Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Crypto theft from Ex ...

 Threats

Using cracked games or apps to spread malware is one of cybercriminals oldest tricks. Incredible as it may sound, gullible victims who believe in Robin Hoods and consider downloading cracked software and games from pirating websites to be absolutely safe still exist in 2024. The type of threat itself may be old, but   show more ...  

malicious actors keep coming up with new ways of circumventing security on victims computers to deliver malware. We recently discovered a new campaign of this kind targeting Apple computers running newer versions of macOS (13.6 and later) and leveraging certain Domain Name System (DNS) features for downloading malicious payloads. Victims are offered to download cracked versions of popular apps for free. So whats in store for those who give in to temptation? Fake activation After downloading a disk image purportedly containing the cracked app, the victim is prompted to copy two files to the Applications folder: the app itself, and a so-called activator. If you just copy and launch the app, it wont run. According to the manual, the cracked app must be activated first. Our analysis found that the activator doesnt do anything sophisticated: it simply removes several bytes from the beginning of the application executable to make it functional. In other words, the cybercriminals have modified a pre-cracked app to prevent it from running unless its activated first. To no ones surprise, the activator has a nasty side-effect: it asks for admin permissions when it runs, and uses those to install a downloader script in the system. The script then downloads from the web a further payload — a backdoor that requests commands from its operators every now and then. Installation manual, activator window, and prompt for administrator password Linking via DNS To download the malicious script, the activator employs a tool thats both exotic and innocent-looking: the Domain Name System (DNS). We wrote about DNS and Secure DNS earlier, but we left out an interesting technical feature of the service. Each DNS record not only links the internet name of a server with its IP address, but can also contain a free-form text description of the server — called a TXT record. This is what the malicious actors exploited by embedding snippets of malicious code within TXT records. The activator downloads three TXT records belonging to a malicious domain and assembles a script from these. Although seemingly complicated, the setup has a number of advantages. To start with, the activator does nothing particularly suspicious: any web application requests DNS records — this is how any communication session has to begin. Secondly, the malicious actors can easily update the script to modify the infection pattern and the final payload by editing the TXT records of the domain. And finally, removing malicious content from the Web is no easy task due to the distributed nature of the Domain Name System. Internet service providers and companies would find it hard to even detect the violation of their policies because each of these TXT records is just a snippet of malicious code that poses no threat in and of itself. The final boss The periodically-running download script allows the attackers to update the malicious payload and perform whatever actions they want on the victims computer. At the time of our analysis, they showed interest in stealing crypto. The backdoor automatically scans the victims computer for Exodus or Bitcoin wallets, and replaces these with trojanized versions. An infected Exodus wallet steals the users seed phrase, and an infected Bitcoin wallet — the encryption key thats used to encrypt private keys. The latter gives the attackers the ability to sign transfers on behalf of the victim. This is how one can try to save a few dozen dollars on pirated apps — only to lose a vastly larger amount in crypto. Protecting yourself against an attack on crypto wallets This isnt novel but still true: to keep away from this threat and avoid becoming a victim, download apps from official marketplaces only. Before downloading an app from a developers website, make sure its the genuine item and not from one of many phishing sites. If youre thinking of downloading a cracked version of an app, think again. Scrupulous and trustworthy pirating sites are about as rare as elves and unicorns. No matter how highly you think of your computer literacy, caution, and attention to detail, be sure to use comprehensive security on all your devices: phones, tablets, and computers. Kaspersky Premium is a good cross-platform solution. Check that all basic and advanced security features are enabled. As for crypto owners, in addition to the above, we suggest reading our detailed instructions on protecting both hot and cold crypto wallets.

image for Leading Mobile Banki ...

 Firewall Daily

The IntelBroker hacker group has claimed responsibility for a potential cyberattack on a popular (undisclosed) mobile banking app boasting over 10 million users. The threat actor, known for their prowess in exploiting vulnerabilities, posted details of the exploit on a hacker forum on Saturday, January 27, 2024. The   show more ...  

