Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Glibc library vulner ...

 Business

On January 30, security researchers published information about a vulnerability they discovered in the glibc (GNU C Library), which could potentially allow attackers elevate their privileges on Linux systems to root level. The library provides system calls and basic system functions – including syslog and vsyslog,   show more ...  

which are used to write messages to the system message log. The vulnerability has received the identifier CVE-2023-6246, and a score of 8.4 on the CVSS v3.1 scale. Despite the fact that the level of this threat is not critical – its just high – theres a high probability of its exploitation in large-scale attacks since glibc is the main system library thats used by almost all Linux programs. Which systems are affected by CVE-2023-6246? The Qualys researchers who discovered the vulnerability tested a number of popular Linux-based system installations, and identified several vulnerable systems: Debian 12 and 13, Ubuntu 23.04 and 23.10, and Fedora Linux versions 37 through 39. However, experts add that other distributions are probably also affected by this vulnerability. CVE-2023-6246 is present in the library version 2.36 and older. The glibc developers fixed the vulnerability in version 2.39 on January 31 – a day after information about it was published. What is the CVE-2023-6246 vulnerability and where did it come from? The vulnerability CVE-2023-6246 is related to a dynamic memory buffer overflow and belongs to the LPE (Local Privilege Escalation) class. In simple terms, an attacker who already has user access to a system can use vulnerable function calls to escalate their privileges to the super-user level. This vulnerability was first added to the library in version 2.37, in August 2022, in an attempt to close the less dangerous vulnerability CVE-2022-39046. Subsequently, the library developers made the same change in version 2.36. How to stay safe? First you need to update the glibc library to version 2.39. Since attackers must already have access to the system to exploit this vulnerability (and all LPE vulnerabilities in general), CVE-2023-6246 will most likely be exploited in complex multi-stage attacks. Therefore, we recommend using solutions that can protect Linux as well. For example, our Kaspersky Endpoint Security solution includes the Kaspersky Endpoint Security for Linux application, which combats modern threats to Linux-based systems.

image for Transatlantic Cable ...

 News

Episode 332 of the Kaspersky Transatlantic Cable podcast kicks off with news that, after the recent AI generated sketch, George Carlins estate has decided to pursue legal matters against the creators.  From there, discussion turns to Mozillas worry about Apples new browser rules and British law makers question the   show more ...  

legality of live facial recognition. To wrap up, the team discuss news around the recent 23andMe data breach.  If you like what you heard, please consider subscribing. George Carlins Family Takes This AI Bullsh*t to Court Mozilla says Apples new browser rules are as painful as possible for Firefox British lawmakers question legality of live facial recognition technology 23andMe data breach: Hackers stole raw genotype data, health reports

image for Arrests in $400M SIM ...

 A Little Sunshine

Three Americans were charged this week with stealing more than $400 million in a November 2022 SIM-swapping attack. The U.S. government did not name the victim organization, but there is every indication that the money was stolen from the now-defunct cryptocurrency exchange FTX, which had just filed for bankruptcy on   show more ...  

