Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Orange Recovers from ...

 Firewall Daily

The Spanish unit of telecoms provider Orange, the telecommunications behemoth, encountered disruptions in its internet services due to cyberattack. Users from various networks reported connectivity issues, leading the company to address the concerns through its X account, the platform formerly known as Twitter. The   show more ...  

disturbance first came to light on a Wednesday afternoon, prompting Orange to respond promptly to rectify the situation. Orange Cyberattack: User Feedback and Swift Action Acknowledging the widespread incident, Orange reassured users that their vigilant feedback played a pivotal role in promptly detecting the Orange cyberattack. “We have identified a widespread incident affecting our nationwide service. Fortunately, it was swiftly identified (thanks largely to your comments and notices), and we are already actively working to resolve it,” responded the company to a user experiencing connection problems due to a cyberattack on Orange. Source: Twitter Orange assured users that the situation was on the mend. In a subsequent X account post, the company stated, “For those of you who informed us about difficulties accessing certain websites, the issue has already been resolved for some clients, and we anticipate a full recovery soon. Please update us here. We apologize for any inconvenience caused.” The company affirmed that the disruption resulted from a cyberattack, specifying that the Orange account in the IP network coordination center (RIPE) experienced unauthorized access. Importantly, they emphasized that customer data remained secure, and the impact was confined to the navigation of select services. Details of the cyberattack unfolded over subsequent hours. Screenshots of the Orange cyberattack were shared by an account created in January, claiming to have rectified the security of Orange’s RIPE administrator account. The hacker posted a message instructing Orange to send a message to receive new credentials. The screenshots depicted the unauthorized access that had the potential to disrupt the entire network. Source: Twitter Despite this, Orange managed to contain the impact, with RIPE only blocking specific DNS, sparing the entire Orange network and its services from a complete shutdown. The method through which Orange recovered the compromised credentials remains uncertain. Global Trend: Telecom Cybersecurity Challenges This incident comes on the heels of a recent cyberattack on Kyivstar, Ukraine’s largest telecommunications company, leading to widespread disruptions in phone and internet services. In November, Optus, Australia’s second-largest telecommunications provider, faced a severe communication crisis with a widespread outage. Initial speculations of a cyberattack were debunked, and Optus has officially disclosed the cause behind the outage, quelling lingering concerns. The increasing frequency and scale of such cyber incidents are prompting questions about the overall cybersecurity resilience of the global telecommunications industry. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Google-Owned Mandian ...

 Firewall Daily

The Twitter account of Mandiant, a prominent American cybersecurity firm and Google subsidiary, fell victim to a security breach earlier today. The Mandiant security breach resulted in an unknown scammer taking control of the account and utilizing it to orchestrate a cryptocurrency scam under the guise of the Phantom   show more ...  

crypto wallet. Company officials promptly responded to the incident, issuing a statement acknowledging the Mandiant security breach. They assured The Cybe Express team that they were actively working to resolve the issue, stating, “We are aware of the incident impacting the Mandiant X account and are working to resolve the issue. We’ve since regained control over the account and are currently working on restoring it.” However, the statement did not provide details regarding how the account was compromised. Initially, the hacked Mandiant account posed as belonging to Phantom, a company specializing in cryptocurrency wallets. The imposter account on Mandiant’s platform encouraged users to visit a suspicious website to check if their cryptocurrency wallet was eligible for a token award. Over several hours, Mandiant employees engaged in a cat-and-mouse game with the scammer, removing fraudulent posts only to have them reappear. Eventually, the scammer escalated the situation by changing the @mandiant username and reappearing under a new identity. The imposter account, now detached from Mandiant, continued promoting a fake website mimicking Phantom and enticing users with promises of free tokens. The imposter account also left a cryptic message urging Mandiant to “check bookmarks when you get account back” and advising them to “change password please.” As of the latest update, the Mandiant profile displayed the message “This account doesn’t exist.”   Mandiant Security Breach: Public Reaction and Speculation Mandiant, known for its expertise in cybersecurity and assisting clients in recovering from significant network compromises, raises concerns about the security measures employed for its X account. Questions linger regarding the strength of the account’s password and the presence of any two-factor authentication. Recent claims about a potential vulnerability in the social media site, reported through legitimate channels but allegedly not qualifying for the bug bounty program, add to the uncertainties surrounding Mandiant’s account security. Social media reactions poured in, with users expressing surprise and speculation about the circumstances. Some tweets suggested rebranding or account selling, highlighting the confusion caused by the Mandiant security breach. On the ninth anniversary of FireEye’s acquisition of Mandiant, one user noted the coincidence and speculated on the lackluster choice of promoting cryptocurrency scams by the hackers. In a somewhat humorous but critical tone, one user expressed disappointment in the hackers, stating, “Mandiant Twitter account gets hacked and all the hackers come up with is promoting freaking Crypto currency scams? Lame!! I expected better…” Another tweet also pointed out the perceived irony in Google’s acquisition of Mandiant, suggesting that a cybersecurity firm of such repute should have robust internal security practices. Efforts to reach out to Phantom for comment were reportedly unsuccessful, adding another layer of mystery to the unfolding situation. The Mandiant security breach raises broader concerns about the security of high-profile accounts and the potential risks associated with cyberattacks targeting companies with significant insights into global cybersecurity threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Cisco ASA Vulnerabil ...

