Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Hewlett Packard Disc ...

 Data Breach News

In a disclosure to the Securities and Exchange Commission (SEC), Hewlett Packard Enterprise Company (HPE) revealed that it had fallen prey to a cyberattack orchestrated by the Russian state-sponsored actor APT29, widely recognized as Cozy Bear or Midnight Blizzard. Microsoft security team detected a sophisticated   show more ...  

nation-state attack on HPE’s corporate systems. On December 12, 2023, Swiftly responding to the threat, Microsoft activated its comprehensive response process, aiming to investigate, disrupt malicious activity, mitigate the attack, and prevent the threat actor. The threat actor, identified as Midnight Blizzard or Cozy Bear, is believed to have gained unauthorized access to HPE’s systems. HPE responded promptly by activating its response process and initiating an investigation, containment, and remediation efforts with the assistance of external cybersecurity experts. The company successfully eradicated the malicious activity. Cyberattack on Hewlett Packard Enterprise Source: Twitter The investigation unveiled that the threat actor had accessed and exfiltrated data starting in May 2023 from a limited number of HPE mailboxes, particularly those belonging to individuals in cybersecurity, go-to-market, business segments, and other functions. This cyberattack on Hewlett Packard Enterprise appears to be connected to earlier activity by the same threat actor, which HPE was made aware of in June 2023. The previous incident involved unauthorized access and exfiltration of a restricted number of SharePoint files as early as May 2023. HPE has been forthcoming in notifying and cooperating with law enforcement agencies. The company is also evaluating its regulatory notification obligations and will make notifications as necessary based on the findings of its ongoing investigation. As of the current filing date, the incident has not materially impacted HPE’s operations, and the company has not determined that it is reasonably likely to have a substantial effect on its financial condition or results of operations. The Official Filing It’s essential to note that this disclosure of the cyberattack on Hewlett Packard Enterprise is in compliance with the Form 8-K requirements and contains forward-looking statements as defined by the safe harbor provisions of the Private Securities Litigation Reform Act of 1995. HPE acknowledges the existence of risks, uncertainties, and assumptions related to these statements. The company emphasizes that if the risks or uncertainties materialize or assumptions prove incorrect, it may result in outcomes that differ materially from those expressed or implied in the forward-looking statements. Hewlett Packard Enterprise highlights its commitment to transparency and compliance, assuring stakeholders that it will continue to provide updates on the incident as needed. The company also reaffirms its adherence to legal obligations and regulations surrounding cybersecurity incidents. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Unveiling the Latest ...

 Dark Web News

A new MacOS stealer has surfaced on the dark web, causing concern among cybersecurity experts. Operating under a mysterious name, this information stealer has caught the attention of the security community with its advanced features and capabilities. Priced at $3000 per month, the MacOS stealer is a sophisticated tool   show more ...  

designed to collect sensitive information, posing a significant threat to Mac users. The Features of the MacOS Stealer Source: Twitter The MacOS stealer, attributed to the PANDA threat actor and known as PandaX, boasts an array of powerful features. The threat actor’s post outlines its ability to collect notes, keychain dumps, system Information, and MacOS passwords, and employ features such as FileGrabber and a hidden console during software initiation. This comprehensive range of functionalities enables the stealer to access and compromise various aspects of a user’s system. Notably, the MacOS stealer is not limited to a specific browser or platform. It is designed to infiltrate popular browsers like Safari, Chrome, Firefox, Brave, Edge, Vivaldi, Yandex, Opera, and OperaGX. Its capability to target a wide range of browsers makes it a versatile threat, posing risks to users across different online environments. MacOS Information Stealer: Wallets and Plugins The MacOS stealer doesn’t stop at browser data; it also targets cryptocurrency wallets and plugins. With the ability to compromise wallets such as Electrum, Binance, Exodus, Atomic, and Coinomi, the stealer poses a significant risk to individuals involved in cryptocurrency transactions. This is not the first time a MacOS information stealer has emerged. Cybersecurity researchers recently identified an upgraded version of a MacOS information stealer named Atomic. The active enhancement of such malware indicates a continuous effort by threat actors to stay ahead of security measures. The MacOS stealer follows a similar modus operandi to its predecessors. The threat actors often repackage pre-cracked applications as PKG files, embedding a Trojan proxy and a post-install script to initiate the infection. Users are deceived into installing compromised applications, leading to the stealthy infiltration of their systems. The recent emergence of the MacOS information stealer by multiple threat actors highlights the adaptability and persistence of threat actors.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for How to turn off Face ...

 Privacy

Facebook recently launched a new feature called link history. This post explains what link history is, why Facebook rolled it out, why you should turn it off, and most importantly — how. What is Facebook link history? Facebook mobile apps come with a built-in browser. Whenever you follow an external link posted on   show more ...  

