Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for What kind of educati ...

 Business

The labor market has long experienced a shortage of cybersecurity experts. Often, companies in need of information-security specialists cant find any – at least, those with specialized formal education and the necessary experience. In order to understand how important it is for a company to have specialists with a   show more ...  

formal education in this area, and how well such education meets modern needs, our colleagues conducted a study in which they interviewed more than a thousand employees from 29 countries in different regions of the world. Among the respondents were specialists of various levels: from beginners with two years of experience, to CIOs and SOC managers with 10. And judging by the respondents answers, it looks like classical education isnt keeping up with InfoSec trends. First and foremost, the survey showed that not all specialists have a higher education: more than half (53%) of InfoSec workers have no post-graduate education. But as to those with it, every second worker doubts that their formal education really helps them perform their job duties. Cybersecurity is a rapidly changing industry. The threat landscape is changing so fast that even a couple of months lag can be critical – while it can take four to five years to obtain an academic degree. During this time, attackers can modernize their tactics and methods in such a way that a graduate InfoSec specialist would have to quickly read all the latest articles about threats and defense methods in the event of an actual attack. InfoSec specialists with real life experience argue that educational institutions in any case dont provide enough practical knowledge – and dont have access to modern technologies and equipment. Thus, to work in the InfoSec field and to fight real cyberthreats, some additional education is required anyway. All this, of course, doesnt mean that cybersecurity professionals with higher education are less competent than their colleagues without it. Ultimately, passion and the ability to continually improve are of the utmost importance in professional development. Many respondents noted that they received more theoretical than practical knowledge in traditional educational institutions, but felt that formal education was still useful since, without a solid theoretical basis, absorption of new knowledge would progress more slowly. On the other hand, specialists who dont have post-graduate education at all, or who came to information security from another IT industry, can also become effective specialists in protecting against cyberthreats. It really does all depend on the individual. How to improve the labor market situation In order for the market to attract a sufficient number of information security experts, the situation needs to be balanced on both sides. First, it makes sense for universities to consider partnering with cybersecurity companies. This would allow them to provide students with more practically applicable knowledge. And second, its a good idea for companies to periodically increase the expertise of their employees with the help of specialized educational courses. You can read the part of the report devoted to InfoSec educational problems on the webpage of the first chapter Educational background of current cybersecurity experts.

image for Transatlantic Cable ...

 News

Episode 333 of the Transatlantic Cable Podcast dives into news that a site called OnlyFakes is offering deepfake photo ID – the team also stay on the AI bandwagon with the next story which talks about the recent furore around illicit AI generated Taylor Swift images. From there the team discuss two final stories,   show more ...  

the first around a virus that was released onto the Valhiem gaming Discord channels, causing havoc as it was spread. The final story looks at a recent Interpol campaign, dubbed Operation Synergia, which resulted in 31 arrests and over 1,300 C2 (command and control) servers being taken down. If you liked what you heard, please consider subscribing. Inside the Underground Site Where Neural Networks Churn Out Fake IDs Taylor Swift deepfakes spark calls in Congress for new legislation Valheim Discord servers locked after hacker releases virus Interpol operation Synergia takes down 1,300 servers used for cybercrime

image for From Cybercrime Saul ...

 A Little Sunshine

In 2021, the exclusive Russian cybercrime forum Mazafaka was hacked. The leaked user database shows one of the forum’s founders was an attorney who advised Russia’s top hackers on the legal risks of their work, and what to do if they got caught. A review of this user’s hacker identities shows that   show more ...  