 Firewall Daily

A threat actor named “xc7d2f4” is allegedly selling remote command injection vulnerability for Cisco ASA. The threat actor has claimed that this vulnerability exists on all 55XX series of the Cisco Adaptive Security Appliance (ASA). The Cyber Express has reached out to Cisco to confirm the details of the   show more ...  

alleged vulnerability exposure, but an official response was not available at the time of writing this report. A remote command injection is an attack method that involves the unauthorized execution of operating system commands. It happens when an application insecurely processes untrusted input to construct operating system commands, typically due to inadequate data sanitization and/or improper invocation of external programs. Adaptive Security Appliance (or ASA) combines firewall, antivirus, intrusion prevention, and VPN capabilities. It provides proactive threat defense that stops attacks before they spread through the network. Cisco ASA protects corporate networks and data centers of all sizes. It provides users with highly secure access to data and network resources. Some features of ASA include: Packet filtering: The process of filtering the incoming or outgoing (data) packets based on rules defined on the Access Control Lists (ACL) which has been applied to the device. Stateful inspection of traffic: A very sophisticated inspection of traffic passing through the ASA. Remote Command Injection Vulnerability Sale The threat actor is claiming to sell the RCI.rb (ruby) meterpreter module, a PDF manual about how to use it, a PDF document with detailed information about the remote command injection vulnerability, and RE snippets. Credit: Daily Dark Web on X RCI.rb (Ruby) Meterpreter Module: This is a module associated with the Metasploit framework, which is a penetration testing tool. The Ruby-based Meterpreter module is designed for post-exploitation activities. Meterpreter: a powerful post-exploitation tool in Metasploit for remote control and privilege escalation. Metasploit: an open-source penetration testing framework used for developing, testing, and executing exploit code to assess and improve the security of computer systems. PDF Manual: This manual could contain instructions, usage examples, and information on evasion techniques. PDF Document About the Vulnerability: The threat actor is offering a PDF document that provides detailed information about the vulnerability targeted by the RCI.rb Meterpreter module. It describes the nature of the remote command injection vulnerability, affected systems, and potential impact. RE Snippets: These are snippets of code or instructions related to the reverse engineering process. These snippets could aid others in understanding the inner workings of the vulnerability or the RCI.rb module. They might include specific code patterns, memory addresses, or other details that are valuable for those analyzing the software. The threat actor has demanded US$1,000,000 in a single installment for selling the remote command injection vulnerability data. Possible Impact of the Cisco ASA Vulnerability Exposure The sale of a remote command injection vulnerability related to Cisco ASA on the dark web poses significant and widespread risks. This CISCO vulnerability could allow malicious actors to execute arbitrary commands on the affected Cisco device from a remote location, leading to unauthorized access and potential takeover of critical infrastructure. The impact goes beyond mere device compromise; attackers could leverage the remote command injection vulnerability to disrupt network services, compromise data integrity, and even perform data exfiltration. This poses a serious threat to organizations dependent on the Cisco ASA, like financial losses, reputational damage, and legal consequences. Mitigating these risks requires applying security patches, updating systems regularly, and conducting thorough security audits. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Security Breach Alle ...

 Data Breach News

Peru-based financial organization Maquisistema has been allegedly impacted by a data breach. A threat actor going by the alias “God User” has claimed responsibility for the Maquisistema data leak. The Cyber Express has reached out to Maquisistema to confirm the details of the data leak, but an official   show more ...  

response was not available at the time of writing this report. Maquisistema Data Leak The Maquisistema data leak is reported to have occurred on January 3, 2024, at 10:45 pm on the Dark Web. The threat actor has allegedly managed to leak “2746 lines of data“ from Maquisistema. The type of data is unknown. Credit: chum1ng0 on X While the exact nature of the exposed information remains unclear, sensitive details may have been compromised, potentially putting the privacy and security of Maquisistema’s clients at risk. Maquisistema, known for its 31-year legacy in facilitating car and home ownership for over 30,000 individuals, currently boasts an active member base of 20,000 participants who trust and engage with the company’s Collective Fund System. The Maquisistema data leak raises concerns about the potential impact on the affected individuals. As data leaks often include personally identifiable information (PII) such as names, addresses, and financial details. In order to ascertain the exact amount and type of data exposed a thorough investigation will be required in collaboration with internal and external cybersecurity experts of Maquisistema. The company has not released an official statement addressing the alleged data leak. Clients and members of Maquisistema are still advised to remain vigilant and monitor their accounts for any suspicious activity. It is recommended that affected individuals take proactive measures, such as updating passwords and enabling two-factor authentication, to enhance cybersecurity. Financial institutions like Maquisistema rely on software for transactions, data storage, and communication which have vulnerabilities a lot of times. They become lucrative targets for cybercriminals seeking to exploit vulnerabilities for financial gain. The vast amounts of sensitive customer data and financial information held by entities like Maquisistema make them particularly susceptible to cyber threats. Safeguarding against cyber threats is not merely a matter of compliance; it is a fundamental necessity to preserve the integrity of financial systems, protect customer assets, and ensure the stability of the entire economic landscape. As the situation unfolds, The Cyber Express will keep updating further information regarding the Maquisistema data leak. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Kershaw County Schoo ...

