Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Double Trouble for B ...

 Firewall Daily

Banco Promerica is currently facing a possible cybersecurity dilemma following recent revelations of a data breach and cyberattack. Initially highlighted in December by RansomHouse, the incident involving Banco Promerica was brought into the spotlight once more on January 11th when Snatch ransomware group also listed   show more ...  

the institution. The threat actor’s post on the Snatch ransomware platform contained messages, including an invitation for insurance companies to take notice. The message implied that those identifying their clients within the compromised data could reach out to the threat actor for a detailed report. This communication also hinted at a potential lapse in IT department judgment as a contributing factor to the security breach. Click here to follow our WhatsApp channel Banco Promerica Data Breach Decoded Source: Twitter According to MalwareHunterTeam on X, Banco Promerica had been added to the RansomHouse data leak site in December 2023. Concerns escalated when Robert Lluberes, a user on social media, posted tweets alerting Banco Promerica users in the Dominican Republic about reported disruptions in digital services since December 10th, 2023. Lluberes raised questions about the possibility of a cyberattack compromising the security of customer data. The uncertainty surrounding the situation prompted him to express concerns about the safety of personal and financial information. The Cyber Express has reached out to the organization for further insights into the alleged Banco Promerica cyberattack. Despite these attempts, no official statements or responses have been issued at the time of writing, leaving the claims regarding the Banco Promerica cyberattack unconfirmed. Two Ransomware Groups Claiming Data Breaches The two ransomware groups claiming the breach are the RansomHouse and Snatch ransomware groups. The RansomHouse ransomware, a distinctive cyber threat, diverges from typical ransomware operations. This ransomware group breaches networks, avoids encryption, and demands payment for stolen data, disavowing responsibility by blaming victims’ inadequate security.  The Snatch ransomware group, on the other hand, has been a popular ransomware collective since 2019, utilizing a distinct modus operandi involving data exfiltration and double extortion tactics. After demanding ransom directly, Snatch may threaten to publish victims’ data on its extortion blog if payment isn’t made. Linked to Russian origins, it evolved from Team Truniger, a former GandCrab affiliate. The potential impact of this Banco Promerica cyberattack incident on the financial institution and its customers remains uncertain. Banco Promerica’s clients are anxiously awaiting updates on the situation and assurance regarding the security of their data. The lack of an official response further intensifies concerns, emphasizing the need for swift action and transparency in addressing potential cybersecurity threats.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Lulzsec Hacktivists ...

 Firewall Daily

In response to the recent airstrikes in Yemen, the hacktivist group Lulzsec has publicly released purported logins for American banks. The swift disclosure of these logins prompts speculation about their origin, possibly indicating they were obtained from earlier data breaches. Amidst the ongoing airstrikes in Yemen   show more ...  

by the US, UK, and their allied forces, various hacktivist collectives are surfacing to express their opposition. Lulzsec, being the first to declare their intent, posted a cryptic message that reads, “Attacking now الهجوم حالياً على هذه الدول المعادية O6 11:16 AM.” This declaration hints at the cyber reprisals that could follow physical responses by Iran proxy groups in the Middle East. Click here to follow our WhatsApp channel Yemen Airstrikes Offend Lulzsec and Hacktivists Groups Source: Twitter The usual suspects in the hacktivist realm are anticipated to engage in low-capability DDoS attacks and defacement attempts. However, with potential involvement from more advanced actors like Iran-linked groups such as Cyberavengers and Cyber Toufan, the cybersecurity facet becomes increasingly complex. The situation in Yemen intensifies as explosions rock several cities, including the capital Sanaa, Hodeidah, Saada, and Dhamar, in response to the US and UK airstrikes against Houthi targets. The Jerusalem Post reports a presence of British and American warplanes in Yemeni airspace. At dawn on January 12, 2024, the United States and the United Kingdom, backed by Australia, Bahrain, Canada, Germany, South Korea, the Netherlands, and New Zealand, initiated a series of strikes against the Houthis in Yemen. This action followed the condemnation of attacks in a resolution by the United Nations Security Council the previous day. Decoding the Yemen Conflict The Houthi leader, Abdel-Malik al-Houthi, had previously warned of retaliation, vowing that any attack would not go without a response. The airstrikes were a direct response to a series of attacks on shipping vessels in the Red Sea region, threatening the freedom of navigation in one of the world’s most critical waterways. US President Joe Biden justified the strikes, stating that they were necessary to counter the Houthi threat to freedom of navigation, reported The Intercept. The collaborative effort involved the UK, Australia, Bahrain, Canada, and The Netherlands, sending a clear message that attacks on personnel or disruptions to navigation will not be tolerated. The air strikes occurred shortly after US Secretary of State Antony Blinken concluded a multi-nation trip through the Middle East, seeking support for increased action against the Houthis. The warnings issued by the US and UK against Houthi attacks on vessels passing through the Red Sea region have prompted various shipping lines to suspend operations, opting for longer routes around Africa. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for What is the principl ...

