Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Subway Data Breach: ...

 Firewall Daily

The renowned American multinational fast-food chain, Subway, finds itself in an alleged cyber catastrophe. The LockBit ransomware gang has asserted responsibility for the Subway data breach, targeting the internal database, and leading to the compromise of sensitive information, including employee salaries, franchise   show more ...  

royalty payments, master franchise commission payments, restaurant turnovers, and more. The Subway data breach announcement from the threat actor was made public through a post on its Tor data leak site, setting a deadline for action: “Deadline: 02 Feb 2024 21:44:16 UTC.” The message implies a significant security lapse on Subway’s part, accusing the sandwich giant of downplaying the severity of the situation.  Alleged Subway Data Breach Opens on Dark Web The threat actor claims to have exfiltrated data totaling hundreds of gigabytes, adding an ultimatum—either Subway takes steps to protect the compromised data promptly, or the stolen information may be put up for sale to competitors. Source: Twitter “The biggest sandwich chain is pretending that nothing happened. We exfiltrated their SUBS internal system, which includes hundreds of gigabytes of data and all financial aspects of the franchise. We are giving some time for them to come and protect this data; if not, we are open to selling it to competitors,” reads the message published on the Tor leak site. As the cybersecurity clock ticks, Subway is yet to release an official statement addressing the alleged breach. The Cyber Express reached out to the fast-food giant for verification, but as of now, no response has been received. The uncertainty surrounding the Subway cyberattack remains, with the company’s website appearing operational and showing no immediate signs of the reported breach. Cyberattack on Fast Food Chains: Similar Instances in the Past This Subway cyberattack incident bears similarities to a recent attack on Yum! Brands, the parent company of KFC, Pizza Hut, Taco Bell, and The Habit Burger Grill, where nearly 300 restaurants in the UK were impacted by a ransomware attack. In that case, Yum! Brands swiftly responded by shutting down affected restaurants for a day, reassuring customers that personal information had not been compromised. While the extent of the Subway breach and the demanded ransom remain undisclosed, The Cyber Express is closely monitoring the situation. We’ll update this post once we have more information on the Subway cyberattack or any official confirmation from the organization.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for LockBit Ransomware G ...

 Firewall Daily

In a recent update on the notorious LockBit ransomware group’s dark web portal, the threat actor proudly announced the addition of three new victims to their list of compromised entities. The victims identified in this latest LockBit ransomware attack are TV Jahn Rheine in Germany, Home Waremmien in Belgium, and   show more ...  

Marxan S.L. Source: Twitter The announcement on the dark web portal includes specific details about the targeted organizations. For TV Jahn Rheine, a company operating in the health, wellness, and fitness industry, the threat actor claims to have stolen a substantial amount of sensitive data, including accounting information, email conversations, and human resources records. The deadline for compliance with their demands is set for January 25, 2024, at 01:37:21 UTC. LockBit Ransomware Attack: New Victims Added in the Last 24 Hours Source: Twitter Similarly, the cybercriminals posted details about the Home Waremmien attack, a public housing company in Belgium, stating that they had uploaded confidential data such as housing records and organizational information. The deadline for compliance with their demands for this victim is also January 25, 2024, at 01:47:56 UTC. Source: Twitter In the case of Marxan S.L., a company involved in the operation of car parks, the threat actor provided limited information, leaving the extent of the breach unclear. The deadline for compliance with their demands for Marxan S.L. is January 25, 2024, at 01:43:18 UTC. The Cyber Express has attempted to verify these claims by reaching out to the affected organizations. As of now, there has been no official statement or response from the victims, leaving the LockBit ransomware cyberattack claims unverified. The Rise of LockBit Ransomware Cyberattack Spree Surprisingly, the websites of the alleged victims appear to be operational, showing no immediate signs of a LockBit ransomware attack. It is speculated that the threat actor might have targeted the databases of the companies rather than compromising the front end of their websites. This tactic aligns with previous attacks where the LockBit ransomware group targeted the databases of companies like Jasman Automotive and Subway within a 24-hour timeframe. Source: Twitter Adding to the complexity of the situation, LockBit has recently listed a new organization based in Taiwan, Province of China, with 1,001-5,000 employees as its victim. This organization operates in the appliances, electrical, and electronics manufacturing sectors. Source: Twitter In a separate incident, Beasley, Mitchell & Co, a certified public accountants firm, allegedly fell victim to a LockBit ransomware cyberattack. The threat actor claims to have accessed sensitive information, including details about the management team and their extensive accounting experience. The deadline for compliance in this case is February 4, 2024, at 10:33:50 UTC. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Tietoevry, Finnish I ...