 Firewall Daily

The Kershaw County School District, a prominent educational institution in the USA, has allegedly fallen victim to a cyberattack by the notorious Black Suit ransomware group. The cybercriminals claim to successfully infiltrated the school’s systems, leading to the unauthorized extraction and subsequent leak of a   show more ...  

staggering 17.5 GB of sensitive data. Magnitude of Cyberattack on Kershaw County School The Kershaw County School District, accommodating more than 10,500 students and boasting a staff of over 1,000 employees, has become the latest target in a string of cyberattacks plaguing the US education sector. The Cyber Express team reached out to school authorities for confirmation of the cyberattack. However, at the time of reporting, no official response has been received, casting uncertainty over the legitimacy of the cyberattack on Kershaw County School claims. Interestingly, the school’s official website remains operational and unaffected, raising questions about the credibility of the Kershaw County School cyberattack assertions. Source: HackManac This cyberattack on Kershaw County School marks a recurring trend in the education sector, particularly K-12 institutions, which have increasingly become prime targets for cybercriminals. Why Educational Institutions Are Targets A research report from the Center for Internet Security highlights the vulnerability of public schools in the US to such malicious activities. This revelation follows the closure of two US schools due to recent cyberattacks, further highlighting the severity of the situation. The Jackson County Intermediate School District (ISD) faced a disruptive ‘system outage,’ prompting the closure of several public schools reliant on its technology services. The outage impacted critical systems, including telephones, classroom technology, and heating facilities. As investigations into the incident continue, Superintendent Kevin Oxley declared a day’s leave for affected schools in Jackson and Hillsdale counties, aiming to facilitate the thorough detection and resolution of the issue. In a separate incident, Stanford University, a prestigious research institution, grappled with a cybersecurity breach in November 2023. The Akira ransomware group claimed responsibility for the attack, which targeted the university’s Department of Public Safety. Stanford University released a statement acknowledging the incident and emphasizing ongoing investigations to assess the extent of the impact. These relentless cyberattacks on educational institutions raise pressing questions about the motivations behind such targeted actions. As schools and universities increasingly find themselves in the crosshairs of cybercriminals, the implications of these attacks on the education sector’s infrastructure, data security, and overall functionality become subjects of urgent concern. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Hacker Threatens Col ...

 Firewall Daily

A threat actor has come forward claiming to have leaked a database and executed SQL injection for the H. Congress of the State of Colima in Mexico. The hacker, who remains unidentified, posted a message online stating, “In the file is a list of databases and all login: passwords to the site. Didn’t dump   show more ...  

the rest of the data because I have no use for it. But I’ll leave SQL injection for anyone who wants to dump data.” Congress of the State of Colima Data Breach The Cyber Express team took immediate action by reaching out to the official representatives of the H. Congress of the State of Colima to verify the hacker’s claim. However, as of the writing of this report, no response has been received. Source: Daily Dark Web Interestingly, upon accessing the official website, it was found to be fully functional, raising questions about the authenticity of the hacker’s claim of the cyberattack on H. Congress of the State of Colima in Mexico. This cyberattack on H. Congress of the State of Colima in Mexico follows a series of recent cyber threats targeting government entities globally. In December 2023, Albania’s Parliament faced a cybersecurity threat, temporarily disrupting parliamentary services. Despite assurances from the parliament that the cyberattack did not compromise the integrity of its data system, concerns about potential repercussions lingered. Similarly, in the same month, the StarsX Team hacker group claimed responsibility for an alleged cyberattack on Indian government websites. The group, purportedly affiliated with Indonesia, targeted specific government websites, including the Department of Justice, High Court of Punjab and Haryana, UP Police, Intellectual Property India, and the Employees’ State Insurance Corporation. However, upon closer inspection, all the mentioned websites were found to be functioning normally, showing no signs of the Distributed Denial of Service (DDoS) attack alleged by the threat actor. Implications of the H. Congress of the State of Colima Claim The implications of the recent claim regarding the H. Congress of the State of Colima’s database leak and SQL injection could be severe if proven true. Unauthorized access to sensitive information, such as login credentials, could lead to a breach of privacy, potential misuse of data, and even compromise the security of the legislative body. While the official response from the targeted institution is awaited, it highlights the growing concern over the vulnerability of government websites to cyber threats. Governments and organizations worldwide need to enhance their cybersecurity measures to safeguard sensitive data and ensure the uninterrupted functioning of critical services. As technology advances, so do the capabilities of malicious actors, emphasizing the importance of proactive cybersecurity strategies to counter emerging cyber threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for CourtListener Websit ...