post by IntelBroker, titled “[Cyber Niggers] Popular Mobile Bank Vulnerability,” offers an exploit capable of scraping and leaking sensitive information from the banking app. The data for sale includes full names, countries, and payment methods of users. The hacker is demanding payment exclusively in XMR (Monero) and has provided visuals to emphasize the gravity of the exploit. IntelBroker Hacker Group and Cyber Niggers Cyberattack Claims The exact target of this attack is not explicitly mentioned in the post. However, speculations stemming from the initial X post by Daily Dark Web hint at Nu Bank being the potential target. Source: Dark Web In November 2023, parallel reports emerged of a cyberattack on General Electric, a multinational tech giant. IntelBroker, affiliated with the Cyber Niggers hacker group, has purportedly breached General Electric, claiming access to confidential military projects. The hackers have attempted to sell network access on a hacker forum for US$500. General Electric, in response, has initiated an investigation into the alleged data breach. The General Electric Data Breach The breach allegedly involves access to sensitive information related to the US government defense R&D agency, DARPA. IntelBroker has not only claimed network access but also put up samples of leaked data for sale on the hacker forum. The data includes SQL database files, military documents, aviation systems technical descriptions and guides, and maintenance reports. General Electric, renowned for its contributions to aerospace technology, particularly aircraft engines, collaborates with DARPA on various defense-related projects. A GE spokesperson confirmed awareness of the claims made by IntelBroker and assured that appropriate measures would be taken to safeguard the integrity of their systems. IntelBroker has a history of successful and high-profile attacks, including breaches at Weee! grocery service, the District of Columbia’s DC Health Link program, and the US Citizenship and Immigration Services. This recent incident highlights the persistent threats posed by cybercriminal organizations like the IntelBroker hacker group and Cyber Niggers in both financial and technological sectors. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for NoName Cyberattack S ...

 Firewall Daily

The NoName group claims to have launched a sophisticated cyberattack on multiple high-profile websites in the Netherlands. The targeted organizations listed in the claimed NoName cyberattack include OV-chipkaart, the Municipality of Vlaardingen, the Dutch Tax Office (Belastingdienst), and GVB, raising concerns due to   show more ...  

the sensitive nature of the information held by these entities. OV-chipkaart, a contactless smart card system widely used for public transportation in the Netherlands, has been specifically identified as a target. This system is integral to travel on trains, trams, buses, and metros and contains personal and financial information. The potential leak of this data could lead to severe consequences. In-Detail About NoName Cyberattack Despite the bold claims made by the NoName group, the extent of the NoName cyberattack, details of any data compromise, or the motive behind the attack remain undisclosed. Upon investigating the official websites of the targeted companies, a lack of security measures was noted, except for the GVB website. A visual examination of the affected organizations’ websites presents a mixed scenario. While some sites appear to be fully operational with no immediate signs of a cyberattack, approximately half of the listed websites are experiencing issues. These issues range from “403 Forbidden” errors to prolonged loading times, indicating a potential disruption or compromise. Source: Twitter The situation is dynamic and continues to unfold. It is imperative to approach this information cautiously, as unverified claims in the cybersecurity world are not uncommon. The alleged NoName attack highlights the persistent threat of cyberattacks on crucial entities, such as banks and government organizations. However, official statements from the targeted companies are yet to be released, leaving room for skepticism regarding the severity and authenticity of the NoName cyberattack claim. Until official communication is provided by the affected organizations, the true nature and impact of the alleged NoName attack remain uncertain. NoName Previous Attacks This isn’t the first instance of NoName targeting organizations. In January 2024, the group claimed responsibility for a series of cyberattacks across Ukraine, Finland, and the USA. The dark web channel of the threat actor specifically named eight organizations as victims, indicating a coordinated and widespread cyberattack. The organizations targeted in the prior attack included PrivatBank 24, Credit Agricole Bank, MTB BANK, Accordbank, Matek Systems (China), Pixhawk (Switzerland), SpetsInTech, and Kvertus. As the cybersecurity landscape evolves, these incidents emphasize the need for enhanced security measures and proactive responses to counteract the ever-growing threat of cyberattacks. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Malaysian Telecom Pr ...