Facebook, it opens in this very browser. Recently the social network decided to start collecting the history of all the links you click, and to use this data to show you targeted ads. Why does Facebook need it? Because its not just the largest social network in the world, but also one of the most powerful global advertising platforms — second only to Google in terms of scale and capabilities. Previously, to collect data on user interests and show targeted ads based on it, Facebook used third-party cookies. However, support for third-party cookies is being phased out in the worlds most popular browser — Google Chrome. Google has devised its own mechanism for tracking users and targeting ads — known as Google Ad Topics. To collect data, this technology makes active use of the Google Chrome browser and the Android operating system. Not so long ago, we explained how to opt out of this Google tracking. Now Facebook has decided to track users through the browser built into its various mobile app versions. Thats how the link-history feature was born. But it offers no additional benefits to regular users — despite Facebook trumpeting the convenience of being able to find any link you ever opened at any moment. But if you dont like the idea of Facebook tracking your every move, its best to turn off the feature; thankfully, its easy to do. How to turn off Facebook link history First, lets clarify that link history is only available in Facebook mobile apps. The feature is missing when you use the web version of the social network. Its also neither available in Facebook Lite (if only because this app has no built-in browser), nor (at least for now) in the Messenger app. The first time a user opens an external link posted on the social network after Facebook introduced link history, theyre asked for their consent to use the feature. The screen requesting permission to turn on link history is only shown once As youd probably expect, link history is enabled by default. So most users likely give consent without too much thought — just to get Facebook off their backs and to show the page they want. If youve already opted in to link history and now want to turn it off, there are two easy ways to do so. The first way to turn off link history In the Facebook app, open Menu by tapping the hamburger icon (the three lines in the upper-right corner on Android), or the Profile icon in the lower-right corner on iOS. Go to Settings & privacy — the easiest way is by tapping the gear icon. Scroll down to Browser and tap it. In the window that opens, toggle Allow link history Also, while youre at it, tap the Clear button next to Link history. Turning off Facebook link history through Settings & privacy on Android The second way to turn off link history In the app, tap any link posted on Facebook. This will open the apps built-in browser. In it, tap the ellipsis icon (upper-right corner on Android, lower-right on iOS). Select Go to Settings. In the window that opens, toggle Allow link history off and tap the Clear button next to Link history. Turning off Facebook link history through the built-in browser on iOS All done. Facebook will no longer collect your link history. While youre at it, dont forget to stop Google tracking you by disabling Google Ad Topics. To avoid online tracking in general, use the Private Browsing feature in Kaspersky applications.

image for Transatlantic Cable ...

 News

Episode 331 of the Transatlantic Cable podcast kicks off with news regarding the mother of all data breaches, consisting of some 26 billion (yes, really) user names. From there the team discuss fake Biden robocalls and a swearing customer chatbot. To wrap up, the team talk about the latest craze sweeping the gaming   show more ...  

world – PalWorld. If you liked what you heard, please consider subscribing. Mother of all breaches data leak reveals 26 billion account records stolen from Twitter, LinkedIn, more The Biden Deepfake Robocall Is Only the Beginning DPD error caused chatbot to swear at customer Pokémon with guns sells 5m copies in three days

image for Using Google Search ...

 A Little Sunshine

Google continues to struggle with cybercriminals running malicious ads on its search platform to trick people into downloading booby-trapped copies of popular free software applications. The malicious ads, which appear above organic search results and often precede links to legitimate sources of the same software, can   show more ...  