 Business

One of the most important concepts in information security is the principle of least privilege. In this post, we explore what it is, how it works, how adhering to this principle benefits businesses, and how to implement the principle of least privilege in practice. How the principle of least privilege works The   show more ...  

principle of least privilege (PoLP) is also known as the principle of minimal privilege (PoMP) or, less commonly, the principle of least authority (PoLA). The main idea is that access to resources in a system should be organized in such a way that any entity within the system has access only to those that the entity requires for its work, and no more. In practice, this could involve different systems and different entities within a system. Either way, in terms of applying the principle of least privilege to enterprise security, this can be restated as follows: Any user of the organizations information infrastructure should only have the right to access the data that is necessary for performing their work tasks. If, in order to perform certain tasks, a user requires access to information they currently dont have, their permissions can be elevated. This elevation can be permanent – if required by the users role, or temporary – if its only necessary for a specific project or task (in the latter case, this is called privilege bracketing). Conversely, when a user no longer requires access to certain information for some reason, their permissions should be lowered in accordance with the principle of least privilege. In particular, the principle implies that regular users should never be granted administrator or superuser rights. Not only are such privileges unnecessary for the duties of the average employee, but they also significantly increase risks. Why is the principle of least privilege needed? The principle of least privilege helps improve access management, and generally hardens the security of the companys information infrastructure. Here are some of the important security objectives that can be achieved by applying the principle of least privilege. Risk mitigation. By restricting access to the minimum necessary for users to perform their tasks, the likelihood of accidental or intentional misuse of privileges can be significantly reduced. This, in turn, helps lower the risks of successful perimeter penetration and unauthorized access to corporate resources. Data protection. Limiting access helps protect confidential data. Users only have access to the data required for their work, thereby reducing the likelihood of their gaining access to sensitive information or, worse, causing its leakage or theft. Minimizing the attack surface. Restricting user privileges makes it more difficult for attackers to exploit vulnerabilities and use malware and hacking tools that rely on the users privileges, thereby reducing the attack surface. Localizing security incidents. If an organizations network is breached, the principle of least privilege helps limit the scope of the incident and its consequences. Because any compromised accounts have minimal rights, potential damage is reduced, and lateral movement within the compromised system or network is impeded. Identifying users responsible for an incident. Minimizing privileges significantly narrows down the circle of users who could be responsible for an incident. This speeds up the identification of those accountable when investigating security incidents or unauthorized actions. Compliance with standards and regulations. Many regulatory requirements and standards emphasize the need for access control – particularly the principle of least privilege. Adhering to industry standards and best practices helps organizations avoid unpleasant consequences and sanctions. Increasing operational efficiency. Implementing the principle of least privilege reduces risks for the organizations information infrastructure. This includes reducing downtime associated with security incidents, thus improving the companys operational efficiency. How to implement the principle of least privilege in your organization Implementing the principle of least privilege in an organizations information infrastructure can be broken down into a few basic steps and tasks: Conduct an inventory of resources, and audit the access rights users currently have. Classify resources and create an access management model based on roles – each with specific rights. As a starting point, assign users roles with minimal rights, and elevate their privileges only if necessary for their tasks. Regularly conduct audits and review permissions – lowering privileges for users who no longer need access to certain resources for their tasks. Apply the principle of privilege bracketing: when a user needs access to a larger number of resources for a task, try to elevate their privileges temporarily – not permanently. And dont forget about other protective measures Of course, applying the principle of least privilege alone isnt enough to secure a companys information infrastructure. Other measures are also required: Regular security audits. Timely software updates. Employee training on the basics of cybersecurity. Deploying reliable protection on all corporate devices.

image for Hathway Hit by Massi ...

 Firewall Daily

A hacker operating under the alias ‘dawnofdevil’ has asserted responsibility for a massive data breach targeting Hathway, one of India’s largest Internet Service Providers (ISPs) and cable television operators. The hacker alleges to have leaked a massive database associated with Hathway, citing a   show more ...  

vulnerability in the Laravel framework application, the content management system (CMS) utilized by the company. According to the hacker’s message posted on the breach forum, the Hathway data leak, which reportedly occurred in December 2023, exposed sensitive information belonging to over 41.5 million customers. Hathway Data Leak Details The Hathway data leak includes names, email addresses, phone numbers, physical addresses, and other personally identifiable information. A staggering 200 GB+ of data has been dumped, comprising 789 CSV files, as claimed by the hacker in a message posted on a forum. Click here to follow our WhatsApp channel The hacker, addressing the BreachForums community, stated, “Hello BreachForums Community, today I have uploaded the Hathway.net Database for you to download, thanks for reading and enjoy!” To validate this claim, The Cyber Express team reached out to Hathway officials. However, as of the writing of this report, no official response has been received, leaving the claim unverified. If proven true, the implications of this breach are far-reaching. The leaked data includes comprehensive details such as full names, email addresses, phone numbers, home addresses, customer registration forms, copies of Aadhaar cards, and various other personal information, including Know Your Customer (KYC) data. Given Hathway’s role as a prominent internet provider in the country, the fallout from this Hathway cyberattack could extend beyond individual privacy concerns. India’s Vulnerability to Cyberattacks India has been a consistent target for cyberattacks, accounting for 13.7% of all global cyber incidents. This is not the first instance of an Indian organization facing such threats. In 2023, a hacker group known as “Team Insane PK” claimed to have successfully executed a cyberattack on Amazon India, though this claim remains unverified. One contributing factor to the increasing frequency of cyberattacks in India is the alarming cybersecurity skill gap. With nearly 30% of cybersecurity job vacancies in the country remaining unfilled due to a severe shortage of skilled professionals, organizations become vulnerable to such breaches. The cybersecurity skill gap is exacerbated by the misconception that only individuals with a technical background in IT security or engineering can pursue careers in the field. To address this, it is crucial to emphasize that the demand for cybersecurity professionals extends beyond those with traditional technical backgrounds. As The Cyber Express continues to investigate this ongoing situation, we will keep our readers informed of any developments in this major data breach affecting Hathway. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Global Nonprofit Wat ...