during his time on the forums he served as an officer in the special forces of the GRU, the foreign military intelligence agency of the Russian Federation. Launched in 2001 under the tagline “Network terrorism,” Mazafaka would evolve into one of the most guarded Russian-language cybercrime communities. The forum’s member roster includes a Who’s Who of top Russian cybercriminals, and it featured sub-forums for a wide range of cybercrime specialities, including malware, spam, coding and identity theft. One representation of the leaked Mazafaka database. In almost any database leak, the first accounts listed are usually the administrators and early core members. But the Mazafaka user information posted online was not a database file per se, and it was clearly edited, redacted and restructured by whoever released it. As a result, it can be difficult to tell which members are the earliest users. The original Mazafaka is known to have been launched by a hacker using the nickname “Stalker.” However, the lowest numbered (non-admin) user ID in the Mazafaka database belongs to another individual who used the handle “Djamix,” and the email address djamix@mazafaka[.]ru. From the forum’s inception until around 2008, Djamix was one of its most active and eloquent contributors. Djamix told forum members he was a lawyer, and nearly all of his posts included legal analyses of various public cases involving hackers arrested and charged with cybercrimes in Russia and abroad. “Hiding with purely technical parameters will not help in a serious matter,” Djamix advised Maza members in September 2007. “In order to ESCAPE the law, you need to KNOW the law. This is the most important thing. Technical capabilities cannot overcome intelligence and cunning.” Stalker himself credited Djamix with keeping Mazafaka online for so many years. In a retrospective post published to Livejournal in 2014 titled, “Mazafaka, from conception to the present day,” Stalker said Djamix had become a core member of the community. “This guy is everywhere,” Stalker said of Djamix. “There’s not a thing on [Mazafaka] that he doesn’t take part in. For me, he is a stimulus-irritant and thanks to him, Maza is still alive. Our rallying force!” Djamix told other forum denizens he was a licensed attorney who could be hired for remote or in-person consultations, and his posts on Mazafaka and other Russian boards show several hackers facing legal jeopardy likely took him up on this offer. “I have the right to represent your interests in court,” Djamix said on the Russian-language cybercrime forum Verified in Jan. 2011. “Remotely (in the form of constant support and consultations), or in person – this is discussed separately. As well as the cost of my services.” WHO IS DJAMIX? A search on djamix@mazafaka[.]ru at DomainTools.com reveals this address has been used to register at least 10 domain names since 2008. Those include several websites about life in and around Sochi, Russia, the site of the 2014 Winter Olympics, as well as a nearby coastal town called Adler. All of those sites say they were registered to an Aleksei Safronov from Sochi who also lists Adler as a hometown. The breach tracking service Constella Intelligence finds that the phone number associated with those domains — +7.9676442212 — is tied to a Facebook account for an Aleksei Valerievich Safronov from Sochi. Mr. Safronov’s Facebook profile, which was last updated in October 2022, says his ICQ instant messenger number is 53765. This is the same ICQ number assigned to Djamix in the Mazafaka user database. The Facebook account for Aleksey Safronov. A “Djamix” account on the forum privetsochi[.]ru (“Hello Sochi”) says this user was born Oct. 2, 1970, and that his website is uposter[.]ru. This Russian language news site’s tagline is, “We Create Communication,” and it focuses heavily on news about Sochi, Adler, Russia and the war in Ukraine, with a strong pro-Kremlin bent. Safronov’s Facebook profile also gives his Skype username as “Djamixadler,” and it includes dozens of photos of him dressed in military fatigues along with a regiment of soldiers deploying in fairly remote areas of Russia. Some of those photos date back to 2008. In several of the images, we can see a patch on the arm of Safronov’s jacket that bears the logo of the Spetsnaz GRU, a special forces unit of the Russian military. According to a 2020 report from the Congressional Research Service, the GRU operates both as an intelligence agency — collecting human, cyber, and signals intelligence — and as a military organization responsible for battlefield reconnaissance and the operation of Russia’s Spetsnaz military commando units. Mr. Safronov posted this image of himself on Facebook in 2016. The insignia of the GRU can be seen on his sleeve. “In recent years, reports have linked the GRU to some of Russia’s most aggressive and public intelligence operations,” the CRS report explains. “Reportedly, the GRU played a key role in Russia’s occupation of Ukraine’s Crimea region and invasion of eastern Ukraine, the attempted assassination of former Russian intelligence officer Sergei Skripal in the United Kingdom, interference in the 2016 U.S. presidential elections, disinformation and propaganda operations, and some of the world’s most damaging cyberattacks.” According to the Russia-focused investigative news outlet Meduza, in 2014 the Russian Defense Ministry created its “information-operation troops” for action in “cyber-confrontations with potential adversaries.” “Later, sources in the Defense Ministry explained that these new troops were meant to ‘disrupt the potential adversary’s information networks,'” Meduza reported in 2018. “Recruiters reportedly went looking for ‘hackers who have had problems with the law.'” Mr. Safronov did not respond to multiple requests for comment. A 2018 treatise written by Aleksei Valerievich Safronov titled “One Hundred Years of GRU Military Intelligence” explains the significance of the bat in the seal of the GRU. “One way or another, the bat is an emblem that unites all active and retired intelligence officers; it is a symbol of unity and exclusivity,” Safronov wrote. “And, in general, it doesn’t matter who we’re talking about – a secret GRU agent somewhere in the army or a sniper in any of the special forces brigades. They all did and are doing one very important and responsible thing.” It’s unclear what role Mr. Safronov plays or played in the GRU, but it seems likely the military intelligence agency would have exploited his considerable technical skills, knowledge and connections on the Russian cybercrime forums. Searching on Safronov’s domain uposter[.]ru in Constella Intelligence reveals that this domain was used in 2022 to register an account at a popular Spanish-language discussion forum dedicated to helping applicants prepare for a career in the Guardia Civil, one of Spain’s two national police forces. Pivoting on that Russian IP in Constella shows three other accounts were created at the same Spanish user forum around the same date. Mark Rasch, a former cybercrime prosecutor for the U.S. Department of Justice, said there has always been a close relationship between the GRU and the Russian hacker community. Rasch noted that in the early 2000s, the GRU was soliciting hackers with the skills necessary to hack US banks in order to procure funds to help finance Russia’s war in Chechnya. “The guy is heavily hooked into the Russian cyber community, and that’s useful for intelligence services,” Rasch said. “He could have been infiltrating the community to monitor it for the GRU. Or he could just be a guy wearing a military uniform.”