 Firewall Daily

Finnish IT services and enterprise cloud hosting provider Tietoevry has fallen victim to a ransomware attack, impacting cloud hosting customers in one of its data centers in Sweden. The Tietoevry cyberattack occurred during the night of Jan 19-20, affecting services for customers in Sweden. While overall Tietoevry   show more ...  

cyberattack recovery efforts are underway, the severity of the situation persists. Details of the Tietoevry Cyberattack The ransomware attack on Tietoevry targeted one part of a data center in Sweden, causing disruptions to Tietoevry’s services for customers in the region. The affected platform was promptly isolated to prevent further damage. The officials informed that the firm is actively engaged with affected customers, providing updates on the ongoing recovery efforts. Venke Bordal, Head of Market Sweden at Tietoevry Tech Services, expressed regret for the impact on customers and assured that all necessary resources are allocated to address the malicious attack. “We sincerely apologize for the problems this malicious attack is causing for our customers and everyone that is impacted by this. We have allocated all necessary resources to address this with full attention. We are in active dialogue with our customers who are directly affected”, said Bordal in a press statement. Officials further informed that the incident had been reported to the police, emphasizing the serious nature of the Tietoevry ransomware attack.  “Currently, we are not able to say how long it will take for systems to be restored but we are laser-focused on resolving this as soon as technically possible. The security and continuity of our services are of utmost priority to us, and we take this situation extremely seriously. The incident is being investigated by both internal and external specialists, and as a ransomware attack is a serious criminal act, it has also been reported to the police. Tietoevry is on high alert and is monitoring the situation continuously”, informed Bordal. Widespread Cyber Campaign Targets Finland’s Critical Sectors The severity of cyber threats in Finland is highlighted by a series of cyberattacks orchestrated by the NoName ransomware group. Suspected to have Russian affiliations, the group has intensified its campaign, targeting diverse critical sectors in the country. The NoName cyberattacks have targeted key entities such as the Energy Industry Association, Technical Academic TEK representing technical professionals, engineers, and Oikeus.fi, Finland’s legal information portal. The deliberate assault on crucial sectors reflects the hacker group’s strategic and widespread approach. Geopolitical Motivations Behind Cyberattacks The escalation of distributed denial-of-service (DDoS) attacks on Finnish organizations is rooted in geopolitical tensions. As Russia’s relations with Western powers strain, cyber operations intensify, with Finland becoming a deliberate target. NoName’s attacks on government organizations, regulatory bodies, and chambers of commerce underscore the geopolitical motivations driving these cyber assaults. The cyber landscape in Finland is under the scanner, with Tietoevry grappling with a ransomware attack and NoName ransomware group strategically targeting critical sectors. The Finnish government and organizations remain on high alert as they navigate the evolving cyber threat landscape. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for DDoS Barrage Hits Mo ...

 DDoS Attacks News

Monobank, Ukraine’s largest mobile-only bank, faced a barrage of denial of service (DDoS) attacks on January 21, crippling its operations and causing widespread disruption. Co-founder and CEO Oleh Horokhovskyi took to Telegram to confirm the Monobank cyberattack, revealing that the bank was targeted with a   show more ...  