that same day. A graphic illustrating the flow of more than $400 million in cryptocurrencies stolen from FTX on Nov. 11-12, 2022. Image: Elliptic.co. An indictment unsealed this week and first reported on by Ars Technica alleges that Chicago man Robert Powell, a.k.a. “R,” “R$” and “ElSwapo1,” was the ringleader of a SIM-swapping group called the “Powell SIM Swapping Crew.” Colorado resident Emily “Em” Hernandez allegedly helped the group gain access to victim devices in service of SIM-swapping attacks between March 2021 and April 2023. Indiana resident Carter Rohn, a.k.a. “Carti,” and “Punslayer,” allegedly assisted in compromising devices. In a SIM-swapping attack, the crooks transfer the target’s phone number to a device they control, allowing them to intercept any text messages or phone calls sent to the victim, including one-time passcodes for authentication or password reset links sent via SMS. The indictment states that the perpetrators in this heist stole the $400 million in cryptocurrencies on Nov. 11, 2022 after they SIM-swapped an AT&T customer by impersonating them at a retail store using a fake ID. However, the document refers to the victim in this case only by the name “Victim 1.” Wired’s Andy Greenberg recently wrote about FTX’s all-night race to stop a $1 billion crypto heist that occurred on the evening of November 11: “FTX’s staff had already endured one of the worst days in the company’s short life. What had recently been one of the world’s top cryptocurrency exchanges, valued at $32 billion only 10 months earlier, had just declared bankruptcy. Executives had, after an extended struggle, persuaded the company’s CEO, Sam Bankman-Fried, to hand over the reins to John Ray III, a new chief executive now tasked with shepherding the company through a nightmarish thicket of debts, many of which it seemed to have no means to pay.” “FTX had, it seemed, hit rock bottom. Until someone—a thief or thieves who have yet to be identified—chose that particular moment to make things far worse. That Friday evening, exhausted FTX staffers began to see mysterious outflows of the company’s cryptocurrency, publicly captured on the Etherscan website that tracks the Ethereum blockchain, representing hundreds of millions of dollars worth of crypto being stolen in real time.” The indictment says the $400 million was stolen over several hours between November 11 and 12, 2022. Tom Robinson, co-founder of the blockchain intelligence firm Elliptic, said the attackers in the FTX heist began to drain FTX wallets on the evening of Nov. 11, 2022 local time, and continuing until the 12th of November. Robinson said Elliptic is not aware of any other crypto heists of that magnitude occurring on that date. “We put the value of the cryptoassets stolen at $477 million,” Robinson said. “The FTX administrators have reported overall losses due to “unauthorized third-party transfers” of $413 million – the discrepancy is likely due to subsequent seizure and return of some of the stolen assets. Either way, it’s certainly over $400 million, and we are not aware of any other thefts from crypto exchanges on this scale, on this date.” The SIM-swappers allegedly responsible for the $400 million crypto theft are all U.S. residents. But there are some indications they had help from organized cybercriminals based in Russia. In October 2023, Elliptic released a report that found the money stolen from FTX had been laundered through exchanges with ties to criminal groups based in Russia. “A Russia-linked actor seems a stronger possibility,” Elliptic wrote. “Of the stolen assets that can be traced through ChipMixer, significant amounts are combined with funds from Russia-linked criminal groups, including ransomware gangs and darknet markets, before being sent to exchanges. This points to the involvement of a broker or other intermediary with a nexus in Russia.” Nick Bax, director of analytics at the cryptocurrency wallet recovery firm Unciphered, said the flow of stolen FTX funds looks more like what his team has seen from groups based in Eastern Europe and Russian than anything they’ve witnessed from US-based SIM-swappers. “I was a bit surprised by this development but it seems to be consistent with reports from CISA [the Cybersecurity and Infrastructure Security Agency] and others that “Scattered Spider” has worked with [ransomware] groups like ALPHV/BlackCat,” Bax said. CISA’s alert on Scattered Spider says they are a cybercriminal group that targets large companies and their contracted information technology (IT) help desks. “Scattered Spider threat actors, per trusted third parties, have typically engaged in data theft for extortion and have also been known to utilize BlackCat/ALPHV ransomware alongside their usual TTPs,” CISA said, referring to the group’s signature “Tactics, Techniques an Procedures.” Nick Bax, posting on Twitter/X in Nov 2022 about his research on the $400 million FTX heist. Earlier this week, KrebsOnSecurity published a story noting that a Florida man recently charged with being part of a SIM-swapping conspiracy is thought to be a key member of Scattered Spider, a hacking group also known as 0ktapus. That group has been blamed for a string of cyber intrusions at major U.S. technology companies during the summer of 2022. Financial claims involving FTX’s bankruptcy proceedings are being handled by the financial and risk consulting giant Kroll. In August 2023, Kroll suffered its own breach after a Kroll employee was SIM-swapped. According to Kroll, the thieves stole user information for multiple cryptocurrency platforms that rely on Kroll services to handle bankruptcy proceedings. KrebsOnSecurity sought comment for this story from Kroll, the FBI, the prosecuting attorneys, and Sullivan & Cromwell, the law firm handling the FTX bankruptcy. This story will be updated in the event any of them respond. Attorneys for Mr. Powell said they do not know who Victim 1 is in the indictment, as the government hasn’t shared that information yet. Powell’s next court date is a detention hearing on Feb. 2, 2024.

 Identity Theft, Fraud, Scams

TA576, a cybercriminal threat actor, has returned with tax-themed lures targeting accounting and finance organizations during the U.S. tax season, using unique attack chains and delivering Parallax RAT.