 Data Breach News

The pro-Israeli hacktivist group, R00TK1T ISC Cyber Team, has allegedly targeted Malaysian entities, marking their first cyberattack on Aminia.  The group claims to have compromised Aminia’s billing and Managed WiFi services portals, hinting at a potential data breach. The attack follows the group’s   show more ...  

threat to target Malaysian internet infrastructure. The hacktivist group posted a message on the compromised portal, warning Aminia of the impending chaos and exposing vulnerabilities within the company. Aminia, a Malaysian telecom provider, provides services and diverse systems for efficient AI-driven analytics. Collaborating with global leaders, Aminia offers GPON, FiberLan, Wi-Fi, and more. The post also includes screenshots revealing compromised Wireless Network Management panels. This cyber onslaught comes on the heels of the group’s explicit threats issued on January 26, where they declared their intent to target Malaysian organizations. Cyberattack on Aminia; R00TK1T ISC Cyber Team Responsibility Source: Dark Web The Cyber Express attempted to reach out to Aminia for more information regarding the Aminia cyberattack, but the website is currently inaccessible, displaying an “Index of /” error. Such errors often occur after a cyberattack when unauthorized access manipulates server configurations or deletes crucial files, exposing directory contents.  Furthermore, the hacktivist group has asserted that they carried out an internal defacement of Aminia’s portal, leaving an indelible mark on the managed service provider. The severity of the breach escalates as the group shares a second screenshot, indicating the compromise of Aminia’s Managed WiFi services portal. Source: Dark Web To substantiate their claims, R00TK1T shared screenshots containing sensitive information related to Aminia’s dashboard, customers, services, and more. The group accuses Malaysia of harboring cyber threats in the Middle East conflict and vows to expose such activities. R00TK1T ISC Cyber Team Vows to Target Malaysia Source: Dark Web The gravity of the situation intensifies with the revelation that the threat actors are not confining their actions to Aminia alone. R00TK1T ISC Cyber Team has issued threats to target Malaysian internet infrastructure, amplifying concerns about the broader implications of their actions on the nation. The group’s modus operandi involves sharing screenshots of the compromised Wireless Network Management panel, specifically the Controlled Access Point System Manager (CAPsMAN) panel, manufactured by MicroTik. The panel was running on OS version 7.3.1, which is susceptible to CVE-2023-41570, highlighting an incorrect access control vulnerability in the wireless network management panel.  However, it remains uncertain whether the compromised panel belongs to Aminia or another Malaysian telecommunication company. The Cyber Express will be closely monitoring the situation and we’ll update this post once we have more information on the Aminia cyberattack. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Malware and Vulnerabilities

The ransomware appends a random 8-character alphanumeric extension to encrypted files and its DLS, titled “MYDATA,” is considered unstable and frequently offline, indicating the group is still in the process of setting up operations.

 Malware and Vulnerabilities

The attack, IOActive explains, was possible due to a vulnerability in the ATM’s software update mechanism that could allow an attacker to supply their own malicious file and trigger legitimate processes for code execution.

 Expert Blogs and Opinion

Security step-ups should only be used for higher-risk scenarios and should be implemented in a user-friendly manner to maintain a balance between security and user experience.

 Feed

Gentoo Linux Security Advisory 202401-34 - Multiple vulnerabilities have been discovered in Chromium and its derivatives, the worst of which can lead to remote code execution. Versions greater than or equal to 120.0.6099.109 are affected.

 Feed

Gentoo Linux Security Advisory 202401-33 - Multiple vulnerabilities have been found in WebKitGTK+, the worst of which may lead to remote code execution. Versions greater than or equal to 2.42.2:4 are affected.

 Feed

TELSAT marKoni FM Transmitter version 1.9.5 is susceptible to unauthenticated remote code execution with root privileges. An attacker can exploit a command injection vulnerability by manipulating the Email settings' WAN IP info service, which utilizes the wget module. This allows the attacker to gain unauthorized   show more ...  

access to the system with administrative privileges by exploiting the url parameter in the HTTP GET request to ekafcgi.fcgi.

 Feed

Qualys discovered a heap-based buffer overflow in the GNU C Library's __vsyslog_internal() function, which is called by both syslog() and vsyslog(). This vulnerability was introduced in glibc 2.37 (in August 2022).

 Feed

Qualys discovered a memory corruption in the glibc's qsort() function, due to a missing bounds check. To be vulnerable, a program must call qsort() with a nontransitive comparison function (a function cmp(int a, int b) that returns (a - b), for example) and with a large number of attacker-controlled elements (to   show more ...  

cause a malloc() failure inside qsort()). They have not tried to find such a vulnerable program in the real world. All glibc versions from at least September 1992 (glibc 1.04) to the current release (glibc 2.38) are affected, but the glibc's developers have independently discovered and patched this memory corruption in the master branch (commit b9390ba, "stdlib: Fix array bounds protection in insertion sort phase of qsort") during a recent refactoring of qsort().

