s. While there are significant benefits here, it does open the door for digital risks. The   show more ...  

world of cybersecurity is changing at a breakneck pace: cyber threats are […] La entrada Sophisticated Cyber Threats Require a New Approach to Digital Security in Healthcare. – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team By Jason Mafera, Field CTO, North America, IGEL The ‘endpoint’ has transformed from traditional desktop hardware to any number of devices, digital workspaces, and locations, offering new opportunities for cybercriminals who often seem one step ahead   show more ...  

of data protection and defense technologies. Cybercriminals are finding the increase in workloads […] La entrada Securing The Virtual Runway to The Cloud – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team www.cyberdefensemagazine.com is using a security service for protection against online attacks. This process is automatic. You will be redirected once the validation is complete. Reference ID IP Address Date and Time 3dc7dfbd7081283bcc5956880acf9126 68.   show more ...  

178.221.220 12/28/2023 07:46 AM UTC Protected by StackPath Original Post URL: https://www.cyberdefensemagazine.com/proven-strategies-to-fix-this-cybersecurity-shortage/ Category & Tags: Cyber Security […] La entrada Proven Strategies to Fix This Cybersecurity Shortage – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Maycie Belmore Welcome to the “Life in the Swimlane” blog series. Here we will feature interviews with Swimlaners to learn more about their experience. This series will give you a preview of Swimlane, our culture, and the people who keep us going. Hello! My name is   show more ...  

Kevin, I’m the Director of […] La entrada Life in the Swimlane with Kevin Mata, Director of Cloud Operations and Automation – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 AppSec

Source: securityboulevard.com – Author: Gal Ofri In part 2 of the series, we dived into the internals of the provenance document to understand its content and usage. In this part, we will explore the different SLSA levels for generating provenance and go through the different challenges you might face when   show more ...  

adopting SLSA provenance. Finally, we […] La entrada SLSA Provenance Blog Series, Part 3: The Challenges of Adopting SLSA Provenance – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman No one specifically Someone on our general security team A dedicated person/team that handles cloud security Cloud architects and developers Original Post URL: https://securityboulevard.   show more ...  

com/2023/12/usenix-security-23-hailun-ding-juan-zhai-yuhong-nan-shiqing-ma-airtag-towards-automated-attack-investigation-by-unsupervised-learning-with-log-texts/ Category & Tags: Network Security,Security Bloggers Network,Cybersecurity,cybersecurity education,Information Security,Infosecurity Education,Open Access Research,Security Architecture,Security Conferences,Security Research,USENIX,USENIX Security ’23 – Network Security,Security Bloggers Network,Cybersecurity,cybersecurity education,Information Security,Infosecurity Education,Open […] La entrada USENIX Security ’23 – Hailun Ding, Juan Zhai, Yuhong Nan, Shiqing Ma – ‘AIRTAG: Towards Automated Attack Investigation By Unsupervised Learning With Log Texts’ – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman No one specifically Someone on our general security team A dedicated person/team that handles cloud security Cloud architects and developers Original Post URL: https://securityboulevard.   show more ...  

com/2023/12/usenix-security-23-noe-zufferey-mathias-humbert-romain-tavenard-kevin-huguenin-watch-your-watch-inferring-personality-traits-from-wearable-activity-trackers/ Category & Tags: Network Security,Security Bloggers Network,Cybersecurity,cybersecurity education,Information Security,Infosecurity Education,Open Access Research,Security Architecture,Security Conferences,Security Research,USENIX,USENIX Security ’23 – Network Security,Security Bloggers Network,Cybersecurity,cybersecurity education,Information Security,Infosecurity Education,Open […] La entrada USENIX Security ’23 – Noé Zufferey, Mathias Humbert, Romain Tavenard, Kévin Huguenin ‘Watch Your Watch: Inferring Personality Traits From Wearable Activity Trackers’ – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: bacohido By Byron V. Acohido Russia’s asymmetrical cyber-attacks have been a well-documented, rising global concern for most of the 2000s. I recently visited with Mihoko Matsubara, Chief Cybersecurity Strategist at NTT to discuss why this worry has climbed steadily over   show more ...  

the past few years – and is likely to intensify in […] La entrada MY TAKE: Rising geopolitical tensions suggest a dire need for tighter cybersecurity in 2024 – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blog

Source: securityboulevard.com – Author: Votiro Team No matter which airport you travel through or how many times you travel through it, one element remains the same – the security check(s). Whether you’re asked to take off your shoes, put your laptop in a separate bin, or leave it all together and walk   show more ...  