 Malware and Vulnerabilities

FortiGuard Labs exposed a fresh attack vector involving the FAUST ransomware, a Phobos variant. The attackers employed a Visual Basic script in an Office document to propagate FAUST. They utilized the Gitea service to store encoded files. The ransomware employs advanced evasion tactics, adds persistence, and carries an exclusion list. 

 Trends, Reports, Analysis

The expanding supply chain vulnerabilities and digital transformation are increasing the risk of data breaches in 2024. Threat actors may target rare earth material supply chains and leverage small-scale data manipulation for major impact.

 Incident Response, Learnings

The lawsuit from the New York Attorney General claims that the bank lacks sufficient security measures to prevent unauthorized transfers and fails to respond effectively when red flags are raised.

 Malware and Vulnerabilities

The threat actors behind the Nitrogen campaign prefer hosting their payloads on compromised WordPress sites and have a known connection to ransomware, making it a serious threat to businesses.

 Laws, Policy, Regulations

The proposed regulation would impose compliance costs on IaaS providers, including data retention and record-keeping requirements, potentially costing up to $170 million annually for affected companies.

 Incident Response, Learnings

While the financial impact on Progress Software from the MOVEit zero-day vulnerability has been minimal so far, the firm is still dealing with 118 class-action lawsuits and formal government investigations, including subpoenas from the SEC and FTC.

 Malware and Vulnerabilities

The ransomware, named "grinchv3," self-copies itself to the startup folder for persistence, encrypts user data using the Fernet symmetric key encryption algorithm, and adds a pop-up message after encryption.

 Companies to Watch

Incognia, a San Jose-based company specializing in location identity solutions, has raised $31M in Series B funding led by Bessemer Venture Partners, with participation from FJ Labs and existing investors.

 Companies to Watch

The acquisition will enable organizations to benefit from Laiyer AI's LLM Guard software, which detects, redacts, and sanitizes inputs and outputs from LLMs with lower latency, while also supporting open source contributions.

 Expert Blogs and Opinion

The new system introduces changes such as splitting attack complexity into two parameters and categorizing user interaction into three levels, offering a more nuanced and comprehensive assessment of vulnerabilities.

 Feed

Ubuntu Security Notice 6620-1 - It was discovered that the GNU C Library incorrectly handled the syslog function call. A local attacker could use this issue to execute arbitrary code and possibly escalate privileges.

 Feed

Ubuntu Security Notice 6619-1 - Rory McNamara discovered that runC did not properly manage internal file descriptor while managing containers. An attacker could possibly use this issue to obtain sensitive information or bypass container restrictions.

 Feed

Ubuntu Security Notice 6587-4 - USN-6587-1 fixed vulnerabilities in X.Org X Server. The fix was incomplete resulting in a possible regression. This update fixes the problem. Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs.   show more ...  

An attacker could possibly use this issue to cause the X Server to crash, obtain sensitive information, or execute arbitrary code.

 Feed

Red Hat Security Advisory 2024-0619-03 - An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Issues addressed include bypass, out of bounds write, and privilege escalation vulnerabilities.

 Feed

Red Hat Security Advisory 2024-0618-03 - An update for firefox is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Issues addressed include bypass, out of bounds write, and privilege escalation vulnerabilities.

 Feed

Red Hat Security Advisory 2024-0617-03 - An update for tigervnc is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Issues addressed include a buffer overflow vulnerability.

 Feed

Red Hat Security Advisory 2024-0489-03 - Red Hat OpenShift Container Platform release 4.12.48 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.

 Feed

Red Hat Security Advisory 2024-0485-03 - Red Hat OpenShift Container Platform release 4.12.48 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a cross site scripting vulnerability.

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting iOS, iPadOS, macOS, tvOS, and watchOS to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability, tracked as CVE-2022-48618 (CVSS score: 7.8), concerns a bug in the kernel component. "An attacker with

 Feed

Google-owned Mandiant said it identified new malware employed by a China-nexus espionage threat actor known as UNC5221 and other threat groups during post-exploitation activity targeting Ivanti Connect Secure VPN and Policy Secure devices. This includes custom web shells such as BUSHWALK, CHAINLINE, FRAMESTING, and a variant of LIGHTWIRE. "CHAINLINE is a Python web shell backdoor that is