 Feed

Debian Linux Security Advisory 5611-1 - The Qualys Research Labs discovered several vulnerabilities in the GNU C Library's __vsyslog_internal() function (called by syslog() and vsyslog()). A heap-based buffer overflow (CVE-2023-6246), an off-by-one heap overflow (CVE-2023-6779) and an integer overflow (CVE-2023-6780) can be exploited for privilege escalation or denial of service.

 Feed

Ubuntu Security Notice 6591-2 - USN-6591-1 fixed vulnerabilities in Postfix. A fix with less risk of regression has been made available since the last update. This update updates the fix and aligns with the latest configuration guidelines regarding this vulnerability.

 Feed

Gentoo Linux Security Advisory 202401-31 - Multiple vulnerabilities have been found in containerd, the worst of which could result in privilege escalation. Versions greater than or equal to 1.6.14 are affected.

 Feed

Gentoo Linux Security Advisory 202401-30 - Multiple vulnerabilities have been discovered in the Xorg Server and XWayland, the worst of which can result in privilege escalation or remote code execution. Versions greater than or equal to 21.1.11 are affected.

 Feed

Ubuntu Security Notice 6609-2 - Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network family support while creating a new netfilter table. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. It was discovered that the CIFS   show more ...  

network file system implementation in the Linux kernel did not properly validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial of service or possibly expose sensitive information.

 Feed

Ubuntu Security Notice 6617-1 - It was discovered that libde265 could be made to write out of bounds. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04   show more ...  

LTS and Ubuntu 18.04 LTS. It was discovered that libde265 could be made to write out of bounds. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

 Feed

A vulnerability exists within Mirth Connect due to its mishandling of deserialized data. This vulnerability can be leveraged by an attacker using a crafted HTTP request to execute OS commands within the context of the target application. The original vulnerability was identified by IHTeam and assigned CVE-2023-37679.   show more ...  

Later, researchers from Horizon3.ai determined the patch to be incomplete and published a gadget chain which bypassed the deny list that the original had implemented. This second vulnerability was assigned CVE-2023-43208 and was patched in Mirth Connect version 4.4.1. This Metasploit module has been tested on versions 4.1.1, 4.3.0 and 4.4.0.

 Feed

Ubuntu Security Notice 6618-1 - It was discovered that Pillow incorrectly handled certain long text arguments. An attacker could possibly use this issue to cause Pillow to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. Duarte Santos discovered that   show more ...  

Pillow incorrectly handled the environment parameter to PIL.ImageMath.eval. An attacker could possibly use this issue to execute arbitrary code.

 Feed

Ubuntu Security Notice 6587-3 - USN-6587-1 fixed vulnerabilities in X.Org X Server. The fix was incomplete resulting in a possible regression. This update fixes the problem. Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs.   show more ...  

An attacker could possibly use this issue to cause the X Server to crash, obtain sensitive information, or execute arbitrary code. Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled reattaching to a different master device. An attacker could use this issue to cause the X Server to crash, leading to a denial of service, or possibly execute arbitrary code. Olivier Fourdan and Donn Seeley discovered that the X.Org X Server incorrectly labeled GLX PBuffers when used with SELinux. An attacker could use this issue to cause the X Server to crash, leading to a denial of service. Olivier Fourdan discovered that the X.Org X Server incorrectly handled the curser code when used with SELinux. An attacker could use this issue to cause the X Server to crash, leading to a denial of service. Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the XISendDeviceHierarchyEvent API. An attacker could possibly use this issue to cause the X Server to crash, or execute arbitrary code. Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled devices being disabled. An attacker could possibly use this issue to cause the X Server to crash, or execute arbitrary code.

 Feed

Ubuntu Security Notice 6616-1 - It was discovered that OpenLDAP was not properly performing bounds checks when executing functions related to LDAP URLs. An attacker could possibly use this issue to cause a denial of service.

 Feed

Ubuntu Security Notice 6615-1 - Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.36 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

 Feed

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide. The latest stable version is the 3.2 series supported until 23rd November 2025.