make searching for software on Google a dicey affair. Google says keeping users safe is a top priority, and that the company has a team of thousands working around the clock to create and enforce their abuse policies. And by most accounts, the threat from bad ads leading to backdoored software has subsided significantly compared to a year ago. But cybercrooks are constantly figuring out ingenious ways to fly beneath Google’s anti-abuse radar, and new examples of bad ads leading to malware are still too common. For example, a Google search earlier this week for the free graphic design program FreeCAD produced the following result, which shows that a “Sponsored” ad at the top of the search results is advertising the software available from freecad-us[.]org. Although this website claims to be the official FreeCAD website, that honor belongs to the result directly below — the legitimate freecad.org. How do we know freecad-us[.]org is malicious? A review at DomainTools.com show this domain is the newest (registered Jan. 19, 2024) of more than 200 domains at the Internet address 93.190.143[.]252 that are confusingly similar to popular software titles, including dashlane-project[.]com, filezillasoft[.]com, keepermanager[.]com, and libreofficeproject[.]com. Some of the domains at this Netherlands host appear to be little more than software review websites that steal content from established information sources in the IT world, including Gartner, PCWorld, Slashdot and TechRadar. Other domains at 93.190.143[.]252 do serve actual software downloads, but none of them are likely to be malicious if one visits the sites through direct navigation. If one visits openai-project[.]org and downloads a copy of the popular Windows desktop management application Rainmeter, for example, the file that is downloaded has the same exact file signature as the real Rainmeter installer available from rainmeter.com. But this is only a ruse, says Tom Hegel, principal threat researcher at the security firm Sentinel One. Hegel has been tracking these malicious domains for more than a year, and he said the seemingly benign software download sites will periodically turn evil, swapping out legitimate copies of popular software titles with backdoored versions that will allow cybercriminals to remotely commander the systems. “They’re using automation to pull in fake content, and they’re rotating in and out of hosting malware,” Hegel said, noting that the malicious downloads may only be offered to visitors who come from specific geographic locations, like the United States. “In the malicious ad campaigns we’ve seen tied to this group, they would wait until the domains gain legitimacy on the search engines, and then flip the page for a day or so and then flip back.” In February 2023, Hegel co-authored a report on this same network, which Sentinel One has dubbed MalVirt (a play on “malvertising”). They concluded that the surge in malicious ads spoofing various software products was directly responsible for a surge in malware infections from infostealer trojans like IcedID, Redline Stealer, Formbook and AuroraStealer. Hegel noted that the spike in malicious software-themed ads came not long after Microsoft started blocking by default Office macros in documents downloaded from the Internet. He said the volume of the current malicious ad campaigns from this group appears to be relatively low compared to a year ago. “It appears to be same campaign continuing,” Hegel said. “Last January, every Google search for ‘Autocad’ led to something bad. Now, it’s like they’re paying Google to get one out of every dozen of searches. My guess it’s still continuing because of the up-and-down [of the] domains hosting malware and then looking legitimate.” Several of the websites at this Netherlands host (93.190.143[.]252) are currently blocked by Google’s Safebrowsing technology, and labeled with a conspicuous red warning saying the website will try to foist malware on visitors who ignore the warning and continue. But it remains a mystery why Google has not similarly blocked more the 240+ other domains at this same host, or else removed them from its search index entirely. Especially considering there is nothing else but these domains hosted at that Netherlands IP address, and because they have all remained at that address for the past year. In response to questions from KrebsOnSecurity, Google said maintaining a safe ads ecosystem and keeping malware off of its platforms is a priority across Google. “Bad actors often employ sophisticated measures to conceal their identities and evade our policies and enforcement, sometimes showing Google one thing and users something else,” Google said in a written statement. “We’ve reviewed the ads in question, removed those that violated our policies, and suspended the associated accounts. We’ll continue to monitor and apply our protections.” Google says it removed 5.2 billion ads in 2022, and restricted more than 4.3 billion ads and suspended over 6.7 million advertiser accounts. The company’s latest ad safety report says Google in 2022 blocked or removed 1.36 billion advertisements for violating its abuse policies. Some of the domains referenced in this story were included in Sentinel One’s February 2023 report, but dozens more have been added since, such as those spoofing the official download sites for Corel Draw, Github Desktop, Roboform and Teamviewer. This October 2023 report on the FreeCAD user forum came from a user who reported downloading a copy of the software from freecadsoft[.]com after seeing the site promoted at the top of a Google search result for “freecad.” Almost a month later, another FreeCAD user reported getting stung by the same scam. “This got me,” FreeCAD forum user “Matterform” wrote on Nov. 19, 2023. “Please leave a report with Google so it can flag it. They paid Google for sponsored posts.” Sentinel One’s report didn’t delve into the “who” behind this ongoing MalVirt campaign, and there are precious few clues that point to attribution. All of the domains in question were registered through webnic.cc, and several of them display a placeholder page saying the site is ready for content. Viewing the HTML source of these placeholder pages shows many of the hidden comments in the code are in Cyrillic. Trying to track the crooks using Google’s Ad Transparency tools didn’t lead far. The ad transparency record for the malicious ad featuring freecad-us[.]org (in the screenshot above) shows that the advertising account used to pay for the ad has only run one previous ad through Google search: It advertised a wedding photography website in New Zealand. The apparent owner of that photography website did not respond to requests for comment, but it’s also likely his Google advertising account was hacked and used to run these malicious ads.

image for BlackCat Hackers Hit ...

 Data Breach News

The hacking group ALPHV/BlackCat has resurfaced, once again targeting healthcare companies and threatening to report them to the U.S. Department of Health and Human Services (HHS). This government agency, responsible for advancing the well-being of all Americans, now finds itself at the center of a cybersecurity storm.   show more ...  

Visitors to the BrightStar Care website were met with a chilling message indicating a security breach: “Sorry, you have been blocked. You are unable to access brightstarcare.com.” Cyberattack on BrightStar Care Further investigation revealed that the website was utilizing a security service to protect itself from online attacks, triggered by unspecified actions, possibly a certain word or phrase, a SQL command, or malformed data. The website also instructed affected users to contact the site owner, providing details of the incident.   In an attempt to delve deeper into the matter and verify the cyberattack, The Cyber Express Team reached out to the officials. However, as of the time of writing this report, no response has been received from the targeted healthcare companies. Adding fuel to the fire, according to the tweets, BlackCat openly declared their intention to report the targeted healthcare companies to the HHS. This marks a repeat of their aggressive approach seen in December when the BlackCat filed a complaint with the U.S. Securities and Exchange Commission (SEC) against MeridianLink, accusing the California-based company of not adhering to a four-day rule for disclosing a cyberattack. BlackCat Previous Encounter with the SEC and FBI In a strategic move viewed by experts as a form of triple extortion, BlackCat’s December complaint with the SEC showcased a new frontier in cybercrime—publicly reporting a cyberattack to a regulatory body. The group accused MeridianLink of withholding information about a cybersecurity incident that compromised customer data and operational details. In a bizarre turn of events, just hours after the FBI seized control of the ALPHV/BlackCat threat group’s website, the hackers defiantly reestablished control and issued a menacing message directed at the FBI. The dark web post detailed the repercussions of the takedown, revealing specific information about the exposed data to the FBI. BlackCat asserted its control by stating that the FBI only had access to a limited number of keys, leaving more than 3000 companies without access to their decryption keys. The post outlined new rules, removing all constraints except one—no interference with the Critical Infrastructure Sectors (CIS). The hackers declared that hospitals, nuclear power plants, and other critical systems were fair game for disruption. This audacious move by BlackCat, deviating from their usual covert operations and ransom demands, raises questions about the motivations and evolving strategies of cybercriminal groups. Is this a sign of desperation, an attempt to exert more pressure for ransom, or an innovative tactic to manipulate regulations for their illicit gains? As the cybersecurity landscape continues to evolve, these incidents emphasize the need for enhanced vigilance and collaboration between authorities, businesses, and cybersecurity experts to mitigate the ever-growing threat posed by sophisticated hacking groups. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Airline Gets SASE to ...