image for Pakistan Super Leagu ...

 Firewall Daily

With the highly anticipated season nine of the Pakistan Super League (PSL) just around the corner, organizers and fans have been left in disarray following a cyberattack on PSL ticketing website, disrupting preparations for the upcoming tournament. Although the latest update indicates that the ticketing website   show more ...  

problem has been fixed, many users are still unable to access the website. Following the security incident, the authorities took to social media platform X, formerly known as Twitter, to announce the cyberattack on PSL ticketing website. There has been a cyberattack on the #HBLPSL9 ticketing website. Technical team of the ticketing partners are addressing the issue with efficiency. We anticipate a swift resolution and expect the website of the service provider to be operational again shortly,” read the tweet. Source: Twitter Cyberattack on PSL Ticketing Website Despite the latest update from authorities stating that the cyberattack on the PSL website has been resolved and fans can now pre-book tickets, users are still encountering an error message when attempting to access the website. The official website of the Pakistan Super League remains inaccessible, compounding the frustration of fans eager to secure their tickets for the upcoming matches. The impact of this malicious cyberattack on PSL Ticketing Website extends beyond mere inconvenience, with fans expressing their concerns and disappointment on social media platforms. One user tweeted, “Thank you for the update. It’s reassuring to hear that the technical team is swiftly addressing the cyberattack on the #HBLPSL9 ticketing website. We hope for a quick resolution and the website’s operational status to be restored soon.” Source: Twitter Another fan expressed optimism, tweeting, “May issue resolved soon Insha’Allah I will buy tickets… I can’t wait to see and enjoy the PSL live .” Source: Twitter However, amidst the optimism, there were also reports of users encountering difficulties with the ticketing process. One frustrated fan tweeted, “I have been trying to get a ticket for at least 3 hours but not getting OTP. Kindly resolve this issue……..” Source: Twitter Pakistan Super League: Season 9 The cyberattack on PSL ticketing website comes at a crucial juncture, with the ninth season of the premier T20 competition in Pakistan scheduled to commence on February 17. The opening match will feature a showdown between the defending champions Lahore Qalandars and the formidable Islamabad United at the iconic Gaddafi Stadium in Lahore. Throughout the group stage of the tournament, a total of 30 fixtures will be contested across four venues: Gaddafi Stadium (Lahore), National Bank Cricket Arena (Karachi), Multan Cricket Stadium (Multan), and Rawalpindi Cricket Stadium (Rawalpindi). As the tournament progresses, the playoffs will be staged at the National Bank Cricket Arena in Karachi. Qualifier 1 is scheduled for March 14, followed by Eliminator 1 on March 15. The culmination of the playoffs will witness the grand finale on March 18, where the top teams will battle for supremacy. Notably, Lahore Qalandars and Islamabad United stand as two of the most successful franchises in PSL history, each boasting two tournament victories. The competition also features formidable teams such as Peshawar Zalmi, Quetta Gladiators, Karachi Kings, and Multan Sultans, all vying for glory in what promises to be an exhilarating season of cricket. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Trends, Reports, Analysis