 Feed

A pair of recently disclosed zero-day flaws in Ivanti Connect Secure (ICS) virtual private network (VPN) devices have been exploited to deliver a Rust-based payload called KrustyLoader that's used to drop the open-source Sliver adversary simulation tool. The security vulnerabilities, tracked as CVE-2023-46805 (CVSS score: 8.2) and CVE-2024-21887 (CVSS score: 9.1), could be abused

 Feed

Malicious local attackers can obtain full root access on Linux machines by taking advantage of a newly disclosed security flaw in the GNU C library (aka glibc). Tracked as CVE-2023-6246, the heap-based buffer overflow vulnerability is rooted in glibc's __vsyslog_internal() function, which is used by syslog() and vsyslog() for system logging purposes. It's said to have been accidentally

 Feed

Ivanti is alerting of two new high-severity flaws in its Connect Secure and Policy Secure products, one of which is said to have come under targeted exploitation in the wild. The list of vulnerabilities is as follows - CVE-2024-21888 (CVSS score: 8.8) - A privilege escalation vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows

 Feed

Cybersecurity researchers are calling attention to the "democratization" of the phishing ecosystem owing to the emergence of Telegram as an epicenter for cybercrime, enabling threat actors to mount a mass attack for as little as $230. "This messaging app has transformed into a bustling hub where seasoned cybercriminals and newcomers alike exchange illicit tools and insights creating a dark and

 Feed

The SEC isn’t giving SaaS a free pass. Applicable public companies, known as “registrants,” are now subject to cyber incident disclosure and cybersecurity readiness requirements for data stored in SaaS systems, along with the 3rd and 4th party apps connected to them.  The new cybersecurity mandates make no distinction between data exposed in a breach that was stored on-premise, in the

 Feed

A financially motivated threat actor known as UNC4990 is leveraging weaponized USB devices as an initial infection vector to target organizations in Italy. Google-owned Mandiant said the attacks single out multiple industries, including health, transportation, construction, and logistics. "UNC4990 operations generally involve widespread USB infection followed by the deployment of the

 Feed

Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks. The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have been collectively dubbed Leaky Vessels by cybersecurity vendor Snyk. "These container

 Guest blog

A 33-year-old man has been sentenced to two years in prison after admitting his part in a series of ransomware and malware attacks that hit more than one thousand individuals, businesses, and organisations — including three police departments. Read more in my article on the Hot for Security blog.

 Brazilian

Source: thehackernews.com – Author: . Jan 30, 2024NewsroomCyber Crime / Malware A Brazilian law enforcement operation has led to the arrest of several Brazilian operators in charge of the Grandoreiro malware. The Federal Police of Brazil said it served five temporary arrest warrants and 13 search and   show more ...  

seizure warrants in the states of São Paulo, […] La entrada Brazilian Feds Dismantle Grandoreiro Banking Trojan, Arresting Top Operatives – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Jan 30, 2024NewsroomDevSecOps / Vulnerability GitLab once again released fixes to address a critical security flaw in its Community Edition (CE) and Enterprise Edition (EE) that could be exploited to write arbitrary files while creating a workspace. Tracked as   show more ...  

CVE-2024-0402, the vulnerability has a CVSS score of 9.9 out of […] La entrada URGENT: Upgrade GitLab – Critical Workspace Creation Flaw Allows File Overwrite – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 China-Linked

Source: thehackernews.com – Author: . Jan 30, 2024NewsroomMalware / Cyber Espionage The China-based threat actor known as Mustang Panda is suspected to have targeted Myanmar’s Ministry of Defence and Foreign Affairs as part of twin campaigns designed to deploy backdoors and remote access trojans.   show more ...  

The findings come from CSIRT-CTI, which said the activities took place […] La entrada China-Linked Hackers Target Myanmar’s Top Ministries with Backdoor Blitz – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cryptography

Source: www.schneier.com – Author: Bruce Schneier HomeBlog Comments tfb • January 30, 2024 5:05 PM I do wonder whether the remaining colossi were really still useful in the 1960s. I suppose they must have been but that’s well into the era of transistor computers. Clive Robinson • January 30, 2024 7:04 PM   show more ...  