 Feed

Exposed Docker API endpoints over the internet are under assault from a sophisticated cryptojacking campaign called Commando Cat. "The campaign deploys a benign container generated using the Commando project," Cado security researchers Nate Bill and Matt Muir said in a new report published today. "The attacker escapes this container and runs multiple payloads on the

 Feed

The U.S. government on Wednesday said it took steps to neutralize a botnet comprising hundreds of U.S.-based small office and home office (SOHO) routers hijacked by a China-linked state-sponsored threat actor called Volt Typhoon and blunt the impact posed by the hacking campaign. The existence of the botnet, dubbed KV-botnet, was first disclosed by the Black Lotus Labs team at

 Feed

How’s your vulnerability management program doing? Is it effective? A success? Let’s be honest, without the right metrics or analytics, how can you tell how well you’re doing, progressing, or if you’re getting ROI? If you’re not measuring, how do you know it’s working? And even if you are measuring, faulty reporting or focusing on the wrong metrics can create blind spots and make it harder to

 Feed

Cybersecurity researchers have detailed an updated version of the malware HeadCrab that's known to target Redis database servers across the world since early September 2021. The development, which comes exactly a year after the malware was first publicly disclosed by Aqua, is a sign that the financially-motivated threat actor behind the campaign is actively adapting and

 Feed

The threat actor behind a peer-to-peer (P2P) botnet known as FritzFrog has made a return with a new variant that leverages the Log4Shell vulnerability to propagate internally within an already compromised network. "The vulnerability is exploited in a brute-force manner that attempts to target as many vulnerable Java applications as possible," web infrastructure and security

 iOS

The iPhone security setting that you should enable right now, the worrying way that AI is predicting what criminals look like, and we play a game of face fake or real... All this and much more is discussed in the latest edition of the award-winning "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by Mark Stockley.

 2024

Source: www.cybertalk.org – Author: slandau EXECUTIVE SUMMARY: Cyber criminals are weaponizing advanced tactics, including intricate social engineering campaigns, to carry out malicious activities. Last year, social engineering attempts rose by 464%. Often a result of social engineering attempts, ransomware   show more ...  

attacks have reportedly increased by 90%. Amidst this unsettling attack landscape, it can be difficult and […] La entrada The all-star AI-powered, cloud-delivered security platform you need – Source: www.cybertalk.org se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.lastwatchdog.com – Author: bacohido San Francisco, Calif., Jan. 31, 2024 – Reken, an AI & cybersecurity company, today announced the close of its $10M oversubscribed seed round, led by Greycroft and FPV Ventures. Other investors in the round include Firebolt Ventures, Fika Ventures, Omega   show more ...  

Venture Partners, Homebrew, and JAZZ Venture Partners. The funding will […] La entrada News alert: Reken raises $10M from Greycroft to protect against generative AI-enabled fraud – Source: www.lastwatchdog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.lastwatchdog.com – Author: bacohido By Byron V. Acohido There’s no denying that castle walls play a prominent role in the histories of both military defense, going back thousands of years, and — as of the start of the current millennia — in cybersecurity. Related: How Putin has weaponized   show more ...  

ransomware In his new Polity Press […] La entrada Author Q&A: The ongoing role of fortified structures in military clashes — and cybersecurity – Source: www.lastwatchdog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 Pawn Storm, an advanced persistent threat (APT) actor also known as APT28, has been targeting high-value entities globally, employing a range of techniques since at least 2004.  Despite relying on seemingly outdated methods like decade-old phishing campaigns,   show more ...  

the group continues to compromise thousands of email accounts.  According to an advisory […] La entrada Pawn Storm’s Stealthy Net-NTLMv2 Assault Revealed – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 The EU has adopted its first Cybersecurity Certification scheme as part of efforts to boost cybersecurity of IT products and services across member states. The European Cybersecurity Scheme on Common Criteria (EUCC) was drafted by the European Union Agency for   show more ...  