Financial services organizations, including mortgage industry firms, are vulnerable to cyberattacks due to the critical functions they perform, the funding they handle, and the sensitive information they manage.

 Malware and Vulnerabilities

Fortinet's FortiGuard Labs uncovers a Python-based info-stealer distributed via malicious Excel documents, showcasing cybercriminals' innovative tactics. Exploiting legacy Excel 4.0 macros, the attack scans devices for sensitive data, employing sophisticated evasion techniques for stealthy data exfiltration. For safety, users are advised to disable macros in Office documents.

 Innovation and Research

IBM researchers demonstrated a technique to intercept live conversations and replace keywords based on the context, allowing for the manipulation of information, financial fraud, and even real-time changes to news broadcasts and political speeches.

 Security Culture

The Post-Quantum Cryptography Alliance aims to drive the adoption of post-quantum cryptography to address security risks posed by quantum computing, with support from industry leaders like Google, IBM, Amazon Web Services, and Cisco.

 Govt., Critical Infrastructure

The GAO urged the White House to establish performance measures for federal cybersecurity initiatives, but the ONCD pushed back, citing the difficulty of developing outcome-oriented measures and estimating implementation costs.

 Malware and Vulnerabilities

Canon has patched critical buffer-overflow bugs in its printers that could allow attackers to remotely perform denial of service or execute arbitrary code, emphasizing the importance of promptly updating firmware.

 Security Products & Services

The framework has successfully identified vulnerabilities in C/C++ projects, including two in cJSON and libplist, which might have remained undiscovered without the use of large language models.

 Trends, Reports, Analysis

Companies are bracing for a significant increase in cyber threats in 2024, with 96% of respondents expecting the threat of cyberattacks to their industry to rise, and 71% predicting an increase of more than 50%, according to Cohesity.

 Trends, Reports, Analysis

Malware-as-a-Service (MaaS) infections and Ransomware-as-a-Service (RaaS) attacks were the predominant cybersecurity threats in the second half of 2023, posing a significant danger to organizations, according to a new Darktrace report.

 Incident Response, Learnings

The incident revealed data security failures and led to a corrective action plan, including a thorough security risk analysis and implementation of audit controls, to address vulnerabilities and improve patient information protection.

 Feed

fwknop implements an authorization scheme that requires only a single encrypted packet to communicate various pieces of information, including desired access through a Netfilter policy and/or specific commands to execute on the target system. The main application of this program is to protect services such as SSH with   show more ...  

an additional layer of security in order to make the exploitation of vulnerabilities much more difficult. The authorization server works by passively monitoring authorization packets via libpcap.

 Feed

Ubuntu Security Notice 6610-2 - USN-6610-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these   show more ...  

to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. Cornel Ionce discovered that Firefox did not properly manage memory when opening the print preview dialog. An attacker could potentially exploit this issue to cause a denial of service.

 Feed

Ubuntu Security Notice 6609-3 - Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network family support while creating a new netfilter table. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. It was discovered that the CIFS   show more ...  

network file system implementation in the Linux kernel did not properly validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial of service or possibly expose sensitive information.