staggering 580 million service requests in one of the attacks. DDoS attacks, which involve overwhelming a website with excessive traffic to overload its servers, have become a favored tactic among cybercriminals seeking to disrupt services. Horokhovskyi expressed concern over the severity of the attacks, stating, “I think today Monobank is one of the most attacked IT targets in the country.” Monobank Cyberattack: Menace of DDoS Attacks This cyberattack on Monobank follows a similar incident on January 20 when the bank experienced a DDoS attack involving 50 million service requests. While Horokhovskyi assured the public that the situation was under control and that Monobank was “still standing,” he revealed that another wave of attacks had commenced as he was announcing the Monobank cyberattack. The Monobank CEO did not attribute the attacks to any specific entity but noted that past threats had been linked to Russian hackers. This incident is reminiscent of a previous cyberattack in December 2023, when Monobank was targeted on the same day as a massive cyber assault on Ukrainian phone operator Kyivstar. The Russian hacker group Solntsepek claimed responsibility for the Kyivstar cyberattacks, raising suspicions about potential Russian involvement in the recent Monobank DDoS attack. Hybrid Warfare Unleashed: Russia’s Multi-Pronged Strategy The ongoing conflict between Russia and Ukraine has witnessed a shift in tactics, with cyber warfare playing an increasingly prominent role. Recent cyberattacks, including those by the NoName ransomware group, have targeted key Ukrainian organizations, such as the National Securities and Stock Market Commission, Accordbank, Unex Bank, Energy Community, and VELTA. Additionally, Microsoft’s recent report suggests that Russia is implementing a multi-pronged hybrid technology strategy to destabilize Ukraine. This involves destructive methodologies, the use of missiles, and cyberattacks on critical infrastructure. Russian hackers have continuously adapted their strategies, focusing on disrupting Ukraine’s energy, water, and other vital sectors. The situation has raised concerns about Russia’s intentions, with fears that the country may be planning to use cyberwarfare as a tool to destabilize Ukraine further. The cyberattack on Monobank highlights the vulnerability of Ukraine’s financial institutions to such cyber threats. As tensions escalate, experts predict that Russia is preparing for its next wave of cyberattacks, aiming to exploit and form destabilizing alliances critical to Ukraine’s resilience. The true extent and nature of these attacks remain uncertain, but the recent onslaught on Monobank foreshadows a potential winter of aggression against Ukraine and its partners. The cyber warfare in Europe has reached a critical juncture, with Russia’s targeted attacks on Ukraine’s government and critical infrastructure causing significant damage. As the conflict takes on new dimensions, the international community closely watches the evolving situation and its potential ramifications. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for BianLian Ransomware ...

 Firewall Daily

The BianLian ransomware group has claimed three new victims, adding them to their dark web portal. The targeted organizations include North Star Tax and Accounting, KC Pharmaceuticals, and Martinaire, all based in the United States. However, details regarding the extent of the BianLian ransomware attack, data   show more ...  

compromise, and the motive behind the cyber assault remain undisclosed. Despite the claims made by the BianLian ransomware, the official websites of the targeted companies are fully functional. This discrepancy has raised doubts about the authenticity of the BianLian group’s assertion. To ascertain the veracity of the claims, The Cyber Express team reached out to the officials of the affected organizations. As of the writing of this news report, no response has been received, leaving the BianLian ransomware attack claim unverified. BianLian Ransomware Attack: Industry Impact The potential implications of the recent BianLian ransomware attacks are particularly alarming, given the significant stature and nature of the companies that have fallen prey to the insidious group. North Star Tax and Accounting, a reputable firm in the financial sector, is entrusted with handling sensitive financial information for numerous clients. Source: Twitter The compromise of such data could have severe repercussions, not only for the company but also for the individuals and businesses relying on their services. Financial data breaches can lead to identity theft, financial fraud, and a loss of trust among clients, potentially jeopardizing the company’s standing in the industry. KC Pharmaceuticals, another victim in this wave of attacks, operates in the pharmaceutical sector, a critical industry responsible for the development and distribution of life-saving medications. Any disruption to their operations could not only compromise proprietary research and development data but also pose a threat to public health by affecting the production and distribution of essential pharmaceuticals. Source: Twitter The potential consequences of such an attack extend far beyond the immediate financial losses, encompassing public health risks and damage to the pharmaceutical supply chain. Martinaire, an aviation company specializing in air cargo services, is the third victim named in the ransomware claims. The aviation industry is known for its stringent safety regulations, and any compromise of Martinaire’s systems could potentially have widespread implications for air cargo logistics and transportation security. This highlights the broader impact that cyberattacks on critical infrastructure sectors can have on national security and economic stability. Source: Twitter History Repeats: Previous Attacks and Unverified Claims BianLian ransomware, as noted in a report by BlackBerry, showcases exceptional encryption speed and is coded in the Go programming language (Golang). This sophisticated approach has enabled the group to strike multiple organizations, leaving a trail of unverified claims in its wake. This is not the first time BianLian has surfaced; earlier in 2024, the group targeted MOOver, claiming access to a staggering 1.1 terabytes of data. Subsequently, Northeast Spine and Sports Medicine also found themselves on the list of victims. Both of these claims, similar to the recent ones, remain unverified. Further, in October 2023, the ransomware group added four victims to its dark web portal. Despite the claims, the websites of these alleged victims showed no immediate signs of a cyberattack. Going further back, in December 2022, the Australian Real Estate Group (AREG) fell prey to BianLian, with cybercriminals demanding a US$5 million ransom. The group not only claimed responsibility but also shared compressed folders containing sensitive company data. The Cybersecurity and Infrastructure Security Agency (CISA) has been monitoring BianLian’s activities, warning of its grim track record, particularly targeting critical infrastructure sectors in the U.S. since June 2022. The tactics of the BianLian group involve infiltrating victim systems through valid Remote Desktop Protocol (RDP) credentials. They utilize open-source tools and command-line scripting for discovery, credential harvesting, and eventually exfiltrating victim data through File Transfer Protocol (FTP), Rclone, or Mega. The group’s persistent attacks highlight the need for enhanced cybersecurity practices to prevent falling victim to these cybercriminals and protect critical infrastructure sectors from potential harm. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Govt., Critical Infrastructure