 Feed

Cathay, a travel lifestyle brand that includes the Cathay Pacific airline, had a growing cybersecurity problem made worse by its aging technology infrastructure. It solved part of the problem by replacing legacy technology with a modern one that has security built in.

 Malware and Vulnerabilities

Pirate applications targeting macOS users distribute a backdoor, allowing attackers to download and execute multiple payloads. Each application includes a malicious dylib, a backdoor, and a persistent downloader, posing a significant threat to users. The researchers from Jamf Threat Labs identified similarities with the ZuRu malware.

 Security Products & Services

A new iOS 17 update brings Stolen Device Protection feature to prevent unauthorized access and actions on stolen iPhones. Thieves will have limited access to sensitive information and actions, requiring additional authentication for critical changes.

 Security Tips and Advice

The performance goals consist of essential and enhanced practices based on industry cybersecurity frameworks and aim to address common vulnerabilities and mature cybersecurity capabilities in the healthcare sector.

 Trends, Reports, Analysis

In 2023, ReversingLabs identified a significant increase in malicious packages across open-source software platforms like npm, PyPI, and RubyGems. The number of malicious packages detected increased by 1,300% from 2020 and 28% from 2022.

 Malware and Vulnerabilities

The vulnerability, CVE-2024-23897, allows attackers to read arbitrary files on the Jenkins controller file system. This could potentially lead to various attacks, including remote code execution and decryption of stored secrets.

 Expert Blogs and Opinion

Embracing a culture of cybersecurity transparency is beneficial for businesses and the broader security of the internet, as it strengthens external perception and leads to quicker and more resilient reactions to breaches.

 Feed

GnuPG (the GNU Privacy Guard or GPG) is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As such, it is meant   show more ...  

to be compatible with PGP from NAI, Inc. Because it does not use any patented algorithms, it can be used without any restrictions.

 Feed

Debian Linux Security Advisory 5607-1 - Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.

 Feed

Debian Linux Security Advisory 5606-1 - Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, phishing, clickjacking, privilege escalation, HSTS bypass or bypass of content security policies.

 Feed

Debian Linux Security Advisory 5605-1 - Multiple security issues were discovered in Thunderbird, which could result in denial of service or the execution of arbitrary code.

 Feed

Ubuntu Security Notice 6598-1 - Fabian Bäumer, Marcus Brinkmann, Joerg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to certain algorithms and   show more ...  

features being downgraded. This issue is known as the Terrapin attack. This update adds protocol extensions to mitigate this issue.

 Feed

Ubuntu Security Notice 6597-1 - It was discovered that Puma incorrectly handled parsing chunked transfer encoding bodies. A remote attacker could possibly use this issue to cause Puma to consume resources, leading to a denial of service.

 Feed

Red Hat Security Advisory 2024-0397-03 - An update for the squid:4 module is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Issues addressed include buffer over-read, denial of service, and null pointer vulnerabilities.

 Firewall Daily

EquiLend, a prominent global financial technology company providing trading and post-trade services for the securities finance industry, disclosed that it fell victim to a cyberattack on January 22, 2024. The company officially announced the cyberattack on EquiLend, stating, “EquiLend identified a technical   show more ...  