 Cybersecurity News

The CourtListener website, a platform hosting crucial documents related to the infamous Jeffrey Epstein case, experienced a sudden crash due to an overwhelming surge in traffic. The site, operated by the non-profit Free Law Project, initially displayed 40 documents made public by Judge Loretta Preska in New York,   show more ...  

shedding light on the convoluted legal history of the disgraced financier and Epstein client list. Unprecedented Demand Leads to CourtListener Website Overload Visitors looking for Jeffrey Epstein’s list on the site were met with an error message stating, “This usually happens when we are doing maintenance or our server is overloaded.” The Free Law Project acknowledged the CourtListener website crash issue in a post on social media, stating, “We are getting utterly hammered by the Epstein docs and are working on a fix. In the meantime, the https://storage.courtlistener.com links work fine. Reply here with the storage links folks will want and hopefully, we can recover the site. Thank you and apologies!” Source: Twitter As news of the CourtListener website crash spread, Twitter erupted with speculations, with some users suggesting a “massive cyberattack.” However, others quickly dismissed this notion, pointing out that the crash was likely a result of the sheer number of people attempting to access the information simultaneously.   Source: Twitter One tweet read, “It’s not a cyber attack, it’s too many people trying to get the information all at once.” The documents hosted on CourtListener carried Jeffrey Epstein list that is associated with a lawsuit filed in 2015 by Virginia Giuffre against Ghislaine Maxwell, a close associate of Epstein. Giuffre, one of Epstein’s victims, alleged that she was subjected to abuse at various locations linked to Epstein. The unsealed records related to Jeffrey Epstein list, provide a glimpse into the controversial plea deal that allowed Epstein to serve a mere 13-month sentence in 2008 for charges related to a single victim, despite numerous allegations from other underage girls. Jeffrey Epstein’s Web of Connections: A Deep Dive Jeffrey Epstein, a wealthy and well-connected figure, faced initial legal troubles in 2005, and the unsealed documents on CourtListener shed light on Epstein client list which includes celebrities, politicians, and billionaires. The CourtListener website crash reflects the intense public interest in exposing the details of Epstein’s activities and the legal proceedings surrounding his case. While the CourtListener website struggled to handle the sudden influx of visitors, the documents remained accessible through the PACER system, which provides public access to federal court records. The unsealed records, dating from 2019 to 2022, include approximately 250 pages with redacted sections or complete seals. As the Free Law Project works tirelessly to resolve the CourtListener website crash, the public remains eager to delve into the revelations contained within these pivotal documents. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Companies to Watch

Airbus is expected to offer between €1.5 to 1.8 billion (~$1.64 to 1.97 billion) for Atos' Big Data & Security division, in line with its goal of growing its cybersecurity arm and enhancing its defense and security portfolio.

 Identity Theft, Fraud, Scams

The Twitter account of cybersecurity firm Mandiant, which is owned by Google, was hacked and used to promote a cryptocurrency scam. The attacker impersonated the Phantom crypto wallet and shared a fake website offering free tokens.

 Feed

sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database   show more ...  

management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.

 Feed

Ubuntu Security Notice 6566-1 - It was discovered that SQLite incorrectly handled certain protection mechanisms when using a CLI script with the --safe option, contrary to expectations. This issue only affected Ubuntu 22.04 LTS. It was discovered that SQLite incorrectly handled certain memory operations in the   show more ...  

sessions extension. A remote attacker could possibly use this issue to cause SQLite to crash, resulting in a denial of service.

 Feed

Ubuntu Security Notice 6565-1 - It was discovered that OpenSSH incorrectly handled supplemental groups when running helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand as a different user. An attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 20.04 LTS.   show more ...  

It was discovered that OpenSSH incorrectly added destination constraints when PKCS#11 token keys were added to ssh-agent, contrary to expectations. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 23.04.

 Feed

EuskalHack Security Congress seventh edition is a new proposal from the EuskalHack Computer Security Association, with the aim to promote the community growth and the culture in the digital security field. As usual, in this new edition proximity to our public and technical quality will be our hallmarks. With an   show more ...  

estimated capacity of 200 people, EuskalHack Security Congress has established itself as the most relevant congress specialized in computer security in the Basque Country, and as a national reference. The profile of attendees include specialized companies, public organisms, professionals, hobbyists and students in the area of security and Information Technology. The congress will take place on the 21st and 22nd of June 2024 in the lovely city of Donostia San Sebastian (Gipuzkoa).

 Feed

Red Hat Security Advisory 2024-0046-03 - An update for the squid:4 module is now available for Red Hat Enterprise Linux 8. Issues addressed include buffer over-read, denial of service, and null pointer vulnerabilities.