 Firewall Daily

Water For People, a prominent nonprofit, has become a target of the notorious Medusa ransomware group. This group, recognized for encrypting data and demanding ransoms, announced the cyberattack on Water For People by adding the organization to its victim list. Additionally, the hacker group has stipulated a deadline   show more ...  

of 9 days, 21 hours, 02 minutes, and 36 seconds for the organization to comply with their demands in the aftermath of the cyberattack. Click here to follow our WhatsApp channel Water For People, dedicated to promoting the development of high-quality drinking water and sanitation services, operates in nine countries, including Bolivia, Guatemala, Honduras, Peru, India, Malawi, Rwanda, Tanzania, and Uganda. Cyberattack on Water For People: Demands and Deadline The cybercriminals, in a post on a hacking forum, have laid out their demands: a ransom of US$10,000 within a day, US$300,000 to delete all the data, and an additional US$300,000 to download the data immediately. Source: DailyDarkWeb As of now, the motive behind the cyberattack remains unknown. The official website of Water For People, however, appears to be functioning without any disruption, casting doubt on the authenticity of the hacker group’s claim. To validate the seriousness of the situation, The Cyber Express Team attempted to reach out to the officials, but as of the writing of this report, no official response has been received, leaving the cyberattack on Water For People claim unverified. Modus Operandi of Medusa Ransomware Medusa ransomware, also known as MedusaLocker, surfaced in September 2019, primarily targeting Windows computers. Since its inception, the group has been responsible for attacks on various entities, including corporations, governmental bodies, and healthcare providers. The modus operandi involves encrypting the victim’s data, denying access, and demanding a ransom for its release. Failure to comply results in the threat of exposing sensitive personal information. This incident follows the infamous Medusa ransomware group’s recent breach of a Florida-based national specialty pharmacy chain, BioMatrix. The frequency and audacity of the attacks perpetrated by Medusa raise concerns about the vulnerabilities in cybersecurity measures across different sectors. If the cyberattack on Water For People proves to be true, the implications could be severe. Beyond the immediate financial repercussions of the ransom, the potential exposure of sensitive data could compromise the organization’s integrity and trustworthiness. Given the nonprofit’s commitment to providing essential services in multiple countries, the fallout could extend to operational disruptions, loss of donor confidence, and damage to the communities relying on Water For People’s support. In the face of growing cyber threats, organizations worldwide are urged to enhance their cybersecurity measures to safeguard sensitive information and prevent falling prey to ransomware attacks. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Hacktivist Groups Al ...

 Firewall Daily

Hacktivist groups have purportedly orchestrated a cyberattack on Indian Police and Government Institutions, commencing on January 10th, 2024, with data disclosure coming to light today. The identified threat actors include ‘THE ANONYMOUS BD,’ ‘GARUDA FROM CYBER,’ and ‘SYLHET GANG-SG.   show more ...  

’  The cyberattack on Indian government institutions includes DDoS assaults on the Indian Ministry of Power by ‘THE ANONYMOUS BD,’ ‘GARUDA FROM CYBER’ focusing on Jammu & Kashmir Police, and ‘SYLHET GANG-SG’ directing their efforts at the Mumbai Police website. Click here to follow our WhatsApp channel The disruptions were corroborated by Check Host link reports, documenting anomalies in network traffic. Alleged Cyberattack on Indian Police and Government Institutions Source: Twitter The Ministry of Power, Jammu & Kashmir Police, and Mumbai Police have borne the brunt of these cyberattacks. Notable websites affected include jkpolice.gov.in, uday.gov.in, and mumbaipolice.gov.in, resonating across the Indian subcontinent. The alleged data leaked from this cyberattack on Indian government institutions was later posted on the dark web.  Source: Twitter The threat actors left a digital imprint with posts such as “SYLHET GANG-SG Mumbai Police,” indicating their affiliation with hacktivist groups and providing links to the compromised websites. Similarly, ‘GARUDA FROM CYBER‘ announced the success of their attack on the Jammu & Kashmir Police website, accompanied by a list of associated hacktivist groups and collaborators. The Cyberattack Claims Require Verification While The Cyber Express reached out to the affected organizations for insights into the cyberattacks on Indian government institutions, as of now, no official statement or response has been forthcoming. This lack of verification highlights the complexity of assessing the veracity of claims surrounding the incident. Contrary to the severity of the reported cyberattacks on Indian police and other Indian government websites, the websites of the alleged victims currently appear operational, showing no overt signs of compromise or data breach. This suggests the possibility that the cyberattack on Indian police may have been brief or strategically targeted, potentially focusing on database infiltration rather than employing defacement or DDoS tactics. The lack of official confirmation and the seemingly unaffected state of victimized websites contribute to the ambiguity surrounding the incident. The Cyber Express is closely monitoring the situation and we’ll update this post once we have more information on this alleged cyberattack on Indian government institutions. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Potential Data Breac ...

 Firewall Daily

There are unconfirmed reports indicating a potential breach of the database at the Indian Railways Institute of Mechanical & Electrical Engineering (IRIMEE). Situated in Jamalpur, IRIMEE functions as the central training hub for the Indian Railways, primarily dedicated to educating officers and supervisors in the   show more ...  