There are differing opinions on whether the CSRB should be granted subpoena powers, with concerns about potential conflicts of interest and adversarial relationships with the private sector.

 Incident Response, Learnings

A security researcher in Germany was fined €3,000 ($3,300) for uncovering and reporting a serious e-commerce database vulnerability. The vulnerability exposed almost 700,000 customer records due to a plaintext password stored in the software.

 Security Tips and Advice

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), along with the Environmental Protection Agency (EPA) and the FBI, has issued a warning about increased cyberthreats targeting water and wastewater systems.

 Breaches and Incidents

Subway's internal system, containing hundreds of gigabytes of data, has allegedly been compromised by the ransomware group. The group has given Subway a deadline to protect the stolen data, and it is currently unknown what ransom they have demanded.

 Incident Response, Learnings

The French regulator found that Yahoo had deposited at least 20 advertising cookies without obtaining proper consent, affecting more than 5 million consumers over 21 months.

 Breaches and Incidents

The renowned denim brand DENHAM the Jeanmaker confirmed that it fell victim to a cyberattack by the Akira ransomware group, with the incident being discovered on December 27, 2023.

 Malware and Vulnerabilities

The Zloader static configuration is now encrypted using RC4 with a hardcoded alphanumeric key, and the network encryption employs 1,024-bit RSA with RC4 and the Zeus "visual encryption" algorithms.

 Feed

This Metasploit module chains an authentication bypass vulnerability and a command injection vulnerability to exploit vulnerable instances of either Ivanti Connect Secure or Ivanti Policy Secure, to achieve unauthenticated remote code execution. All currently supported versions 9.x and 22.x prior to the vendor mitigation are vulnerable. It is unknown if unsupported versions 8.x and below are also vulnerable.

 Feed

PacketFence is a network access control (NAC) system. It is actively maintained and has been deployed in numerous large-scale institutions. It can be used to effectively secure networks, from small to very large heterogeneous networks. PacketFence provides NAC-oriented features such as registration of new network   show more ...  

devices, detection of abnormal network activities including from remote snort sensors, isolation of problematic devices, remediation through a captive portal, and registration-based and scheduled vulnerability scans.

 Feed

Gentoo Linux Security Advisory 202401-26 - Multiple vulnerabilities have been found in Apache XML-RPC, the worst of which could result in arbitrary code execution. Versions less than or equal to 3.1.3 are affected.

 Feed

Ubuntu Security Notice 6587-2 - USN-6587-1 fixed several vulnerabilities in X.Org. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs. An   show more ...  

attacker could possibly use this issue to cause the X Server to crash, obtain sensitive information, or execute arbitrary code.