 Data Breach News

On Wednesday, the London Public Library stated that certain workers’ personal information was stolen by the hackers responsible for the incident. However, there is no proof that the personal information of library users was compromised in the cyberattack on London Public Library. The London Public Library has   show more ...  

issued an official release stating that it had informed the Information and Privacy Commissioner (IPC) about the cyberattack and the compromise of personal data. “Although the investigation is ongoing, it has thus far revealed that the personal information of some London Public Library employees has been accessed by the perpetrators of the attack. There is no indication that personal information belonging to Library patrons has been accessed,” reads the official release. Update of Cyberattack on London Public Library The announcement concerning Library services and systems, stated that the access to OverDrive/Libby ebook and audiobook platforms, along with other digital resources. Additionally, Library WiFi, telephone services, and email systems have all been restored. The London Public Library has set up a temporary website on which it will provide updates when services like Wi-Fi at branches and access to the ebook and audiobook platforms Overdrive and Libby are restored. Furthermore, they are actively working to reassure its patrons who have either paid fees or made online donations. It is important to note that the compromised information does not include any credit card details. This is because online library fee payments and donations are processed through external banking platforms, which have remained unaffected by the cyberattack. In a positive outlook, the library anticipates the resumption of public computer access in the near future. The institution also assures its community that efforts are underway to fully restore lending and catalog services, emphasizing its commitment to providing a seamless and secure experience for all library users. The official release read, “We are hopeful that public computer access will be available very soon and we are continuing to work at restoring the Library’s catalog and lending systems, including holds, returns, and check-ins of books and other physical items.” The Background On December 20, 2023, officials announced that the cyberattack on London Public Library that happened on December 13 was the cause of the branch closures and service interruptions. With the help of an external security company, they are working to mitigate the damage. Following the cyberattack on London Public Library, the officials decided to hire cybersecurity specialists to look into the security breach and restore its systems. The type of information that was hacked and the number of employees who were impacted in the cyberattack on the London Public Library were not disclosed then. Three smaller branches of the library were closed for over three weeks. In the immediate wake of the cyberattack on London Public Library, almost all of its systems and services were unavailable, including its digital resources, website, catalogue, Wi-Fi, email, phones, laptops, and printing capabilities. It was also unable to place holds on items. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Feed

American cybersecurity firm and Google Cloud subsidiary Mandiant had its X (formerly Twitter) account compromised for more than six hours by an unknown attacker to propagate a cryptocurrency scam. As of writing, the account has been restored on the social media platform. It's currently not clear how the account was breached. But the hacked Mandiant account was initially renamed to "@

 Feed

The threat actor known as UAC-0050 is leveraging phishing attacks to distribute Remcos RAT using new strategies to evade detection from security software. "The group's weapon of choice is Remcos RAT, a notorious malware for remote surveillance and control, which has been at the forefront of its espionage arsenal," Uptycs security researchers Karthick Kumar and Shilpesh Trivedi said in

 Feed

Section four of the "Executive Order on Improving the Nation’s Cybersecurity" introduced a lot of people in tech to the concept of a “Software Supply Chain” and securing it. If you make software and ever hope to sell it to one or more federal agencies, you have to pay attention to this. Even if you never plan to sell to a government, understanding your Software Supply Chain and

 Feed

Three new malicious packages have been discovered in the Python Package Index (PyPI) open-source repository with capabilities to deploy a cryptocurrency miner on affected Linux devices. The three harmful packages, named modularseven, driftme, and catme, attracted a total of 431 downloads over the past month before they were taken down. “These packages, upon initial use, deploy a CoinMiner

 0 - CISO2CISO Notepad Series Free

Apache Hardening for DevSecOps La entrada DevSecOpsChecklist Part 1 se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - CISO Strategics - Information S

La definición de la gravedad de un incidente es un aspecto crítico en la gestión de incidentes, ya que permite evaluar y categorizar la magnitud del impacto que un evento puede tener en una organización. En términos generales, la severidad de un incidente se determina considerando la combinación de su alcance,   show more ...  

la cantidad de recursos […] La entrada How do you define the severity of an incident? se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - Cybersecurity Architecture - De

Application development programs leverage Agile and DevOps software development methodologies to support the continuous integration and continuous delivery required for their business solutions. At the same time, systems continue to be a primary target for bad actors due to the sensitive nature of mission data.   show more ...  

DevSecOps accelerates delivery by automating the required security and privacy […] La entrada DevSecOps Best Practices Guide se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - CISO Strategics - Cybersecurity

The objective of the Joas Antonio Incident Management Policy is to describe the requirements for dealing with information security incidents. Audience or interested parties The Incident Management Policy applies to executive management and other individuals responsible for protecting Joas Antonio Company Information   show more ...  