Mechanical Engineering Department. Alleged IRIMEE Data Leak Details A threat actor asserts the release of 908,626 records, comprising names, email addresses, passwords, and birth dates, in a purported data leak from IRIMEE for the year 2023. Click here to follow our WhatsApp channel Source: DailyDarkWeb The Cyber Express Team, seeking to verify the IRIMEE data leak claim, reached out to officials, but no response has been received as of the writing of this report, leaving the claim unverified. Continuation of Cybersecurity Challenges in India This IRIMEE data breach is not an isolated one, as similar claims have been made on other Indian government organizations. In January, sensitive information of defense personnel was exposed in the SPARSH portal data leak, compromising usernames, passwords, URLs, and Pension Numbers. This raised serious concerns about the privacy and security of those who have served in the nation’s defense forces. In 2023, the Gernesia Team claimed responsibility for a DDoS attack against the Nuclear Power Corporation of India Limited. Another threat actor ‘dawnofdevil‘ asserted compromising the security of the Income Tax Department of India, though the claims are yet to be confirmed. The Phoenix hacker group, affiliated with the pro-Russia hacker group Killnet, claimed several cyberattacks on the Ministry of Health in India, including unauthorized access to sensitive data on hospitals, staff, and chief physicians. Furthermore, over the Christmas weekend in 2023, pro-Russian hacker group Anonymous Russia listed Indian companies as targets, signaling a shift in its focus from pro-Ukraine nations. Despite India’s neutral stance on the Russia-Ukraine issue, the country has become a target, possibly due to its strategic alliance with Russia, demonstrated by the “Act Far-East” policy, bilateral trade agreements, and visible signs of preference for Russia over the USA. The repeated targeting of Indian government organizations raises questions about the motives behind these cyberattacks. Is it purely political, or are there other underlying factors driving these security breaches? As investigations unfold, The Cyber Express will continue to keep its readers informed of any developments in this ongoing series of cyber threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Pro-India Groups Tar ...

 Firewall Daily

In the midst of escalating tensions and a growing political divide between India and Maldives, the cyber landscape has transformed into a battleground for warfare. In this surge of cyberattacks on the Maldivian agencies, pro-India cyber groups have unleashed targeted assaults on several Maldivian institutions. As   show more ...  

reported by a cybersecurity research agency on X, formerly known as Twitter, these pro-India cyber factions have initiated several cyberattacks on the Maldivian agencies. Among their primary targets are the Maldives National Defence Force, Maldives Bureau of Statistics, Maldives Business Times, Juvenile Court of Maldives, Maldives Immigration Department, and the Finance Department of Maldives. Click here to follow our WhatsApp channel Cyberattacks on the Maldivian Agencies Several cybercriminal groups are actively involved in the ongoing cyberattacks on the Maldivian agencies, intensifying the severity of the situation. Prominent entities contributing to the cyber onslaught comprise Team UCC, Network Nine, Black Dragon Sec, Team Blackdragonsec, Team NWH Security, Kerala Cyber Black Squad, Kerala Cyber Extractors, Team Anon One, Team ICP, Anonymous India, Unknown Cyber Cult, India Cyber Punk, Team NWH, All India Hackers. Additionally, Network Nine, Black Dragon Sec, Dark Cyber Warrior, Glory Sec, and Team Garuna are among the noteworthy groups escalating the cyber threats faced by the Maldives. The digital warfare intensifies as these groups strategically target key institutions, adding a complex layer to an already strained India-Maldives relationship. The cyberattacks on the Maldivian agencies agencies initially focused on the websites of the Juvenile Court, the Maldivian President’s Office, the Foreign Ministry, and the Tourism Ministry. The Warning The compromised Maldivian Juvenile Court website is responsible for handling criminal cases involving minors. It displayed a message expressing the hackers’ discontent and outlining the motivations behind this cyberattack. The message displayed on the website read, “We have hacked your site in response to the recent inflammatory and offensive statements made by certain members of your government. The illiterate and racist remarks from figures like Malsha, Muizzu, and Shiuna are not only shameful but also detrimental to the diplomatic relationship between our nations.” The statement also recalled the historical assistance and support Maldives received from India. It also stated that the disrespectful comments regarding Indian culture and the apparent forgetfulness about past aid and collaboration were disheartening. “Consider this a warning, the continuation of such hate speech and racism will not be tolerated. We are capable of taking actions that could severely impact your cyberspace. It is in your best interest to cease this provocation immediately and reflect on the potential consequences,” read the warning message. The message warned that the hackers aim to contribute to a constructive and peaceful resolution of differences between the two nations. Nevertheless, if this pattern of behavior continues, they will not hesitate to respond firmly. Escalating Tensions The ongoing cyber conflict between the two nations raises concerns regarding its potential impact on the cybersecurity of nations, emphasizing the increasing convergence of geopolitics and the digital realm. Former Maldives President Mohamed Nasheed denounced the disparaging remarks, urging the government to distance itself from such comments. Nasheed emphasized the significance of nurturing positive relations with international partners, reported Deccan Herald. While the cyber assault targeted Maldives government websites, speculation regarding its motives proliferated across online platforms. Given the ongoing diplomatic tensions, some users hypothesized that Chinese hackers may have orchestrated the attack to discredit India. However, it is imperative to note that such claims lack concrete evidence, adding a layer of complexity to the understanding of the cyber incident’s motivations. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Celcom, Malaysia’s ...