 Feed

Ubuntu Security Notice 6591-1 - Timo Longin discovered that Postfix incorrectly handled certain email line endings. A remote attacker could possibly use this issue to bypass an email authentication mechanism, allowing domain spoofing and potential spamming. Please note that certain configuration changes are required to address this issue. They are not enabled by default for backward compatibility.

 Feed

In Traceroute versions 2.0.12 through to 2.1.2, the wrapper scripts mishandle shell metacharacters, which can lead to privilege escalation if the wrapper scripts are executed via sudo. The affected wrapper scripts include tcptraceroute, tracepath, traceproto, and traceroute-nanog. Version 2.1.3 addresses this issue.

 Feed

Red Hat Security Advisory 2024-0204-03 - Red Hat OpenShift Container Platform release 4.14.9 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.

 Firewall Daily

In an exclusive statement to The Cyber Express team, DENHAM the Jeanmaker, the renowned denim brand founded in Amsterdam in 2008, confirmed falling victim to a cyberattack. The denim giant disclosed that the DENHAM cyberattack was first discovered on December 27, 2023. Subsequently, The Cyber Express (TCE) reported   show more ...  

that DENHAM the Jeanmaker had been targeted by the Akira ransomware group. Nevertheless, DENHAM has refrained from either confirming or providing comments regarding the purported involvement of this hacker group in the cyberattack on DENHAM. Cyberattack on DENHAM Implications  According to a spokesperson responding to The Cyber Express query, the cyberattack on DENHAM did not materially impact the brand’s services in stores and online. The company swiftly responded to the threat, engaging a specialized cybersecurity firm immediately after the discovery. “Our incident response team conducted a digital forensic investigation into the incident,” the spokesperson told to TCE. “We have determined that the threat actor had access to some data on the affected systems. Importantly, this does not include the personal data of consumers who have visited our webshop. However, we are in proactive communication with relevant parties and have notified the Dutch Data Protection Authority as a precautionary measure.” DENHAM reassures customers, business partners, and employees about its commitment to data confidentiality. “We take the security of our customers’, business partners’, and employees’ data very seriously,” the spokesperson emphasized. The company, in collaboration with external cybersecurity experts, has implemented various measures to enhance security and prevent similar incidents in the future. Despite the severity of the cyberattack, DENHAM’s business operations have remained uninterrupted, thanks to the swift response and recovery efforts. Chronology of the DENHAM Cyberattack Discovery on December 27, 2023: DENHAM the Jeanmaker identified the cyberattack on their systems when a message from the threat actor was discovered. Immediate Response: The company promptly contacted a specialized cybersecurity firm to address the threat and restore systems. Due to the rapid recovery, there was virtually no impact on operational processes. Data Involved: The cyberattack targeted certain limited business data, with no compromise of consumer data. DENHAM ensures ongoing direct communication with affected parties as required. Precautionary Measures: The Dutch Data Protection Authority has been notified as a precautionary step, demonstrating DENHAM’s commitment to transparency and compliance with data protection regulations. Despite the severity of the DENHAM cyberattack, officials have chosen not to disclose further details surrounding the circumstances, the threat actor, or other aspects due to ICT security concerns. DENHAM the Jeanmaker remains resolute in its commitment to addressing the cyberattack’s aftermath responsibly, safeguarding customer data, and fortifying its cybersecurity measures for the future. The denim brand encourages affected parties to reach out for direct communication and support as necessary. The Cyber Express team will continue to provide exclusive updates as more information unfolds. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Feed

The U.S. Federal Trade Commission (FTC) is continuing to clamp down on data brokers by prohibiting InMarket Media from selling or licensing precise location data. The settlement is part of allegations that the Texas-based company did not inform or seek consent from consumers before using their location information for advertising and marketing purposes. "InMarket will also be prohibited from

 Feed

Cybersecurity researchers are warning of a "notable increase" in threat actor activity actively exploiting a now-patched flaw in Apache ActiveMQ to deliver the Godzilla web shell on compromised hosts. "The web shells are concealed within an unknown binary format and are designed to evade security and signature-based scanners," Trustwave said. "Notably, despite the binary's unknown file