Resources. La entrada INCIDENT RESPONSE PLAN se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - SOC - CSIRT Operations - Malwar

This whitepaper seeks to quantitatively demonstrate the importance of cyber hygiene – deployment of baseline cybersecurity controls and defensive countermeasures – for small businesses. The analysis is framed around ransomware, one of the most prominent cyber threats facing small businesses today. We take a   show more ...  

data-driven approach to building a ransomware “threat profile” specific to small […] La entrada Defensive Measures Against Ransomware se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - SOC - CSIRT Operations - Malwar

In 2023, ransomware attacks have surged, and threat actors are deploying ransomware quickly, often within one day of initial access. Common initial access vectors for ransomware attacks include publicfacing applications, stolen credentials, offthe-shelf malware, and external remote services. La entrada Defending Against Ransomware by Telesemana se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - CISO Strategics - Risk & Compli

Monitoring and controlling cybersecurity risks in the supply chain can be described as challenging at the very least. How does one do it? Products and services are brought into the Netherlands from all over the world, after all. Such an international network comes with opportunities as well as risks. The NCSC   show more ...  

recently opened a dialogue […] La entrada Dealing with risks in the supply chain – Good practices in Dutch organisations se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - Cybersecurity Architecture - De

Imagine you’re building ahouse. The developer environment is thefoundation, the DevOps platform is theframing, and the application environment is thefinishing touches. Common pipelineattack vectors Aspects ofSecuring DevOpsInfrastructure La entrada Cyphere Guidance on Securing Devops Environments se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan The Twitter account of American cybersecurity firm and Google subsidiary Mandiant was hijacked earlier today to impersonate the Phantom crypto wallet and share a cryptocurrency scam. “We are aware of the incident impacting the Mandiant X account and   show more ...  

are working to resolve the issue,” a Mandiant spokesperson told BleepingComputer. […] La entrada Mandiant’s account on X hacked to push cryptocurrency scam – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Lawrence Abrams Orange Spain suffered an internet outage today after a hacker breached the company’s RIPE account to misconfigure BGP routing and an RPKI configuration. The routing of traffic on the internet is handled by Border Gateway Protocol (BGP), which   show more ...  

allows organizations to associate their IP addresses with autonomous system (AS) […] La entrada Hacker hijacks Orange Spain RIPE account to cause BGP havoc – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.schneier.com – Author: Bruce Schneier A helpful summary of which US retail stores are using facial recognition, thinking about using it, or currently not planning on using it. (This, of course, can all change without notice.) Three years ago, I wrote that campaigns to ban facial recognition are too   show more ...  

narrow. The problem here is […] La entrada Facial Recognition Systems in the US – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 3rd Party Risk Management , Cybercrime , Fraud Management & Cybercrime HealthEC Hack Also Compromised More Than a Dozen US Healthcare Systems Marianne Kolbasuk McGee (HealthInfoSec) • January 3, 2024     Image: HealthEC A hacking incident at a New   show more ...  

Jersey-based vendor of artificial intelligence-enabled population health management services has […] La entrada Population Health Management Firm’s Breach Affects Millions – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Heriberto Cabrera Director of Technical Solutions Engineering, LATAM at Tanium Heriberto Cabrera works within Tanium as Director of Technical Solutions Engineering for Tanium in Latin America. Heriberto has 19 years of experience in IT, working with companies and   show more ...  

clients in the Commercial, Financial, Public, Health, Education and Manufacturing sectors in […] La entrada Live Webinar | Supercharge your CMDB and Realize Value Sooner with Tanium’s ServiceNow ITAM Integration (in Spanish) – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Artificial intelligence, machine learning and large language models are not new, but they are coming to fruition with the mass adoption of generative AI. For cybersecurity professionals, these are “exciting times we live in,” said Dan Grosu, chief   show more ...  

technology officer and chief information security officer at Information Security Media Group. […] La entrada Large Language Models: Moving Past the Early Stage – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Critical

Source: www.govinfosecurity.com – Author: 1 Leadership & Executive Communication , Training & Security Leadership , Video Zero Trust Expert Chase Cunningham on His Latest Book About Leadership Styles Anna Delaney (annamadeline) • January 3, 2024     Chase Cunningham, advisory board member,   show more ...  

Akeyless Chase Cunningham, aka the Doctor of Zero Trust, has written a new […] La entrada How NOT to Lead: Critical Errors in Cybersecurity Leadership – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Nate Smolenski Head of Cyber Intelligence Strategy, Netskope Nate Smolenski is an experienced CISO, Advisor, and technology leader with over two decades of experience across insurance, financial services, management consulting, and software industry verticals. Nate   show more ...  

currently serves as Head of Cyber Intelligence Strategy as a member of the CSO team […] La entrada Live Webinar | Dancing with Shadows: Vendor Risk Management in the Age of AI and Cyber Intrigue – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Actors

Source: www.govinfosecurity.com – Author: 1 Fraud Management & Cybercrime , Geo-Specific , Government Hackers Lock Up Recordings of Court Hearings to Extort Victoria’s Court System Jayant Chakravarti (@JayJay_Tech) • January 3, 2024     The Supreme Court of Victoria in Melbourne, Australia   show more ...  