 Firewall Daily

A threat actor has claimed to be selling the source code of Celcom, Malaysia’s oldest mobile telecommunications provider, for US$4000. The ominous announcement of a cyberattack on Celcom sent ripples through the cybersecurity community, raising concerns about the potential impact on the company and its users. As   show more ...  

of now, no additional details regarding the cyberattack on Celcom have been disclosed by the threat actor. Click here to follow our WhatsApp channel Cyberattack on Celcom: In Detail The Cyber Express Team, in an effort to verify the authenticity of the Celcom cyberattack claim, reached out to officials. However, at the time of writing this news report, no response has been received from the company, leaving the situation shrouded in uncertainty. Source: DailyDarkWeb If the claim is proven true, the implications of cyberattack on Celcom could be significant. The sale of source code poses a serious threat to Celcom’s security infrastructure, potentially compromising sensitive information and exposing the company and its users to various risks. A Global Tread This revelation comes on the heels of a cyberattack on the Spanish unit of Orange, a telecommunications giant, which experienced disruptions in its internet services in the first week of January. The incident prompted Orange to address the concerns through its X account on Twitter, with users from various networks reporting connectivity issues. This incident also adds to the growing list of cyberattacks targeting telecommunications companies globally. Just recently, Kyivstar, Ukraine’s largest telecommunications company, fell victim to a cyberattack, resulting in widespread disruptions to phone and internet services. In November of the previous year, Optus, Australia’s second-largest telecommunications provider, faced a severe communication crisis due to a widespread outage. While initial speculations pointed to a cyberattack, the company later disclosed the actual cause behind the disruption, dispelling concerns. The recurring nature of such cyber incidents is raising pertinent questions about the overall cybersecurity resilience of the global telecommunications industry. Stakeholders are urging companies to enhance their cybersecurity measures to mitigate the growing threats and safeguard the integrity of their services. In a bid to gauge the severity of the situation, the global cybersecurity community is closely monitoring developments surrounding Celcom. The silence from Celcom officials adds to the growing uncertainty, leaving users and industry experts anxious about the potential fallout. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for FBI Warns More Elect ...

 Feed

FBI Director Christopher Wray says to have confidence in the American election system but to expect ongoing information warfare, pointing to China as most formidable threat actor.

 Innovation and Research

A team of computer scientists has developed a method called Baldur, which uses artificial intelligence to automatically generate proofs and verify the correctness of software, aiming to reduce software bugs and vulnerabilities.

 Breaches and Incidents

The leaked data, containing names, phone numbers, and addresses, appears to be accurate according to users listed in the file. Customers should be cautious of potential smishing attacks and the misuse of their information for fraudulent purposes.

 Govt., Critical Infrastructure

The regulation strengthens the role of CERT-EU as a hub for cybersecurity assistance and information exchange, with EU agencies obligated to share incident-related information with the body.

 Identity Theft, Fraud, Scams

Phishing scams in the UAE are on the rise, with fake websites posing as legitimate authorities and tourist sites. Scammers are using black hat SEO techniques to manipulate search engine rankings and promote fraudulent websites.

 Security Products & Services

Passkeys in Bitwarden are generated using the PRF WebAuthn extension, which derives a unique encryption key from the passkey and enhances security. The passkey feature is currently in beta and available in Chromium-based browsers.

 Identity Theft, Fraud, Scams

Researchers from Qualys have warned of a new wave of job scams on Facebook's Meta platform. Scammers are using Facebook ads to lure users with offers of remote work and then stealing their personal data and banking credentials.

 Malware and Vulnerabilities

The vulnerability (CVE-2023-7028) allows attackers to reset passwords through unverified email addresses, affecting all self-managed instances of GitLab Community Edition and Enterprise Edition.

 Malware and Vulnerabilities

The Medusa ransomware group has escalated its activities by introducing a dedicated leak site called the Medusa Blog, where they disclose sensitive data from non-compliant victims.

 Feed

Debian Linux Security Advisory 5601-1 - Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the SSH protocol is prone to a prefix truncation attack, known as the "Terrapin attack". This attack allows a MITM attacker to effect a limited break of the integrity of the early encrypted SSH transport   show more ...  

protocol by sending extra messages prior to the commencement of encryption, and deleting an equal number of consecutive messages immediately after encryption starts.

 Feed

Debian Linux Security Advisory 5600-1 - Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the SSH protocol is prone to a prefix truncation attack, known as the "Terrapin attack". This attack allows a MITM attacker to effect a limited break of the integrity of the early encrypted SSH transport   show more ...  

protocol by sending extra messages prior to the commencement of encryption, and deleting an equal number of consecutive messages immediately after encryption starts.

 Feed

Debian Linux Security Advisory 5599-1 - Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the SSH protocol is prone to a prefix truncation attack, known as the "Terrapin attack". This attack allows a MITM attacker to effect a limited break of the integrity of the early encrypted SSH transport   show more ...  

protocol by sending extra messages prior to the commencement of encryption, and deleting an equal number of consecutive messages immediately after encryption starts.

 Feed

On Intel macOS, HEVC video decoding is performed in the AppleGVA module. Using fuzzing, researchers identified multiple issues in this decoder. The issues range from out-of-bounds writes, out-of-bounds reads and, in one case, free() on an invalid address. All of the issues were reproduced on macOS Ventura 13.6 running on a 2018 Mac mini (Intel based).