through one of […] La entrada Data In-Flight: Applying Zero Trust to Airline Travel and Content Security – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime Cyber Israel Warns of a Wave of Phishing Attempts Mihir Bagwe (MihirBagwe) • December 27, 2023     View of the Gaza Strip from space (Image: Shutterstock) Cyberspace aggression against Israel   show more ...  

has intensified since the onset of war in the Gaza […] La entrada Cyberattack Tempo Ratchets Up in Israel – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Strengthening OT Security with HCLTech and Microsoft December 27, 2023     In an age reliant on operational technology, ensuring robust security for diverse industries is crucial. Join us as we discuss operational challenges, highlighting specific threats faced by   show more ...  

businesses today. From understanding the evolving threat landscape to implementing comprehensive […] La entrada OnDemand Panel | Securing Operational Excellence: Insights into Fortifying OT Security – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Governance & Risk Management , Next-Generation Technologies & Secure Development , Zero Trust Presented by LightBeam.AI     60 minutes     The Zero Trust Framework as we know it is primarily focused on the network with a “never trust, always verify”   show more ...  

approach. This makes complete sense, but have you […] La entrada LIVE Webinar | A Zero Trust Journey for Data Security and Enterprise AI Implementations – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Access

Source: www.govinfosecurity.com – Author: 1 Priyadarshi Prasad Co-Founder and Chief Product Officer, LightBeam.ai Priyadarshi (PD) Prasad is the co-founder and chief product officer at LightBeam.ai. An experienced tech industry professional with a passion for all things data including security, privacy and   show more ...  

protection, PD is always on the lookout for interesting ways organizations use and secure […] La entrada LIVE Webinar | From Access to Awareness: Unveiling the Zero Trust Data Landscape – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Governance & Risk Management , Government , Industry Specific Defense Department Proposes New Security Requirements for Defense Industrial Base Chris Riotta (@chrisriotta) • December 27, 2023     The U.S. Department of Defense released a draft rule for CMMC   show more ...  

on Dec. 26, 2023. (Image: Shutterstock) The U.S. Department of Defense […] La entrada New CMMC Rule Offers Tiered Security Levels for Contractors – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Artificial Intelligence & Machine Learning , Next-Generation Technologies & Secure Development NIST Fails to Provide Information on Award Process for AI Research, Lawmakers Say Chris Riotta (@chrisriotta) • December 27, 2023     U.S. House lawmakers   show more ...  

pressed the National Institute of Standards and Technology on how its AI institute will […] La entrada Lawmakers Push NIST for Transparency in AI Research Funding – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Eduard Kovacs The DragonForce ransomware group has taken credit for the Ohio Lottery hack, claiming to have stolen millions of data records. The post Ohio Lottery Hit by Ransomware, Hackers Claim Theft of Employee and Player Data appeared first on SecurityWeek. Original   show more ...  

Post URL: https://www.securityweek.com/ohio-lottery-hit-by-ransomware-hackers-claim-theft-of-employee-and-player-data/ Category & Tags: Ransomware,ransomware – Ransomware,ransomware La entrada Ohio Lottery Hit by Ransomware, Hackers Claim Theft of Employee and Player Data – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Ionut Arghire iOS zero-click attack targeting Kaspersky iPhones bypassed hardware-based security protections to take over devices. The post Mysterious Apple SoC Feature Exploited to Hack Kaspersky Employee iPhones appeared first on SecurityWeek. Original Post URL:   show more ...  

https://www.securityweek.com/mysterious-apple-soc-feature-leveraged-to-hack-kaspersky-employee-iphones/ Category & Tags: Mobile & Wireless,exploit,Featured,iOS,Operation Triangulation – Mobile & Wireless,exploit,Featured,iOS,Operation Triangulation La entrada Mysterious Apple SoC Feature Exploited to Hack Kaspersky Employee iPhones – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Barracuda

Source: www.securityweek.com – Author: Eduard Kovacs The new Barracuda ESG zero-day CVE-2023-7102 has been used by Chinese hackers to target organizations in the US and APJ region. The post Barracuda Zero-Day Used to Target Government, Tech Organizations in US, APJ appeared first on SecurityWeek. Original Post   show more ...  

URL: https://www.securityweek.com/barracuda-zero-day-used-to-target-government-tech-organizations-in-us-apj/ Category & Tags: Malware & Threats,Barracuda,China,Zero-Day – […] La entrada Barracuda Zero-Day Used to Target Government, Tech Organizations in US, APJ – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Eduard Kovacs A cyberattack appears to have caused significant disruption to the systems and operations of title insurer First American and its subsidiaries. The post Cyberattack Disrupts Operations of First American, Subsidiaries appeared first on SecurityWeek. Original   show more ...  