 Feed

We analyzed 2,5 million vulnerabilities we discovered in our customer’s assets. This is what we found. Digging into the data The dataset we analyze here is representative of a subset of clients that subscribe to our vulnerability scanning services. Assets scanned include those reachable across the Internet, as well as those present on internal networks. The data includes findings for network

 Feed

Cybersecurity researchers have discovered a new Java-based "sophisticated" information stealer that uses a Discord bot to exfiltrate sensitive data from compromised hosts. The malware, named NS-STEALER, is propagated via ZIP archives masquerading as cracked software, Trellix security researcher Gurumoorthi Ramanathan said in an analysis published last week. The ZIP file contains

 Feed

Media organizations and high-profile experts in North Korean affairs have been at the receiving end of a new campaign orchestrated by a threat actor known as ScarCruft in December 2023. "ScarCruft has been experimenting with new infection chains, including the use of a technical threat research report as a decoy, likely targeting consumers of threat intelligence like cybersecurity

 Feed

Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attack method called MavenGate. "Access to projects can be hijacked through domain name purchases and since most default build configurations are vulnerable, it would be difficult or even impossible to know whether an attack was being performed

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Lawrence Abrams Finnish IT services and enterprise cloud hosting provider Tietoevry has suffered a ransomware attack impacting cloud hosting customers in one of its data centers in Sweden, with the attack reportedly conducted by the Akira ransomware gang. Tietoevry is   show more ...  

a Finnish IT services company offering managed services and cloud hosting […] La entrada Tietoevry ransomware attack causes outages for Swedish firms, cities – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Lawrence Abrams A widespread Facebook phishing campaign stating, “I can’t believe he is gone. I’m gonna miss him so much,” leads unsuspecting users to a website that steals your Facebook credentials. This phishing attack is ongoing and widely   show more ...  

spread on Facebook through friend’s hacked accounts, as the threat actors build a […] La entrada Watch out for “I can’t believe he is gone” Facebook phishing posts – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas Brave Software has announced plans to deprecate the ‘Strict’ fingerprinting protection mode in its privacy-focused Brave Browser because it causes many sites to function incorrectly. Fingerprinting protection in Brave Browser is a feature   show more ...  

designed to enhance user privacy by preventing websites from tracking users through a technique called fingerprinting. […] La entrada Brave to end ‘Strict’ fingerprinting protection as it breaks websites – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas A German court has charged a programmer investigating an IT problem with hacking and fined them €3,000 ($3,265) for what it deemed was unauthorized access to external computer systems and spying on data. According to the original report by Heise, the   show more ...  

programmer, operating as a freelance IT service provider, […] La entrada Court charges dev with hacking after cybersecurity issue disclosure – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the   show more ...  

organizations YouTube channel. Permalink *** This is a Security Bloggers Network syndicated blog from Infosecurity.US […] La entrada USENIX Security ’23 – Kaiming Cheng, Jeffery F. Tian, Tadayoshi Kohno, Franziska Roesner – Exploring User Reactions and Mental Models Towards Perceptual Manipulation Attacks in Mixed Reality – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Chris Pierson The importance of data privacy continues to grow exponentially. We recognize this critical need and are excited to kick off Data Privacy Week, a dedicated time to focus on the ways we can protect our personal information online. This week is not just about   show more ...  

awareness; it’s about taking actionable […] La entrada Welcome to Data Privacy Week: Empowering Your Cybersecurity with BlackCloak – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Lohrmann on Cybersecurity The 54th Annual Meeting of The World Economic Forum took place in Davos, Switzerland, this past week, and cybersecurity and AI were again top topics. Here are some highlights. January 21, 2024 •  Dan Lohrmann Adobe Stock/immimagery How can we   show more ...  

gauge what world leaders in the public and private […] La entrada Cybersecurity Challenges at the World Economic Forum – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 AI Application Security

Source: securityboulevard.com – Author: girishwallarm In today’s complex digital landscape, the security of APIs has become paramount. As we move into 2024, it’s essential to stay ahead of the evolving API security threats and vulnerabilities. The upcoming webinar on “API ThreatStats™ Report: 2023   show more ...  