issue that placed portions of our systems offline. We immediately launched an investigation and have identified a cybersecurity incident involving unauthorized access to our systems.” The company took immediate measures to secure its systems and is actively working to restore the affected services from EquiLend cyberattack. Cyberattack on EquiLend: Collaborative Efforts for Investigation In response to the cyberattack on EquiLend, the firm is collaborating with external cybersecurity firms and professional advisers to conduct a thorough investigation and expedite the restoration of services. While clients have been informed that the process may take several days, EquiLend assures that they are committed to providing regular updates as the situation evolves. This EquiLend cyberattack, comes amidst a series of cyberattacks targeting the financial sector. LoanDepot, Inc., a leading home lending solutions provider, recently reported a cyberattack where an unauthorized third party accessed sensitive personal information of approximately 16.6 million individuals within its systems. In response, LoanDepot is swiftly taking action, notifying affected individuals, and offering credit monitoring and identity protection services. In December 2023, Fidelity National Financial (FNF) disclosed a cyberattack, revealing that 1.3 million customers had their data exposed. Another major player, First American Financial Corporation, also succumbed to a cyberattack in the same month, prompting a temporary shutdown of specific systems. Potential Far-reaching Implications for EquiLend At the time of writing this report, EquiLend’s official website maintains its appearance of normalcy, seemingly functioning without apparent disruptions. However, the potential ramifications of this EquiLend cyberattack could extend far beyond the immediate challenges posed by the technical disruption. The gravity of the situation is accentuated by the fact that EquiLend operates within the financial sector, an industry that stands as a prime target for cyber threats due to the sensitive nature of financial data and transactions. Despite the company’s swift response and ongoing efforts to restore services, EquiLend has yet to disclose the full extent of the cyber intrusion. The lack of clarity regarding which systems or specific data may have been compromised adds an additional layer of uncertainty. As a result, industry stakeholders, including clients and partners, are left navigating uncharted waters, uncertain about the potential impact on financial data and the broader stability of financial transactions. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Firewall Daily

Just like how a gap in a wall is a flaw in a castle’s defenses, vulnerabilities in platforms and products are the most frequently used attack vectors that Threat Actors leverage or exploit in order to compromise a product. These can range from long-standing vulnerabilities in any given software to zero-day   show more ...  

exploits that occur during an update or change in the software. This flaw or vulnerability is typically not known to the vendor until the point of exploitation by a Threat Actor.   Over the past few years, we have observed several notable compromises and breaches in key products across the world, leveraging vulnerabilities as an initial access point. Meet ODIN.   The ODIN platform has emerged as a game-changer in the vulnerability-hunting space, taking the search for Common Vulnerabilities and Exposures (CVEs) to unprecedented levels of detail and usability, allowing vendors and organizations to take corrective or mitigative actions before they can be compromised by a CVE.   Empowering CVE Search:   ODIN’s advanced search mechanism is designed to meticulously explore vulnerabilities in a myriad of software and hardware systems, providing users with a nearly limitless set of actionable threat intelligence for organizations to conduct effective cybersecurity management on their products and platforms. This, in turn, helps equip cybersecurity professionals and enthusiasts with a multifaceted and user-friendly interface, contributing significantly to enhanced cybersecurity resilience, preparedness, and response.  Key Features to Gain Comprehensive Vulnerability Intelligence:   Each vulnerability on ODIN is uniquely identified by a CVE ID, becoming a standard reference point in the cybersecurity field. The platform offers in-depth CVE summaries, providing concise yet comprehensive overviews of vulnerability characteristics and potential impacts. Users benefit from a numerical score assigned to each CVE, gauging severity and potential risk. Correlating CVE IDs with specific ports and services enhances contextual understanding, while the CVE vector string analysis offers detailed insights into vulnerability functions and potential pathways.  Utilizing Common Weakness Enumeration (CWE):   ODIN goes beyond identification, utilizing the Common Weakness Enumeration system to pinpoint software weaknesses. Each CWE entry describes specific issues that can lead to vulnerabilities in software security. Reference links are provided for extended research, directing users to additional resources and detailed explanations.  Expanding ODIN’s Search Functionality to Exploits:   ODIN’s capabilities now extend to exploit details associated with vulnerabilities, offering precise tracking and management through exploit IDs. Detailed information about files associated with exploits, descriptive analyses outlining the nature and methodology, and categorization based on exploit type streamline vulnerability management. Platform details provide critical information about the platforms affected by exploits, facilitating targeted and effective security measures.  As the threat landscape grows increasingly volatile and enables more sophisticated and multifaceted attacks, ODIN stands as a beacon of innovation, empowering its users with a wealth of actionable intel that stands out in the noise of cyberspace.  Ready to bolster your cybersecurity efforts? Try ODIN today and harness its power stay secure, and navigate the complex world of vulnerabilities, staying one step ahead of threats.  https://getodin.com/ 

 Feed

A new Go-based malware loader called CherryLoader has been discovered by threat hunters in the wild to deliver additional payloads onto compromised hosts for follow-on exploitation. Arctic Wolf Labs, which discovered the new attack tool in two recent intrusions, said the loader's icon and name masquerades as the legitimate CherryTree note-taking application to dupe potential victims

 Feed

Hackers with links to the Kremlin are suspected to have infiltrated information technology company Hewlett Packard Enterprise's (HPE) cloud email environment to exfiltrate mailbox data. "The threat actor accessed and exfiltrated data beginning in May 2023 from a small percentage of HPE mailboxes belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions,"

 Feed

A previously undocumented China-aligned threat actor has been linked to a set of adversary-in-the-middle (AitM) attacks that hijack update requests from legitimate software to deliver a sophisticated implant named NSPX30. Slovak cybersecurity firm ESET is tracking the advanced persistent threat (APT) group under the name Blackwood. It's said to be active since at least 2018. The NSPX30