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security vulnerability impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The issue, tracked as CVE-2023-29357 (CVSS score: 9.8), is a privilege escalation flaw that could be exploited by an attacker to gain

 Feed

Cybersecurity researchers have identified a new attack that exploits misconfigurations in Apache Hadoop and Flink to deploy cryptocurrency miners within targeted environments. "This attack is particularly intriguing due to the attacker's use of packers and rootkits to conceal the malware," Aqua security researchers Nitzan Yaakov and Assaf Morag said in an analysis published earlier

 Feed

As many as five different malware families were deployed by suspected nation-state actors as part of post-exploitation activities leveraging two zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances since early December 2023. "These families allow the threat actors to circumvent authentication and provide backdoor access to these devices," Mandiant said in an

 Feed

The threat actors associated with the Medusa ransomware have ramped up their activities following the debut of a dedicated data leak site on the dark web in February 2023 to publish sensitive data of victims who are unwilling to agree to their demands. “As part of their multi-extortion strategy, this group will provide victims with multiple options when their data is posted on their

 Feed

Picture a cybersecurity landscape where defenses are impenetrable, and threats are nothing more than mere disturbances deflected by a strong shield. Sadly, this image of fortitude remains a pipe dream despite its comforting nature. In the security world, preparedness is not just a luxury but a necessity. In this context, Mike Tyson's famous adage, "Everyone has a plan until they get punched in

 Feed

GitLab has released security updates to address two critical vulnerabilities, including one that could be exploited to take over accounts without requiring any user interaction. Tracked as CVE-2023-7028, the flaw has been awarded the maximum severity of 10.0 on the CVSS scoring system and could facilitate account takeover by sending password reset emails to an unverified email address. The

 0 - CT - Cybersecurity Tools - SIEM

El servicio se brinda con la asistencia de un equipo multidisciplinario, en el que se coordinan profesional de ámbitos técnicos y funcionales para cubrir en forma integral la diversidad y amplitud de aspectos alcanzados dentro de esta propuesta. El equipo está compuesto por especialistas en la revisión y gestión   show more ...  

de TI y seguridad de la […] La entrada se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 control

Source: www.darkreading.com – Author: Becky Bracken, Editor, Dark Reading 2 Min Read Source: Techa Tungateja via Alamy Stock Photo Upon review, Google’s cybersecurity operation at Mandiant has determined it temporarily lost control of its X account to cryptocurrency drainer malware operators on Jan. 3   show more ...  

because it didn’t have two-factor authentication set up. Effective March 20, […] La entrada Mandiant, SEC Lose Control of X Accounts Without 2FA – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: PRESS RELEASE TORONTO, Jan. 9, 2024 /PRNewswire/ – Info-Tech Research Group, a global leader in IT research and advisory, has announced that its flagship annual conference, Info-Tech LIVE, will be hosted this year at Bellagio in Las Vegas from September 17 to   show more ...  

19, 2024. This move marks the first time the event will be held at the […] La entrada The Future of IT: Info-Tech LIVE 2024 Conference Announced for September – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer Source: NicoElNino via Shutterstock China-backed cyber espionage group Volt Typhoon is systematically targeting legacy Cisco devices in a sophisticated and stealthy campaign to grow its attack infrastructure. In many instances, the threat   show more ...  

actor, known for targeting critical infrastructure, is exploiting a couple of vulnerabilities from 2019 in […] La entrada Volt Typhoon Ramps Up Malicious Activity Against Critical Infrastructure – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Nate Nelson, Contributing Writer Source: SOPA Images Limited via Alamy Stock Photo A new kind of app store for ChatGPT may expose users to malicious bots, and legitimate ones that siphon their data to insecure, external locales. ChatGPT’s fast rise in popularity,   show more ...  

combined with the open source accessibility of the early […] La entrada OpenAI’s New GPT Store May Carry Data Security Risks – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Tara Seals, Managing Editor, News, Dark Reading Source: hoch2wo via Alamy Stock Photo A “crimewave” of mass exploitation of Zyxel firewall devices has been washing over critical infrastructure in Europe — and Sandworm, the Russian state-sponsored advanced   show more ...  

persistent threat (APT) that specializes in such attacks, is behind only part of it. […] La entrada Move Over, APTs: Cybercriminals Now Target Critical Infrastructure Too – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Kristina Beek, Associate Editor, Dark Reading 1 Min Read Source: Alexander Tolstykh via Shutterstock Ivanti researchers this week flagged two zero-day vulnerabilities discovered in its products — CVE-2023-46805 and CVE-2024-21887— that are already being actively   show more ...  

exploited by threat actors. The vulnerabilities were found in Ivanti Connect Secure (ICS) and Ivanti Policy […] La entrada Ivanti Researchers Report Two Critical Zero-Day Vulnerabilities – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: John Leyden, Contributing Writer Source: dpa picture alliance via Alamy Stock Photo A recent spate of phishing scams — promoted through counterfeit websites — has prompted warnings from police and local businesses in the United Arab Emirates (UAE). The alerts flag fake   show more ...  

websites posing as Dubai’s Road and Transport Authority (RTA), […] La entrada UAE Faces Fresh Plague of Phishing Scams, Poisoned Searches – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Critical

Source: www.darkreading.com – Author: PRESS RELEASE PLANO, Texas, Jan. 11, 2024 /PRNewswire/ — Today, Critical Start, a leading provider of Managed Detection and Response (MDR) cybersecurity solutions and pioneer of Managed Cyber Risk Reduction (MCRR), announced general availability of Critical Start   show more ...  