Year-In-Review” is your quickest way to learn about the latest trends and […] La entrada Webinar: Join us for the latest in API Threats on January 24, 2024 – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Apache ActiveMQ

Source: securityaffairs.com – Author: Pierluigi Paganini Threat actors exploit Apache ActiveMQ flaw to deliver the Godzilla Web Shell Researchers warn of a spike in attacks exploiting a now-patched flaw in Apache ActiveMQ to deliver the Godzilla web shell. Trustwave researchers observed a surge in attacks   show more ...  

exploiting a now-patched flaw in Apache ActiveMQ, in many cases […] La entrada Threat actors exploit Apache ActiveMQ flaw to deliver the Godzilla Web Shell – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini Cybercriminals leaked massive volumes of stolen PII data from Thailand in Dark Web Resecurity researchers warn of massive leak of stolen Thai personally identifiable information (PII) on the dark web by cybercriminals. Resecurity has detected a noticeable   show more ...  

increase in data leaks from consumer-focused platforms in Thailand, confirming that threat […] La entrada Cybercriminals leaked massive volumes of stolen PII data from Thailand in Dark Web – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini Backdoored pirated applications targets Apple macOS users Researchers warned that pirated applications have been employed to deliver a backdoor to Apple macOS users. Jamf Threat Labs researchers warned that pirated applications have been utilized to   show more ...  

distribute a backdoor to Apple macOS users. The researchers noticed that the apps appear […] La entrada Backdoored pirated applications targets Apple macOS users – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini LockBit ransomware gang claims the attack on the sandwich chain Subway The LockBit ransomware gang claimed to have hacked Subway, the American multinational fast food restaurant franchise.  Subway IP LLC is an American multinational fast-food   show more ...  

restaurant franchise that specializes in submarine sandwiches (subs), wraps, salads, and drinks. The Lockbit ransomware group […] La entrada LockBit ransomware gang claims the attack on the sandwich chain Subway – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Endpoint Detection & Response (EDR) , Endpoint Security , Managed Detection & Response (MDR) Presented by Palo Alto Networks     60 minutes     In an era where cyber threats like Ransomware are evolving at unprecedented speed, scale and sophistication,   show more ...  

organizations face the daunting challenge of safeguarding their environments […] La entrada Panel | Defending Against Today’s Threat Landscape with MDR – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 A leading US security agency has issued an emergency directive requiring all of the government’s civilian federal agencies to mitigate two zero-days under active exploitation. Emergency Directive 24-01 was issued on Friday in response to “widespread and   show more ...  

active exploitation of vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure.” CISA […] La entrada CISA Emergency Directive Demands Action on Ivanti Zero-Days – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 Russian state hackers managed to compromise the email accounts of some of Microsoft’s senior leadership team, using basic brute-force techniques, the tech giant has admitted. Microsoft revealed on Friday that the “Midnight Blizzard” group (aka Nobelium,   show more ...  

APT29, Cozy Bear) was detected on its systems on January 12. The fact that […] La entrada Russian Spies Brute Force Senior Microsoft Staff Accounts – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . The U.S. Federal Trade Commission (FTC) is continuing to clamp down on data brokers by prohibiting InMarket Media from selling or licensing precise location data. The settlement is part of allegations that the Texas-based company did not inform or seek consent from   show more ...  

consumers before using their location information for advertising […] La entrada FTC Bans InMarket for Selling Precise User Location Without Consent – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 ActiveMQ

Source: thehackernews.com – Author: . Jan 22, 2024NewsroomVulnerability / Malware Cybersecurity researchers are warning of a “notable increase” in threat actor activity actively exploiting a now-patched flaw in Apache ActiveMQ to deliver the Godzilla web shell on compromised hosts. “The   show more ...  

web shells are concealed within an unknown binary format and are designed to evade security […] La entrada Apache ActiveMQ Flaw Exploited in New Godzilla Web Shell Attacks – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-01
Aggregator history
Monday, January 22
MON
TUE
WED
THU
FRI
SAT
SUN
JanuaryFebruaryMarch