 Feed

The maintainers of the open-source continuous integration/continuous delivery and deployment (CI/CD) automation software Jenkins have resolved nine security flaws, including a critical bug that, if successfully exploited, could result in remote code execution (RCE). The issue, assigned the CVE identifier CVE-2024-23897, has been described as an arbitrary file read vulnerability through the

 Feed

Cybersecurity researchers have uncovered an updated version of a backdoor called LODEINFO that's distributed via spear-phishing attacks. The findings come from Japanese company ITOCHU Cyber & Intelligence, which said the malware "has been updated with new features, as well as changes to the anti-analysis (analysis avoidance) techniques." LODEINFO (versions 0.6.6 and 0.6.7

 Feed

The 2023/2024 Axur Threat Landscape Report provides a comprehensive analysis of the latest cyber threats. The information combines data from the platform's surveillance of the Surface, Deep, and Dark Web with insights derived from the in-depth research and investigations conducted by the Threat Intelligence team. Discover the full scope of digital threats in the Axur Report 2023/2024. Overview

 Feed

Cybersecurity researchers have shed light on the command-and-control (C2) server of a known malware family called SystemBC. "SystemBC can be purchased on underground marketplaces and is supplied in an archive containing the implant, a command-and-control (C2) server, and a web administration portal written in PHP," Kroll said in an analysis published last week. The risk and

 Android

This week the podcast is more lavatorial than usual, as we explore how privacy may have gone to sh*t on Google Maps, our guest drives hands-free on Britain's motorways (and is defamed by AI), and ransomware attacks an airplane-leasing firm. All this and much much more is discussed in the latest edition of the   show more ...  

"Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by BBC Technology Editor Zoe Kleinman.

 Guest blog

In a newly published report, the UK's National Cyber Security Centre (NCSC) has warned that malicious attackers are already taking advantage of artificial intelligence and that the volume and impact of threats - including ransomware - will increase in the next two years. Read more in my article on the Tripwire State of Security blog.

 Cyber Security News

Source: thehackernews.com – Author: . Jan 24, 2024NewsroomCloud Security / Kubernetes Cybersecurity researchers have discovered a loophole impacting Google Kubernetes Engine (GKE) that could be potentially exploited by threat actors with a Google account to take control of a Kubernetes cluster. The   show more ...  

critical shortcoming has been codenamed Sys:All by cloud security firm Orca. As many […] La entrada Google Kubernetes Misconfig Lets Any Gmail Account Control Your Clusters – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . In today’s highly distributed workplace, every employee has the ability to act as their own CIO, adopting new cloud and SaaS technologies whenever and wherever they need. While this has been a critical boon to productivity and innovation in the digital enterprise, it   show more ...  

has upended traditional approaches to IT security […] La entrada What is Nudge Security and How Does it Work? – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . The ransomware group known as Kasseika has become the latest to leverage the Bring Your Own Vulnerable Driver (BYOVD) attack to disarm security-related processes on compromised Windows hosts, joining the likes of other groups like Akira, AvosLocker, BlackByte, and   show more ...  

RobbinHood. The tactic allows “threat actors to terminate antivirus processes and […] La entrada Kasseika Ransomware Using BYOVD Trick to Disarms Security Pre-Encryption – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Lawrence Abrams Hewlett Packard Enterprise (HPE) disclosed today that suspected Russian hackers known as Midnight Blizzard gained access to the company’s Microsoft Office 365 email environment to steal data from its cybersecurity team and other departments.   show more ...  

Midnight Blizzard, aka Cozy Bear, APT29, and Nobelium, is a Russian state-sponsored hacking group believed […] La entrada HPE: Russian hackers breached its security team’s email accounts – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas A previously unknown traffic distribution system (TDS) named ‘VexTrio’ has been active since at least 2017, aiding 60 affiliates in their cybercrime operations through a massive network of 70,000 sites. Traffic Distribution Systems (TDS) are   show more ...  

services that take incoming traffic and redirect the user to another website depending on […] La entrada VexTrio TDS: Inside a massive 70,000-domain cybercrime operation – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas Over 5,300 internet-exposed GitLab instances are vulnerable to CVE-2023-7028, a zero-click account takeover flaw GitLab warned about earlier this month. The critical (CVSS score: 10.0) flaw allows attackers to send password reset emails for a targeted   show more ...  

account to an attacker-controlled email address, allowing the threat actor to change the […] La entrada Over 5,300 GitLab servers exposed to zero-click account takeover attacks – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas The United Kingdom’s National Cyber Security Centre (NCSC) warns that artificial intelligence (AI) tools will have an adverse near-term impact on cybersecurity, helping escalate the threat of ransomware. The agency says cybercriminals already use AI   show more ...  

for various purposes, and the phenomenon is expected to worsen over the next two […] La entrada UK says AI will empower ransomware over the next two years – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan New York-based global financial technology firm EquiLend says its operations have been disrupted after some systems were taken offline in a Monday cyberattack. Following the incident, the technology, data and analytics company also detected unauthorized   show more ...  