@ tfb, ALL, […] La entrada New Images of Colossus Released – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.schneier.com – Author: Bruce Schneier HomeBlog Comments whoops • January 30, 2024 7:58 AM The problem is partly the legality of the NSA buying this. The real problem is that these data can be bought. Or: if it is illegal for the NSA to buy these data, why should it be legal to (hoard […] La   show more ...  

entrada NSA Buying Bulk Surveillance Data on Americans without a Warrant – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 attack

Source: www.govinfosecurity.com – Author: 1 Fraud Management & Cybercrime , Ransomware Manufacturer Confirms Systems Down, Data on Energy Consumption, Emission Accessed Cal Harrison • January 30, 2024     A Schneider Electric facility in Houston, Texas (Image: Shutterstock) Schneider Electric built its   show more ...  

business on manufacturing circuit breakers and other electrical parts, but nowadays it also […] La entrada Ransomware Attack Hits Schneider Electric Sustainability Unit – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Governance & Risk Management , Patch Management Approximately 45,000 Vulnerable Servers Worldwide Mihir Bagwe (MihirBagwe) , Prajeet Nair (@prajeetspeaks) • January 30, 2024     Hacker are searching for vulnerable Jenkins servers. (Image: Jenkins Project)   show more ...  

Hackers are scanning the internet looking for vulnerable instances of the Jenkins server used by […] La entrada Jenkins Servers Used for CI/CD Contain Critical RCE Flaw – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 cloud

Source: www.govinfosecurity.com – Author: 1 Boyu Wang Principal Data Scientist, Snowflake Boyu Wang is a Principal Data Scientist at Snowflake where he designs, architects, as well as implements next generation machine learning systems for corporate I.T. automation, anomaly detection for security, user and   show more ...  

entity behavior analytics, risk management, etc. Prior to joining Snowflake, Boyu held […] La entrada The Power Trio: UEBA, Cloud, and ML for Unusual Security Behaviors – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Artificial Intelligence & Machine Learning , General Data Protection Regulation (GDPR) , Next-Generation Technologies & Secure Development City of Trento Must Pay Regulators 50,000 Euros Akshaya Asokan (asokan_akshaya) • January 30, 2024     The city of   show more ...  

Trento, Italy must pay a fine of 50,000 euros for privacy violations in […] La entrada Italian Data Regulator Slams EU-Funded AI Projects – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Know

Source: www.govinfosecurity.com – Author: 1 Cloud Security , Security Operations Rule Is a Bid to Deter Malicious Foreign Use of US IaaS Providers Chris Riotta (@chrisriotta) • January 30, 2024     The U.S. Department of Commerce is moving forward with regulations for a “know your customer”   show more ...  

program for IaaS providers. (Image: Shutterstock) Cloud providers […] La entrada US IaaS Providers Face ‘Know Your Customer’ Regulation – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Artificial Intelligence

Source: www.securityweek.com – Author: Associated Press Italian regulators told OpenAI that its ChatGPT artificial intelligence chatbot has violated GDPR. The post ChatGPT Violated European Privacy Laws, Italy Tells Chatbot Maker OpenAI appeared first on SecurityWeek. Original Post URL: https://www.securityweek.   show more ...  

com/chatgpt-violated-european-privacy-laws-italy-tells-chatbot-maker-openai/ Category & Tags: Artificial Intelligence,Privacy & Compliance – Artificial Intelligence,Privacy & Compliance La entrada ChatGPT Violated European Privacy Laws, Italy Tells Chatbot Maker OpenAI – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Kevin Townsend Anyone who believes ransomware will go away doesn’t understand the nature of criminality. Extortion has and always will be a primary criminal business plan. The post The Ransomware Threat in 2024 is Growing: Report appeared first on SecurityWeek. Original   show more ...  

Post URL: https://www.securityweek.com/the-ransomware-threat-in-2024-is-growing-report/ Category & Tags: Ransomware,Threat Intelligence,ransomware – Ransomware,Threat […] La entrada The Ransomware Threat in 2024 is Growing: Report – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Ionut Arghire A massive database containing the information of 85% of the Indian population has emerged on the dark web. The post Data of 750 Million Indian Mobile Subscribers Sold on Hacker Forums appeared first on SecurityWeek. Original Post URL: https://www.securityweek.   show more ...  

com/data-of-750-million-indian-mobile-subscribers-sold-on-hacker-forums/ Category & Tags: Cybercrime – Cybercrime La entrada Data of 750 Million Indian Mobile Subscribers Sold on Hacker Forums – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Tara Seals, Managing Editor, News, Dark Reading 2 Min Read Source: Peter Etchells via Alamy Stock Photo Attackers are using a pair of critical zero-day vulnerabilities in Ivanti VPNs to deploy a Rust-based set of backdoors, which in turn download a backdoor malware dubbed   show more ...  