Risk Assessments, which automatically aligns risk assessments to industry frameworks, such as the National Institute of Standards […] La entrada Critical Start Implements Cyber Risk Assessments With Peer Benchmarking and Prioritization Engine – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Elizabeth Montalbano, Contributing Writer Source: Prostock Studio via Alamy Stock Photo A fresh wave of job scams is spreading on Meta’s Facebook platform that aims to lure users with offers for remote-home positions and ultimately defraud them by stealing their   show more ...  

personal data and banking credentials. Researchers from Qualys are warning of […] La entrada Fake Recruiters Defraud Facebook Users via Remote-Work Offers – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 AI

Source: www.cybertalk.org – Author: slandau I’m Zahier Madhar, and I’m honored to work as a Lead Security Engineer and Check Point Evangelist. I’ve been part of the Check Point team since 2012, and my journey in the industry began in 2006. I’m dedicated to helping Dutch companies boost their cyber   show more ...  

security. Outside of work, I […] La entrada How small businesses can mitigate the dark side of digitization – Source: www.cybertalk.org se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - Cybersecurity Architecture - De

The concept of persistence in Linux systems is an intricate tapestry woven from the threads of system administration, security, and advanced operational techniques. It represents the methodologies and strategies employed to maintain continuous operational functionality, automate essential tasks, and in certain   show more ...  

contexts, secure or regain access to system resources. This introduction aims to shed light […] La entrada The art of Linux persistence se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - CISO Strategics - Information S

Businesses that don’t embrace emerging digital technologies are walking a path toward obsolescence. This book is a testimony to this fact. In the following pages, you will read about how new technologies such as brain sensors, generative AI, robotics, AR, and the metaverse are creating value in different   show more ...  

functions such as HR, supply chains, customer […] La entrada Insights You Need from Harvard Business Review se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - CISO Strategics - Information S

Cyber security threats seek to target an organisation’s most vulnerable points. As organisations focus on strengthening their own cyber security, their exposure to cyber threats in the supply chain is increasingly becoming the weakest point in their defences. Recent history has demonstrated many instances in which   show more ...  

organisations were attacked through less-secure points in their supply […] La entrada SUPPLY CHAINCYBER SECURITY. se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.schneier.com – Author: Bruce Schneier HomeBlog Comments Clive Robinson • January 11, 2024 8:58 AM @ ALL, Like the slow drip drip of the Chinese water tourture robs you of your sanity. The slow dip dip of the unlawful privacy intrusion by guard labour robs US citizens of their society. As an   show more ...  

external observer […] La entrada Pharmacies Giving Patient Records to Police without Warrants – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - Cybersecurity Architecture - De

A smart contract is an automated transaction protocol that executes the terms of a contract. They are one of the most exciting areas of blockchain technology implementation. The audit of a Smart Contract is technically the same as auditing a regular code. It entails meticulously investigating code to find security   show more ...  

flaws and vulnerabilities before publicly […] La entrada SMART CONTRACT SECURITY AUDIT se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - Cybersecurity Architecture - IA

Real human data to generate and predict real innovation success We are all uniquely human. As consumers, our decisions are complex, emotional, contextual, and often irrational. Although artificial intelligence (AI) makes new product development faster and easier than ever before, off-the-shelf generic models can   show more ...  

distort or misrepresent consumers’ realities. In this paper, we discuss the […] La entrada HUMANIZING AI se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - CISO Strategics - Cybersecurity

To defend against threat actors and their tactics, techniques, and procedures organizations need to detect, investigate, prevent, mitigate, and remediate threats in cyber relevant time. To do this, organizations need to identify, create, document, and test the orchestration steps needed to achieve these outcomes.   show more ...  

These steps, when grouped together, form a cyber security playbook that […] La entrada Security Playbooks Version 2.0 se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Application security posture management

Source: securityboulevard.com – Author: Julie Peterson The typical global enterprise has over 12,000 web-based applications, including APIs, SaaS applications, servers, and databases. While these applications play a vital role in driving efficiency, productivity, innovation, and overall business success, they   show more ...  

also represent an incredible security risk. In fact, research shows 70% of web applications have severe […] La entrada Application Security Testing (AST) Explained – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Dilan Krishnamurthy Countless data breaches are exposed daily, and finding the vulnerabilities that are leading to these breaches is extremely important. Businesses have been reliant on open-source components to accelerate their application development, but this   show more ...  

convenience does come with a price: the high risk of vulnerabilities associated with said components. This […] La entrada Prioritize Risk and Eliminate SCA Alert Fatigue with SCA 2.0 – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.techrepublic.com – Author: Luis Millares NordVPN: Best for all-around security Mullvad VPN: Best for overall privacy ExpressVPN: Best for security audits ProtonVPN: Best against government surveillance Surfshark: Best for those on a budget CyberGhost VPN: Best for large server and location network   show more ...  