access to its network and is now working to restore all affected services. “On […] La entrada Global fintech firm EquiLend offline after recent cyberattack – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas Google Pixel smartphone owners report problems after installing the January 2024 Google Play system update, being unable to access their devices internal storage, open the camera, take screenshots, or even open apps. The issue is being reported by owners   show more ...  

of numerous Pixel models, including the Google Pixel 5, 6, 6a, 7, 7a, […] La entrada Google Pixel phones unusable after January 2024 system update – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Sponsored by Specops Software Hackers are constantly attempting to steal passwords, with Microsoft tracking 1,287 password attacks every second in 2022. If successful, the stolen passwords could open the door to other accounts, and increase the likelihood of being   show more ...  

targeted for more malicious attacks. To increase password security, regulatory organizations are […] La entrada How to secure AD passwords without sacrificing end-user experience – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 AI-Based Attacks , Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime U.S.-Led Sanctions Do Little to Curtail North Korea’s Development of AI Jayant Chakravarti (@JayJay_Tech) • January 24, 2024     Students at a computer learning   show more ...  

program at the Grand People’s Study House in Pyongyang (Image: Shutterstock) South Korea’s […] La entrada North Korean Hackers Using AI in Advanced Cyberattacks – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Anti-Phishing, DMARC , Business Email Compromise (BEC) , Fraud Management & Cybercrime Tight-Lipped Agency’s Next Move in Wake of $7.5M Scam Could Be Telling Marianne Kolbasuk McGee (HealthInfoSec) • January 24, 2024     Image: Getty Even for the   show more ...  

federal government, losing $7.5 million to cyberattacks is a big chunk […] La entrada Watching the Watchdog: Learning from HHS’ Grant Payment Mess – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Terisa Roberts Global Director, Risk Modelling & Decisioning , SAS Terisa Roberts is a director, and Global Solution lead for Risk Modeling and Decisioning at SAS. In her current role, she advises banks and regulators around the world on best practices topics in   show more ...  

risk modeling, decisioning and the responsible use […] La entrada Webinar | Future Proof Your Organisation with an Integrated Approach to Decision Making – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: PRESS RELEASE CAMBRIDGE, England, Jan. 24, 2024 /PRNewswire/ — Darktrace, a global leader in cyber security AI, and Garland Technology, a leading manufacturer of network TAP (test access point), aggregator, packet broker, data diode and inline bypass solutions,   show more ...  

today announced a new collaboration to help businesses protect complex industrial environments. This collaboration brings Darktrace/OT™ and […] La entrada Darktrace and Garland Technology Collaborate to Help Businesses Secure Operational Technology Environments – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Braun

Source: www.darkreading.com – Author: PRESS RELEASE WASHINGTON, D.C. – U.S. Senators Gary Peters (D-MI), Chairman of the Homeland Security and Governmental Affairs Committee, and Mike Braun (R-IN) introduced bipartisan legislation to better prepare federal employees to address serious cybersecurity   show more ...  

threats. The bill improves the President’s Cup Cybersecurity Competition, a national cyber competition that identifies and helps train the […] La entrada Peters and Braun Introduce Bipartisan Bill to Bolster Government’s Cybersecurity Capabilities – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: PRESS RELEASE DALLAS, Jan. 24, 2024 /PRNewswire-PRWeb/ — Zyston, a leading Managed Security Services Provider (MSSP) based in Dallas, Texas, is excited to introduce Managed Ransomware Detect and Respond (RDR), a co-managed solution designed to mitigate risk and   show more ...  

provide a swift, expert response to ransomware incidents. The average cost of a ransomware attack in the last […] La entrada Managed Ransomware Detect & Respond (RDR) Offering From Zyston – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 atlassian

Source: www.darkreading.com – Author: Tara Seals, Managing Editor, News, Dark Reading Source: Seemanta Dutta via Alamy Stock Photo About 15 million names, usernames, and emails associated with public Trello boards have been collected and put up for sale on the Dark Web — opening the door to account takeovers   show more ...  

and spear-phishing attacks down the line. […] La entrada Atlassian Tightens API After Hacker Scrapes 15M Trello Profiles – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: PRESS RELEASE SAN FRANCISCO, January 24, 2024 — Nozomi Networks Inc., the leader in OT and IoT security, today introduced Guardian Air™, the industry’s only wireless spectrum sensor purpose-built for OT and IoT environments worldwide. With 80 percent of new IoT   show more ...  

deployments wirelessly connected, wireless is quickly becoming a preferred network. The explosion of wirelessly […] La entrada Nozomi Networks Delivers Multi-Spectrum Wireless Security Sensor for Global OT and IoT Environments – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 ChatGPT

Source: www.darkreading.com – Author: Kristina Beek, Associate Editor, Dark Reading 1 Min Read Source: Ascannio via Shutterstock In new findings from Kaspersky’s Digital Footprint Intelligence service, the researchers said there has been an uptick in discussions regarding the illegal use of ChatGPT as   show more ...  

well as other large language models on the Dark Web. The discussions […] La entrada ChatGPT Cybercrime Discussions Spike to Nearly 3K Posts on Dark Web – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CISA's