 Feed

Ubuntu Security Notice 6623-1 - It was discovered that Django incorrectly handled certain inputs that uses intcomma template filter. An attacker could possibly use this issue to cause a denial of service.

 Feed

Red Hat Security Advisory 2024-0712-03 - An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 9. Issues addressed include a file overwrite vulnerability.

 Feed

Red Hat Security Advisory 2024-0711-03 - An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 8. Issues addressed include a file overwrite vulnerability.

 Feed

Red Hat Security Advisory 2024-0710-03 - An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 7. Issues addressed include a file overwrite vulnerability.

 Feed

Red Hat Security Advisory 2024-0702-03 - An update for gimp is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Issues addressed include buffer overflow and integer overflow vulnerabilities.

 Deepfake

A multinational company in Hong Kong was defrauded of a staggering $25.6 million (over ₹200 crore) in a sophisticated scam utilizing deepfake technology. According to reports, the employees of the company were deceived during a multi-person video conference, wherein all participants, except the victim, were   show more ...  

generated using deepfake technology. What Exactly Deepfake Scam Happened?  A finance department employee receives a seemingly innocuous message purportedly from the company’s UK-based chief financial officer (CFO). Little did they know, they were about to be ensnared in a web of deceit spun by tech-savvy fraudsters. According to reports from Business Insider, what followed was a meticulously orchestrated scheme that would leave the company reeling. In a twisted turn of events, the unsuspecting employee found themselves on a video call with what appeared to be the company’s top employees, including the alleged CFO. But here’s the kicker: all participants in the call were nothing more than expertly crafted deepfake personas, indistinguishable from the real deal. Financial Fallout: Millions Lost in a Blink of an Eye As the virtual meeting unfolded, the employee received a series of instructions that seemed legitimate at the time, leading to the transfer of a jaw-dropping HK$200 million (equivalent to $25.6 million) across 15 transactions to various Hong Kong bank accounts, as outlined in reports by BI. The ruse went undetected for a week until the deceived employee, sensing something awry, finally reached out to the company’s headquarters. The Hong Kong police, while tight-lipped about specific company and employee details, disclosed that the perpetrators had crafted deepfakes of meeting participants using readily available video and audio footage from the internet. What’s more astonishing is that the victimized employee failed to discern the artificial nature of the deepfakes during the video conference. As investigations unfold, the authorities are grappling with the daunting task of apprehending the culprits behind this audacious scheme. Thus far, no arrests have been made, highlighting the formidable challenges in combating such technologically advanced cybercrimes. Deepfake Technology: Insights from Expert The proliferation of deepfake technology poses a significant threat to various sectors, including finance, where it can facilitate fraud and corporate deception. Beyond financial institutions, the global spread of deepfake videos raises profound ethical and legal concerns regarding the manipulation of synthetic media. “Advanced AI enables the creation of deepfake videos and images by leveraging content from public social media profiles,” notes Aaron Bugal, Field CTO – Asia Pacific and Japan, Sophos. While privacy settings and limited sharing can mitigate exposure risks, they offer no guarantee against misuse. Bugal’s observation underscores the urgent need for organizations to fortify their cybersecurity defenses and educate employees on the perils of impersonation scams. “As a protective measure, digitally signed videos offer a means to verify content authenticity,” Bugal recommends. Analogous to certificates validating website security, digital signatures can safeguard against deepfake manipulation. Bugal emphasizes the necessity of this verification process, especially as deepfake technology evolves, potentially blurring the line between fabricated and authentic content. The impact of deepfake technology hits closer to home as Indian celebrities, including Katrina Kaif, and Rashmika Mandanna, have fallen prey to manipulative schemes. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Data Breach News

Verizon, one of the largest telecommunication giants in the United States, finds itself embroiled in yet another data breach saga, affecting approximately 63,000 of its employees. The Verizon data breach, which occurred in September 2023, remained undetected for three months, casting a shadow on the telecom   show more ...  