When a VPN provider claims to have a “no-logs policy,” it means […] La entrada 6 Best Anonymous (No-Log) VPNs for 2024 – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Food delivery company HelloFresh is nursing a £140,000 ($178k) fine by Britain’s data privacy watchdog after a probe found it had dispatched upwards of a staggering 79 million spam email and one million texts in just seven months. The meal-kit company   show more ...  

provides weekly packages of premeasured ingredients with recipes […] La entrada Data regulator fines HelloFresh £140k for sending 80M+ spams – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register On Call Welcome once more, dear reader, to On Call, The Register‘s weekly reader-contributed column detailing the delights and dangers of working in tech support. This week, meet a reader we’ll Regomize as “Alvin” who regaled us with the   show more ...  

tale of the time one of his clients told him […] La entrada While we fire the boss, can you lock him out of the network? – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register CES Despite all the buzz around internet-connected smart cars at this year’s CES in Las Vegas, most folks don’t want vehicle manufacturers sharing their personal data with third parties – and even say they’d consider buying an older or   show more ...  

dumber car to protect their privacy and security. According to […] La entrada Drivers: We’ll take that plain dumb car over a flashy data-spilling internet one, thanks – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 cough

Source: go.theregister.com – Author: Team Register eBay will pay $3 million to settle criminal charges that its security team stalked and harassed a Massachusetts couple in retaliation for their website’s critical coverage of the online tat bazaar. Under a deferred prosecution agreement [PDF], eBay admits   show more ...  

responsibility for the actions of six of its former employees, […] La entrada eBay to cough up $3M after cyber-stalking couple who dared criticize the souk – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 brute-forced

Source: go.theregister.com – Author: Team Register Google-owned security house Mandiant’s investigation into how its X account was taken over to push cryptocurrency scams concludes the “likely” cause was a successful brute-force password attack. The natural reaction to this would be to ask why   show more ...  

two/multi-factor authentication didn’t prevent this from taking place. Well, Mandiant’s carefully worded […] La entrada Mandiant’s brute-forced X account exposes perils of skimping on 2FA – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Security experts believe Chinese nation-state attackers are actively exploiting two zero-day vulnerabilities in security products made by Ivanti. If you’re an admin or a user of the two products affected, VPN service Ivanti Connect Secure (ICS) and   show more ...  

network access control toolkit Policy Secure, you should immediately apply the current […] La entrada Infoseccers think attackers backed by China are behind Ivanti zero-day exploits – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 cryptominers

Source: thehackernews.com – Author: . Jan 12, 2024NewsroomCryptocurrency / Malware Cybersecurity researchers have identified a new attack that exploits misconfigurations in Apache Hadoop and Flink to deploy cryptocurrency miners within targeted environments. “This attack is particularly intriguing   show more ...  

due to the attacker’s use of packers and rootkits to conceal the malware,” Aqua security researchers Nitzan Yaakov […] La entrada Cryptominers Targeting Misconfigured Apache Hadoop and Flink with Rootkit in New Attacks – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Active

Source: thehackernews.com – Author: . Jan 12, 2024NewsroomCyber Attack / Vulnerability The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security vulnerability impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of   show more ...  

active exploitation. The issue, tracked as CVE-2023-29357 (CVSS score: 9.8), is a privilege escalation flaw that […] La entrada Act Now: CISA Flags Active Exploitation of Microsoft SharePoint Vulnerability – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Healthcare , Industry Specific , Legislation & Litigation ReproSource Also Agrees to Beef Up Security in Wake of 2021 Ransomware Attack Marianne Kolbasuk McGee (HealthInfoSec) • January 12, 2024     Image: ReproSource A fertility testing laboratory has agreed   show more ...  

to improve its data security practices and pay up to $1.25 […] La entrada Fertility Test Lab Will Pay $1.25M to Settle Breach Lawsuit – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Critical Infrastructure Security DHS Office of Inspector General Finds Lack of Coordination With EPA David Perera (@daveperera) • January 12, 2024     A U.S. federal watchdog urged the Cybersecurity and Infrastructure Security Agency to coordinate more on water   show more ...  

system cybersecurity. (Image: Shutterstock) A U.S. federal watchdog said government agencies […] La entrada US CISA Must Improve Water Sector Assistance, Says Watchdog – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Fraud Management & Cybercrime , Ransomware Crypto-Malware Trackers Report a Surge in Known Ransomware Victims at End of 2023 Mathew J. Schwartz (euroinfosec) • January 12, 2024     Ransomware attackers are on a roll, but Tortilla hackers fell flat. (Image:   show more ...  

Shutterstock) Ransomware-wielding attackers show no signs of stopping, and […] La entrada Ransomware Trends: Medusa and Akira Rage; Tortilla Disrupted – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 API Security , Video Also: Why We Should Care About the New York Times’ Copyright Lawsuit Against OpenAI Anna Delaney (annamadeline) • January 12, 2024     Clockwise, from top left: Anna Delaney, Mathew Schwartz and Rashmi Ramesh In the latest weekly update,   show more ...  

Information Security Media Group editors discussed how […] La entrada ISMG Editors: Will We Ever Get a Handle on API Security? – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Critical

Source: www.infosecurity-magazine.com – Author: 1 The US Cybersecurity and Infrastructure Security Agency (CISA) has urged critical infrastructure organizations to address vulnerabilities affecting nine industrial control systems (ICS) products. The report, dated January 11, 2024, highlighted a series of high   show more ...  

and critical severity vulnerabilities in products widely used in sectors like energy, manufacturing and transportation. Users […] La entrada CISA Urges Critical Infrastructure to Patch Urgent ICS Vulnerabilities – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 Cybercriminal are exploiting employee desires for job satisfaction and orgnaizations’ promise of benefits with a flurry of phishing scams. Pay raises, promotions, holiday bonuses and other ‘life-impacting’ updates are attractive phishing lures, email   show more ...  

security provider Cofense warned in a January 10 blog post. A typical approach is to embed links […] La entrada Waiting for Your Pay Raise? Cofense Warns Against HR-Related Scams – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-01
Aggregator history
Friday, January 12
MON
TUE
WED
THU
FRI
SAT
SUN
JanuaryFebruaryMarch