(Image: Shutterstock) The court system of the Australian province of Victoria said it […] La entrada Ransomware Actors Steal Australian Courts’ Video Recordings – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Ambulance

Source: www.govinfosecurity.com – Author: 1 Cybercrime , Fraud Management & Cybercrime , Healthcare Archived Data Stolen 2 Months After Sale of Business Affects Patients, Employees Marianne Kolbasuk McGee (HealthInfoSec) • January 3, 2024     A data theft involving archived records of defunct firm   show more ...  

Fallon Ambulance has affected nearly 912,000 patients and employees. (Image: Fallon) […] La entrada Hack on Defunct Ambulance Firm Affects 912,000 People – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Application Security

Source: www.securityweek.com – Author: Ryan Naraine Late-stage player in the CNAPP space secures a $60 million extended Series E funding round at a valuation north of $1 billion. The post Aqua Security Scores $60M Series E Funding appeared first on SecurityWeek. Original Post URL: https://www.securityweek.   show more ...  

com/aqua-security-scores-60m-series-e-funding/ Category & Tags: Application Security,Funding/M&A,Aqua Security,CNAPP,container,Unicorn – Application Security,Funding/M&A,Aqua Security,CNAPP,container,Unicorn La entrada Aqua Security Scores $60M Series E Funding – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Application Security

Source: www.securityweek.com – Author: Ryan Naraine SentinelOne plans to acquire PingSafe in a cash-and-stock deal that adds cloud native application protection platform (CNAPP) technologies. The post SentinelOne Snaps up Seed-Stage CNAPP Startup PingSafe appeared first on SecurityWeek. Original Post URL:   show more ...  

https://www.securityweek.com/sentinelone-snaps-up-seed-stage-cnapp-startup-pingsafe/ Category & Tags: Application Security,Cloud Security,CNAPP,PingSafe,SentinelOne – Application Security,Cloud Security,CNAPP,PingSafe,SentinelOne La entrada SentinelOne Snaps up Seed-Stage CNAPP Startup PingSafe – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Insurance

Source: news.sophos.com – Author: Sally Adam PRODUCTS & SERVICES Comparing trends observed in 2023 and predictions for 2024 As we start the new year, this 15-minute fireside chat video provides insights into the latest developments in cybersecurity and cyber insurance from two respected industry leaders.   show more ...  

Raja Patel, Sophos Chief Product Officer, and Jack Vines, CEO […] La entrada Fireside Chat with Measured Insurance – Source: news.sophos.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Karen D. Schwartz, Contributing Writer Source: KaterynaOnyshchuk via Alamy Stock Photo Over the past few years, the job of protecting businesses from hacker and compliance-related security issues has become unwieldy, to say the least. While larger companies typically have   show more ...  

chief information security officers to handle these issues, smaller companies often don’t. […] La entrada Is the vCISO Model Right for Your Organization? – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Robert Lemos, Contributing Writer Source: Artemis Diana via Alamy Passkeys gained momentum in 2023. In addition to the major three technology firms supporting passkeys — Apple, Google and Microsoft — third-party password providers, such as 1Password and Bitwarden,   show more ...  

implemented their own support for managing the credentials. Dozens, and likely hundreds, of major […] La entrada Getting Started With Passkeys, One Service at a Time – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 agents

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer Source: 99Art via Shutterstock The Security Service of Ukraine (SSU) has asked owners and operators of webcams in the country to stop broadcasts from their devices over concerns about Russia’s intelligence services using the feeds to   show more ...  

conduct military reconnaissance against strategic targets. The SSU’s move follows a […] La entrada Russian Agents Hack Webcams to Guide Missile Attacks on Kyiv – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Accelerates

Source: www.darkreading.com – Author: PRESS RELEASE MILPITAS, Calif. — January 3, 2024 — SonicWall, a global cybersecurity leader, today announced the acquisition of Banyan Security, a leading provider of security service edge (SSE) solutions for the modern workforce. This acquisition strengthens   show more ...  

SonicWall’s portfolio by adding zero trust security relied on by leading fortune 100 companies to […] La entrada SonicWall Accelerates SASE Offerings; Acquires Proven Cloud Security Provider – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Dark Reading Staff Source: Michael Ventura via Alamy Stock Photo Xerox Business Solutions, a subsidiary of Xerox, experienced a “cyber security incident,” according to a press release from the company. The cyber incident’s scope was limited to XBS in the   show more ...  

US and has now been contained after initially being discovered by […] La entrada Ransomware Group Claims Cyber Breach of Xerox Subsidiary – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: PRESS RELEASE MOUNTAIN VIEW, CA – January 3, 2024 –  SentinelOne (NYSE: S), a global leader in AI-powered security, today announced that it has agreed to acquire PingSafe. The acquisition of PingSafe’s cloud native application protection platform (CNAPP), when   show more ...  

combined with SentinelOne’s cloud workload security and cloud data security capabilities, is expected to provide companies with […] La entrada SentinelOne to Expand Cloud Security Capabilities With Acquisition of PingSafe – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: PRESS RELEASE WAKARUSA, Ind., Jan. 3, 2024 /PRNewswire/ — iFlock Security Consulting, a leading boutique cybersecurity company specializing in penetration testing and ancillary services, today announced the successful completion of its first private funding round,   show more ...  

along with two strategic sales executive hires. These milestones mark a pivotal moment in the company’s growth trajectory, […] La entrada iFlock Security Consulting Secures Private Funding – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Tara Seals, Managing Editor, News, Dark Reading Source: Pixel-shot via Alamy Stock Photo Cybercriminals are taking over verified “Gold” accounts on X, the social media service formerly known as Twitter — and selling them on the Dark Web for up to $2,000 a pop.   show more ...  