Source: www.darkreading.com – Author: Robert Lemos, Contributing Writer Source: M Production via Shutterstock Water and wastewater utilities last week received new guidance for improving their response to cyberattacks from the US Cybersecurity and Infrastructure Security Agency (CISA), following a greater   show more ...  

number of attacks by nation-state groups and cybercriminals targeting the underserved critical infrastructure. CISA’s 27-page […] La entrada CISA’s Water Sector Guide Puts Incident Response Front & Center – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Accounts

Source: www.darkreading.com – Author: Becky Bracken, Editor, Dark Reading Source: William Morgan via Alamy Stock Photo Texas-based soup and sandwich slinger Jason’s Deli is alerting members of its Deli Dollars rewards program that their personal data was potentially exposed in a credential-stuffing attack.   show more ...  

The accounts were compromised with genuine logins gathered from the Dark Web […] La entrada Jason’s Deli Accounts Compromised by Credential Stuffing – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer Source: Tanoy1412 via Shutterstock A proof-of-concept exploit is now available for a near maximum-severity flaw in Fortra’s GoAnywhere Managed File Transfer (MFT) software that the company publicly disclosed on Jan. 23 after quietly   show more ...  

informing customers about the threat almost seven weeks ago. The release of the exploit […] La entrada Fortra Discloses Critical Auth Bypass Vuln in GoAnywhere MFT – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Alicia Buller, Contributing Writer Source: Birgit Korber via Alamy Stock Photo Experts have welcomed the creation of a new artificial intelligence (AI) council in Abu Dhabi as a key move toward strengthening national cybersecurity. The Artificial Intelligence and Advanced   show more ...  

Technology Council (AIATC), launched on Jan. 22 by the Abu Dhabi government, […] La entrada AI Program Poised to Advance Cybersecurity in Abu Dhabi – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 A Little Sunshine

Source: krebsonsecurity.com – Author: BrianKrebs Google continues to struggle with cybercriminals running malicious ads on its search platform to trick people into downloading booby-trapped copies of popular free software applications. The malicious ads, which appear above organic search results and often   show more ...  

precede links to legitimate sources of the same software, can make searching for software […] La entrada Using Google Search to Find Software Can Be Risky – Source: krebsonsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Angel Salazar Velasquez

Source: www.cybertalk.org – Author: slandau With over two decades of experience in the cyber security industry, I specialize in advising organizations on how to optimize their financial investments through the design of effective and cost-efficient cyber security strategies. Since the year 2000, I’ve had the   show more ...  

privilege of collaborating with various channels and enterprises across the […] La entrada Synergy between cyber security Mesh & the CISO role: Adaptability, visibility & control – Source: www.cybertalk.org se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 cloud architecture

Source: www.cybertalk.org – Author: slandau EXECUTIVE SUMMARY: In a decade driven by digital transformation, the increased reliance on cloud computing has presented unprecedented opportunities for businesses, enabling scalability and efficiency. However, the shift to cloud has also introduced challenges —   show more ...  

particularly in relation to cyber security. As you strategize and prepare for the remainder of […] La entrada Navigating the future of cloud security: 20 statistics & trends – Source: www.cybertalk.org se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 China-Aligned

Source: www.infosecurity-magazine.com – Author: 1 ESET researchers have recently unveiled a highly sophisticated implant known as NSPX30, which has been linked to a newly identified Advanced Persistent Threat (APT) group named Blackwood. The findings, detailed in a Wednesday publication on the ESET blog,   show more ...  

indicate that Blackwood has been actively engaged in cyber-espionage since at least […] La entrada China-Aligned APT Group Blackwood Unleashes NSPX30 Implant – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 The government sector has witnessed the most significant growth in crowdsourced security in 2023, marking a 151% increase in vulnerability submissions and a substantial 58% rise in Priority 1 (P1) rewards for critical vulnerabilities. Noteworthy increases in   show more ...  

vulnerability submissions were also observed in retail (+34%), corporate services (+20%) and computer software […] La entrada Government Security Vulnerabilities Surge By 151%, Report Finds – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 North Korea-backed threat actors hacked more crypto platforms than ever in 2023 but stole less of the digital currency in total than in 2022. Crypto research firm Chainalysis has found that North Korean adversaries stole slightly over $1.0bn in 2023, compared   show more ...  

with around $1.7bn in 2022. The 2022 spike, which […] La entrada North Korea Hacks Crypto: More Targets, Lower Gains – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaches

Source: www.infosecurity-magazine.com – Author: 1 Written by The number of reported data compromises in the US in 2023 increased by 78% compared to 2022, reaching 3205, according to the Identity Theft Resource Center’s (ITRC) latest report. The number of victims of these data breaches reached 353,027,892.   show more ...  

While this is still a staggering number, it represents […] La entrada Data Privacy Week: US Data Breaches Surge, 2023 Sees 78% Increase in Compromises – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-01
Aggregator history
Thursday, January 25
MON
TUE
WED
THU
FRI
SAT
SUN
JanuaryFebruaryMarch