giant’s security measures. In a formal notice submitted to the Maine attorney general’s office, Verizon attributed the Verizon data breach to an insider threat, characterizing it as an “inadvertent disclosure” rather than a malicious act. Verizon Data Breach: What All Was Compromised?  The compromised Verizon data, akin to a treasure trove for potential phishing attacks, encompasses a wide array of sensitive information including names, addresses, Social Security numbers, gender, union affiliations, dates of birth, and compensation details. According to a sample letter addressed to the victims and filed with the Maine attorney general’s office, the Verizon data breach unfolded when a company employee illicitly accessed a file containing personal employee information, in clear violation of company policies. Despite the data breach being discovered on December 12, the telecom giant assured that there is currently no evidence of the compromised data being misused or disseminated beyond Verizon’s confines. Nevertheless, this data breach marks Verizon’s third data security incident within a year, stressing a disturbing trend in the company’s vulnerability to cyber threats. A Troubling Pattern: Verizon’s History of Breaches Earlier in January 2023, 7.5 million wireless customers fell victim to a breach when their data surfaced for sale on the Dark Web, with Verizon attributing the incident to a third-party provider. Before this, in May 2022, the personal information of Verizon employees, including full names, email addresses, corporate ID numbers, and phone numbers, was compromised in another breach. The data was disclosed to the press by a hacker who had obtained it. The specter of cybersecurity breaches has haunted Verizon for years, with a notable incident in 2017 when the personal data of 6 million customers was leaked online. The breach was attributed to a misconfigured security setting on a cloud server, resulting from human error. NICE Systems, an Israel-based company collaborating with Verizon for customer service operations, inadvertently exposed customer phone numbers, names, and some PIN codes, leading to widespread security concerns. This latest breach is particularly worrisome as it highlights the persistent challenges faced by telecom providers in safeguarding sensitive information. The telecom sector has increasingly become a prime target for cyberattacks, posing significant threats to both companies and consumers alike. In response to the data breach, Verizon has announced plans to review and enhance its technical controls to prevent similar incidents in the future. As cyber threats continue to evolve in complexity and frequency, it is imperative for organizations, especially those handling sensitive data, to prioritize security at every level to safeguard against potential breaches and protect the privacy and trust of their customers and employees alike. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Data Breach News

In response to a recent cyberattack on AnyDesk, a prominent provider of remote desktop software, has issued a comprehensive statement assuring users of their proactive measures and the safety of official software versions. Followed by the company’s public statement, released on February 2, 2024, this new update   show more ...  

outlines the steps taken to investigate and mitigate the incident, as well as their ongoing cooperation with relevant authorities. AnyDesk emphasizes that all versions of their software obtained from official sources are safe to use. However, as a precautionary measure, users are encouraged to update to the latest versions, specifically 7.0.15 and 8.0.8. The company highlights its commitment to transparency, integrity, and trust in its products, acknowledging the importance of maintaining user confidence amid cybersecurity challenges. “The forced password reset for our customer portal my.anydesk.com was done out of an abundance of caution. We have no evidence that any customer data has been exfiltrated. Again, we also have no evidence that any end-user devices have been affected by this incident,” reads the official press statement. Cyberattack on AnyDesk: An Overview The AnyDesk cyberattack was first indicated in mid-January when anomalies were detected in some of AnyDesk’s systems. A thorough security audit revealed evidence of compromised production systems, prompting the immediate activation of a remediation and response plan. “We immediately activated a remediation and response plan involving cyber security experts CrowdStrike. The remediation plan has concluded successfully,” reads the official statement. Was AnyDesk User Credentials Impacted? While AnyDesk does not believe user credentials were compromised, the company cannot rule out the theoretical possibility for a brief period. As a precaution, a forced password reset for all customers was implemented. AnyDesk provides insight into its system architecture, explaining that private keys, security tokens, and passwords are not stored, minimizing the risk of exploitation. The cyberattack on AnyDesk only affected two relay servers in Europe, excluding connections to specific customer portals and users in non-European regions. “Only two of these relay servers in Europe were affected by the incident. This means that connections to the customer portal “my.anydesk.com I” are explicitly not involved. Neither are customers in countries that connect via relay servers outside Europe (e.g. USA, Asia, Africa, Australia, South America) and outside the affected location zone of those two servers (i.e. Spain and Portugal). If your credentials were already saved in the client, i.e. you did not enter it manually, you were also not affected,” explained officials. Malware Spread and Software Integrity AnyDesk confirms that no malware was spread through their systems. A thorough review of their code revealed no malicious modifications, and there is no evidence of malicious code distribution to customers. The company reiterates that compromised versions of its software are not being distributed and advises users to download software only from official sources. To further enhance security measures, AnyDesk has revoked security-related certificates and is in the process of revoking code-signing certificates. AnyDesk’s Recommendations for Users Users are strongly encouraged to use the latest versions of AnyDesk (7.0.15 and 8.0.8) to ensure optimal security. AnyDesk emphasizes the importance of avoiding third-party sites for software downloads and recommends checking the version properties within the client for verification. In conclusion, AnyDesk remains dedicated to maintaining user trust and confidence while prioritizing the security and integrity of its products. The company’s swift response to the cyber incident highlights its commitment to user safety, transparency, and proactive cybersecurity measures. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Press Release