That’s according to research from CloudSEK, which […] La entrada Cybercriminals Flood Dark Web With X (Twitter) Gold Accounts – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Australia

Source: www.bitdefender.com – Author: Graham Cluley Hackers are believed to have successfully accessed several weeks’ worth of sensitive video and audio recordings of court hearings, including one made at a children’s court where the identities of minors are supposed to be particularly critical to   show more ...  

protect. The ransomware attack happened on the computer systems of Victoria’s […] La entrada Courts service “PWNED” in Australia, as hackers steal sensitive recordings of hearings – Source: www.bitdefender.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 Two years after suffering a series of major beaches, LastPass has started implementing stricter password measures for its customers. These include the requirement for all customers to use a master password with at least 12 characters. This measure has been   show more ...  

LastPass’ default option since 2018. In April 2023 it was […] La entrada LastPass Enforces 12-Character Master Passwords – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blames

Source: www.infosecurity-magazine.com – Author: 1 Ukraine’s security service has attributed the cyber-attack on mobile operator Kyivstar to Russian hacking group Sandworm. Kyivstar is Ukraine’s largest mobile network carrier, the cyber-attack rendered internet access and mobile communications temporarily   show more ...  

unavailable for its customers in December 2023. Illya Vitiuk, head of the Security Service of Ukraine (SSU) Cyber […] La entrada Ukraine Blames Russian Sandworm Hackers for Kyivstar Attack – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 Written by Almost a quarter of people mentioned cybersecurity among their New Year’s digital resolutions for 2024, according to Kaspersky. In the latest edition of its New Year resolutions annual survey, the cybersecurity provider found that 13% of respondents   show more ...  

vowed to use stronger passwords in 2024. The resolution was critical […] La entrada Using Stronger Passwords Among Top 2024 Digital Resolutions – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breach

Source: www.infosecurity-magazine.com – Author: 1 A data breach at HealthEC LLC has impacted nearly 4.5 million people, with highly sensitive medical information accessed by cyber attackers. The New Jersey-based health tech company first reported that 112,005 individuals were affected by the breach in a   show more ...  

notification to the Office of the Maine Attorney General on December […] La entrada HealthEC Data Breach Impacts 4.5 Million Patients – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 clash

Source: www.infosecurity-magazine.com – Author: 1 Security experts have begun the year in combative mood after a leading security vendor called on the US government to ban ransomware payments. Noted for its work in ransomware decryption, Emsisoft revealed new analysis this week claiming that 2207 US hospitals,   show more ...  

schools and government entities were directly impacted by ransomware […] La entrada Experts Clash Over Ransomware Payment Ban – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 A Nigerian national is facing an eight-count indictment related to business email compromise (BEC) charges involving two US charities, after being arrested in Ghana. Olusegun Samson Adejorin has been charged with wire fraud, aggravated identity theft and   show more ...  

unauthorized access to a protected computer, after stealing $7.5m from a New York-based […] La entrada Nigerian Faces $7.5m BEC Charges After Charities Are Swindled – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas Hackers are increasingly targeting verified accounts on X (formerly Twitter) belonging to government and business profiles and marked with ‘gold’ and ‘grey’ checkmarks to promote cryptocurrency scams. A recent high-profile case is   show more ...  

the X account of cyber threat intelligence company Mandiant, a Google subsidiary, which was hijacked yesterday to […] La entrada Hackers hijack govt and business accounts on X for crypto scams – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas A threat actor announced on a cybercrime forum that they sold the source code and a cracked version of the Zeppelin ransomware builder for just $500. The post was spotted by threat intelligence company KELA and while the legitimacy of the offer has not   show more ...  

been validated, the screenshots from the seller indicate […] La entrada Zeppelin ransomware source code sold for $500 on hacking forum – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Artificial Intelligence

Source: www.bleepingcomputer.com – Author: Bill Toulas The U.S. Federal Trade Commission (FTC) has started accepting submissions for its Voice Cloning Challenge, a public competition with a $25,000 top prize for ideas that protect consumers from the danger of AI-enabled voice cloning for fraudulent activity.   show more ...  

The Challenge was announced in mid-November in an effort to find […] La entrada FTC offers $25,000 prize for detecting AI-enabled voice cloning – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-01
Aggregator history
Thursday, January 04
MON
TUE
WED
THU
FRI
SAT
SUN
JanuaryFebruaryMarch