Post URL: https://www.securityweek.com/cyberattack-disrupts-operations-of-first-american-subsidiaries/ Category & Tags: Data Breaches,data breach – Data Breaches,data breach La entrada Cyberattack Disrupts Operations of First American, Subsidiaries – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Casino

Source: go.theregister.com – Author: Team Register Feature The same cybercrime crew broke into two high-profile Las Vegas casino networks over the summer, infected both with ransomware, and stole data belonging to tens of thousands of customers from the mega-resort chains. But despite the similar characters and   show more ...  

plots, these two stories have disparate endings — and […] La entrada A tale of 2 casino ransomware attacks: One paid out, one did not – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Kaspersky’s Global Research and Analysis Team (GReAT) has exposed a previously unknown ‘feature’ in Apple iPhones that allows attackers to bypass hardware-based memory protection. Addressed in CVE-2023-38606, which was patched in July 2023,   show more ...  

the issue affected iPhones running iOS versions up to 16.6, according to the cybersecurity outfit. Kaspersky […] La entrada Kaspersky reveals previously unknown hardware ‘feature’ used in iPhone attacks – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Chaz Lever Source: NicoElNino via Alamy Stock Photo COMMENTARY While distributed denial-of-service (DDoS) attacks and zero-day threats are nothing new in cybersecurity, they’re still happening regularly for a simple reason: They work. In early November 2023, OpenAI   show more ...  

blamed a DDoS attack for intermittent ChatGPT issues, and one of the largest known denial-of-service […] La entrada In Cybersecurity and Fashion, What’s Old Is New Again – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Elizabeth Montalbano, Contributing Writer Source: Marcos Alvarado via Alamy Stock Photo As innovation in artificial intelligence (AI) continues apace, 2024 will be a crucial time for organizations and governing bodies to establish security standards, protocols, and other   show more ...  

guardrails to prevent AI from getting ahead of them, security experts warn. Large language models […] La entrada Skynet Ahoy? What to Expect for Next-Gen AI Security Risks – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Arabia

Source: www.darkreading.com – Author: Cathy Simms, Contributing Writer Source: Maxim Ermolenko via Alamy Stock Photo The Kingdom of Saudi Arabia continues to advance its strategic commitment to cybersecurity, led by its National Cybersecurity Authority (NCA), the driver of many of the country’s cyber   show more ...  

protection initiatives. The NCA, formed in 2017, in the past year has […] La entrada Saudi Arabia Strengthens Its Cybersecurity Posture – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Ax Sharma A blockchain developer shares his ordeal over the holidays when he was approached on LinkedIn by a “recruiter” for a web development job. The recruiter in question asked the developer to download npm packages from a GitHub repository, and hours   show more ...  

later the developer discovered his MetaMask wallet had been emptied. Take-home […] La entrada Blockchain dev’s wallet emptied in “job interview” using npm package – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan The Ohio Lottery was forced to shut down some key systems after a cyberattack affected an undisclosed number of internal applications on Christmas Eve. While the incident is now under investigation, and the lottery is working to restore all impacted   show more ...  

services, its gaming system is still fully operational. “Mobile […] La entrada Ohio Lottery hit by cyberattack claimed by DragonForce ransomware – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas German hospital network Katholische Hospitalvereinigung Ostwestfalen (KHO) has confirmed that recent service disruptions at three hospitals were caused by a Lockbit ransomware attack. The attack occurred on Saturday in the early morning of December 24, 2023.   show more ...  

It severely impacted the systems that support the operations of three hospitals in […] La entrada Lockbit ransomware disrupts emergency care at German hospitals – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 APT

Source: socprime.com – Author: Veronika Telychko Throughout the second half of December 2023, cybersecurity researchers uncovered a series of phishing attacks against Ukrainian government agencies and Polish organizations attributed to the infamous russian nation-backed APT28 hacking collective. CERT-UA has   show more ...  

recently issued a heads-up covering the in-depth overview of the latest APT28 attacks, from the initial […] La entrada APT28 Adversary Activity Detection: New Phishing Attacks Targeting Ukrainian and Polish Organizations – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2023-12
Aggregator history
Thursday, December 28
FRI
SAT
SUN
MON
TUE
WED
THU
DecemberJanuaryFebruary