Cybersecurity (ENISA) in coordination with member states. The voluntary scheme, […] La entrada EU Launches First Cybersecurity Certification for Digital Products – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 A new bipartisan bill proposed by two US Senators looks to bolster the cybersecurity of the food and agriculture sector. If successful, the bill will lead to the Farm and Food Cybersecurity Act. The bill aims to identify cybersecurity vulnerabilities in the   show more ...  

agriculture sector, boost the cyber defenses of private […] La entrada US Senators Propose Cybersecurity Agriculture Bill – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 A substantial 91% of runtime scans are failing within organizations, signaling a significant reliance on identifying issues rather than preventing them, according to Sysdig’s latest report. The new research also revealed that 69% of enterprises have yet to   show more ...  

integrate artificial intelligence (AI) into their cloud environments. Even among the companies […] La entrada Sysdig Report Exposes 91% Failure in Runtime Scans – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 The US government has announced sanctions against two Egyptian IT experts for providing cybersecurity support and training to the terrorist organization ISIS. The Egyptian nationals also enabled ISIS to use cryptocurrency and assisted the group’s online   show more ...  

recruitment and propaganda efforts. One of the individuals identified by the US Department of […] La entrada US Sanctions Egyptian IT Experts Aiding ISIS in Cybersecurity – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Citibank

Source: www.infosecurity-magazine.com – Author: 1 New York’s attorney general, Letitia James, yesterday launched legal action against one of America’s biggest banks for allegedly failing to adequately protect and reimburse customers who fell victim to online fraud. She argued that Citibank should pay back   show more ...  

the “millions” that New Yorkers are alleged to have lost, with interest, as well […] La entrada Citibank Sued For Failing to Protect Fraud Victims – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 cyber

Source: www.infosecurity-magazine.com – Author: 1 Two of the UK’s leading accounting and security bodies are teaming up with others to launch a new taskforce today designed to help organizations improve the security of their corporate finance deals. The initiative is led by the Institute of Chartered   show more ...  

Accountants in England and Wales (ICAEW) in collaboration with […] La entrada City Cyber Taskforce Launches to Secure Corporate Finance – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Banking

Source: www.schneier.com – Author: Bruce Schneier In October, the Consumer Financial Protection Bureau (CFPB) proposed a set of rules that if implemented would transform how financial institutions handle personal data about their customers. The rules put control of that data back in the hands of ordinary   show more ...  

Americans, while at the same time undermining the data […] La entrada CFPB’s Proposed Data Rules – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: PRESS RELEASE TEL AVIV, Israel–(BUSINESS WIRE)–Aim Security, an Israeli cybersecurity startup offering enterprises a holistic, one-stop shop GenAI security platform, today announced $10 million in seed funding. The round was led by YL Ventures, with   show more ...  

participation from CCL (Cyber Club London), the founders of WIZ and angel investors from Google, Proofpoint […] La entrada Aim Security Raises $10M to Secure Generative AI Enterprise Adoption – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: PRESS RELEASE Woburn, MA – January 31, 2024 — Kaspersky today releases its Industrial Control Systems Cyber Emergency Response Team (ICS CERT) predictions for 2024, outlining the key cybersecurity challenges facing industrial enterprises in the year ahead. The   show more ...  

predictions highlight the persistence of ransomware threats, the rise of cosmopolitical hacktivism, an outlook […] La entrada Kasperskys ICS CERT Predictions for 2024: Ransomware Rampage, Cosmopolitical Hacktivism, and Beyond – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: PRESS RELEASE San Jose, CA – Jan 31, 2024, at 10:00 am ET – Today, Incognia, the innovator in location identity solutions, is announcing it has closed $31MM in Series B funding led by Bessemer Venture Partners, with participation from FJ Labs and existing   show more ...  

investors, including Point72, Prosus, and Valor Capital. The financing will […] La entrada Incognia Secures $31M to Meet Demand for Proactive Approach to Fraud Prevention – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Becky Bracken, Editor, Dark Reading Source: Mykola Lytvynenko via Alamy Stock Photo The cybersecurity community is getting duped by fake breach claims from ransomware groups, experts say — and ransomware misinformation is a threat they predict will only grow in the coming   show more ...  

months. The cybersecurity community should know that cybercriminals aren’t […] La entrada Ransomware Groups Gain Clout With False Attack Claims – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 county

Source: www.darkreading.com – Author: Kristina Beek, Associate Editor, Dark Reading 1 Min Read Source: Allen Creative / Steve Allen via Alamy Stock Photo As Fulton County in Georgia continues to experience a cyberattack and a power outage, government systems are offline, and it’s unknown when   show more ...  