“KrustyLoader.” The two bugs were disclosed earlier […] La entrada Ivanti Zero-Day Patches Delayed as ‘KrustyLoader’ Attacks Mount – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CACTUS

Source: www.darkreading.com – Author: Nate Nelson, Contributing Writer Source: Nate Hovee via Shutterstock Schneider Electric has fallen victim to a cyberattack affecting its Sustainability Business division, and reports thus far have attributed it to a rising ransomware operation called “Cactus.”   show more ...  

Schneider Electric is a world leader in industrial manufacturing, be it equipment for industrial automation […] La entrada ‘Cactus’ Ransomware Strikes Schneider Electric – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Apple

Source: www.darkreading.com – Author: Dark Reading Staff Source: GK Images via Alamy Stock Photo In an effort to comply with the European Union’s Digital Markets Act (DMA), Apple is making changes to iOS, Safari, and the App Store that would open up its walled garden to support third-party app stores (and   show more ...  

apps) and non-Apple payment […] La entrada Apple Warns iPhone Sideloading Changes Will Increase Cyber Threats – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: PRESS RELEASE HERNDON, Va.–(BUSINESS WIRE)– Forcepoint Federal announced today that it has rebranded as Everfox to reflect its next chapter as a trailblazer in developing and delivering defense-grade cybersecurity technology. Under the new name and brand   show more ...  

identity, Everfox will build on Forcepoint Federal’s 25-year heritage of innovation and unwavering dedication to […] La entrada Forcepoint Federal Rebrands As Everfox to Reflect New Era of Defense-Grade Cybersecurity – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cohesity

Source: www.darkreading.com – Author: PRESS RELEASE SAN JOSE, Calif. – January 30, 2024 – Research commissioned by Cohesity, a leader in AI-powered data security and management, reveals today’s pervasive cyberattacks are forcing the majority of companies to pay ransoms and break their ‘do not pay’   show more ...  

policies, with data recovery deficiencies compounding the problem. The research polled from […] La entrada Cohesity Research Reveals Most Companies Pay Millions in Ransoms – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer 3 Min Read Source: Weitwinkel via Shutterstock The US government, in collaboration with private sector stakeholders, has been quietly working to disrupt the attack infrastructure of “Volt Typhoon,” a dangerous China-linked threat   show more ...  

group associated with numerous attacks targeted at US critical infrastructure since at least mid-2021. Reuters, […] La entrada Feds Reportedly Try to Disrupt ‘Volt Typhoon’ Attack Infrastructure – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 APT (Targeted attacks)

Source: securelist.com – Author: Evgeny Goncharov Kaspersky Security Bulletin We do not expect rapid changes in the industrial cyberthreat landscape in 2024. Most of the below-described trends have been observed before, many for some years. However, some of them have reached a critical mass of creeping changes,   show more ...  

which could lead to a qualitative shift in […] La entrada ICS and OT threat predictions for 2024 – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Businesses

Source: thehackernews.com – Author: . Jan 31, 2024NewsroomCryptocurrency / Cybersecurity A financially motivated threat actor known as UNC4990 is leveraging weaponized USB devices as an initial infection vector to target organizations in Italy. Google-owned Mandiant said the attacks single out multiple   show more ...  

industries, including health, transportation, construction, and logistics. “UNC4990 operations generally involve widespread USB infection […] La entrada Italian Businesses Hit by Weaponized USBs Spreading Cryptojacking Malware – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CISOs

Source: thehackernews.com – Author: . The SEC isn’t giving SaaS a free pass. Applicable public companies, known as “registrants,” are now subject to cyber incident disclosure and cybersecurity readiness requirements for data stored in SaaS systems, along with the 3rd and 4th party apps   show more ...  

connected to them. The new cybersecurity mandates make no distinction between […] La entrada The SEC Won’t Let CISOs Be: Understanding New SaaS Cybersecurity Rules – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Jan 31, 2024NewsroomCyber Attack / Network Security A pair of recently disclosed zero-day flaws in Ivanti Connect Secure (ICS) virtual private network (VPN) devices have been exploited to deliver a Rust-based payload called KrustyLoader that’s used to drop the   show more ...  

open-source Sliver adversary simulation tool. The security vulnerabilities, tracked as CVE-2023-46805 […] La entrada Hackers Exploiting Ivanti VPN Flaws to Deploy KrustyLoader Malware – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-01
Aggregator history
Wednesday, January 31
MON
TUE
WED
THU
FRI
SAT
SUN
JanuaryFebruaryMarch