they’ll become operational again. Court filings, tax processing, and other […] La entrada Fulton County Suffers Power Outages as Cyberattack Continues – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer Source: Jack Sullivan via Alamy Stock Photo Researchers have uncovered a set of four vulnerabilities in container engine components that they dubbed “Leaky Vessels,” three of which give attackers a way to break out of containers   show more ...  

and execute malicious actions on the underlying host system. One of […] La entrada ‘Leaky Vessels’ Cloud Bugs Allow Container Escapes Globally – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Controls

Source: www.darkreading.com – Author: Tara Seals, Managing Editor, News, Dark Reading 1 Min Read Source: Chroma Craft Media Group via Alamy Stock Photo Johnson Controls International (JCI) spent $27 million remediating a September 2023 ransomware attack on its systems — an attack that government officials   show more ...  

warned at the time could threaten physical security. According to […] La entrada Johnson Controls Ransomware Cleanup Costs Top $27M and Counting – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Tara Seals, Managing Editor, News, Dark Reading Source: imageBROKER via Alamy Stock Photo Ivanti has finally begun patching a pair of zero-day security vulnerabilities disclosed on Jan. 10 in its Connect Secure VPN appliances. However, it also announced two additional bugs   show more ...  

today in the platform, CVE-2024-21888 and CVE-2024-21893 — the latter […] La entrada More Ivanti VPN Zero-Days Fuel Attack Frenzy as Patches Finally Roll – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 credentials

Source: www.darkreading.com – Author: Alicia Buller, Contributing Writer Source: Brian Jackson via Alamy Stock Photo Hundreds of network operator credentials stolen via compromised RIPE accounts were recently discovered on the Dark Web. RIPE, the database for IP addresses and their owners for every country in   show more ...  

the Middle East as well as some in Europe and […] La entrada Looted RIPE Credentials for Sale on the Dark Web – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Access Management

Source: heimdalsecurity.com – Author: Cristian Neagu The Importance of Choosing the Right Privilege Identity Management Solution The essence of effective Privileged Identity Management (PIM) lies not in identity or management but in privilege. A robust PIM system focuses on identifying those who should, and   show more ...  

equally importantly, those who should not, have administrative access to important […] La entrada 10 Best Privileged Identity Management Tools (2024) – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: heimdalsecurity.com – Author: Livia Gyongyoși Cactus Ransomware claims responsibility for the January 17th Schneider Electric data breach. Schneider Electric confirms hackers got access to their Resource Advisor cloud platform. The French-based energy giant says the attack only hit their Sustainability   show more ...  

Business division. The platform holds data belonging to more than 2000 companies worldwide. For […] La entrada Cactus Ransomware behind Schneider Electric Data Breach – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Feb 01, 2024NewsroomCryptocurrency / Botnet Cybersecurity researchers have detailed an updated version of the malware HeadCrab that’s known to target Redis database servers across the world since early September 2021. The development, which comes exactly a year   show more ...  

after the malware was first publicly disclosed by Aqua, is a sign that […] La entrada HeadCrab 2.0 Goes Fileless, Targeting Redis Servers for Crypto Mining – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . How’s your vulnerability management program doing? Is it effective? A success? Let’s be honest, without the right metrics or analytics, how can you tell how well you’re doing, progressing, or if you’re getting ROI? If you’re not measuring, how   show more ...  

do you know it’s working? And even if you are measuring, […] La entrada Why the Right Metrics Matter When it Comes to Vulnerability Management – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Feb 01, 2024NewsroomNetwork Security / Malware Google-owned Mandiant said it identified new malware employed by a China-nexus espionage threat actor known as UNC5221 and other threat groups during post-exploitation activity targeting Ivanti Connect Secure VPN and   show more ...  

Policy Secure devices. This includes custom web shells such as BUSHWALK, CHAINLINE, FRAMESTING, and […] La entrada Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Active

Source: thehackernews.com – Author: . Feb 01, 2024NewsroomVulnerability / Software Update The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting iOS, iPadOS, macOS, tvOS, and watchOS to its Known Exploited Vulnerabilities (KEV) catalog, based on   show more ...  

evidence of active exploitation. The vulnerability, tracked as CVE-2022-48618 (CVSS score: 7.8), concerns a […] La entrada CISA Warns of Active Exploitation of Critical Flaws in Apple iOS and macOS – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-02
Aggregator history
Thursday, February 01
THU
FRI
SAT
SUN
MON
TUE
WED
FebruaryMarchApril