Join us on the 28th and 29th of February 2024 at the vibrant Innovation Hub, RIT University, Dubai Silicon Oasis for a groundbreaking event set to redefine the landscape of cybersecurity. In collaboration with Dubai Silicon Oasis, CyberOT Secure Summit is poised to illuminate and address the pivotal realms of IT   show more ...  

security on Day 1 and Operational Technology Security on Day 2.  Why Attend the CyberOT Secure Summit?  Day 1 – IT Security: Delve into the latest advancements, emerging threats, and robust solutions within the intricate realm of IT Security. Explore cutting-edge strategies, best practices, and real-world case studies shared by industry experts.  Day 2 – OT Security: Gain invaluable insights into Operational Technology Security and fortify your understanding of safeguarding critical infrastructure, industries, and utilities against evolving cyber threats.   Day 2 – CyberShield Innovation Hackathon invites students, individuals, and startups to compete for prizes by devising cutting-edge solutions to address evolving cybersecurity challenges. Call for Speakers: Share Your Expertise  Are you a thought leader, innovator, or expert in IT or OT security? Seize this opportunity to showcase your insights and be a part of our esteemed panel of speakers. Share your knowledge, experiences, and solutions shaping the future of cybersecurity.  Seeking Sponsors: Elevate Your Brand  Partner with us to amplify your brand’s visibility and reach a diverse audience of industry leaders, professionals, and decision-makers. Gain exclusive exposure through sponsorship opportunities tailored to align with your objectives.  Register Your Interest  Secure your spot at CyberOT Secure Summit 2024 and be at the forefront of revolutionizing cybersecurity. Register your interest now by visiting www.CyberOTS.com and be part of this transformative experience.  Register for Cybershield Innovation Hackathon  Whether you are an individual, student or a startup, you can register yourself for the Cybershield Innovation Hackathon to win interesting gadgets and cash prizes. Visit the link https://cyberots.com/hackathon/ to enroll yourself.   Don’t miss this unparalleled opportunity to network, learn, and shape the future of cybersecurity. Join us at the intersection of innovation and security.  For inquiries, partnership opportunities, or speaker submissions, contact us at Production@inoexglobal.com  For sponsorship related queries reach out to Danford@inoexglobal.com  For any other queries reach out to Info@inoexglobal.com  Secure your seats today by visiting our event website: https://cyberots.com/  Mark your calendars for the most anticipated cybersecurity event of 2024. Let’s secure the digital future together!  Stay Secure. Stay Ahead.

 Feed

Chinese state-backed hackers broke into a computer network that's used by the Dutch armed forces by targeting Fortinet FortiGate devices. "This [computer network] was used for unclassified research and development (R&D)," the Dutch Military Intelligence and Security Service (MIVD) said in a statement. "Because this system was self-contained, it did not lead to any damage to the

 Feed

JetBrains is alerting customers of a critical security flaw in its TeamCity On-Premises continuous integration and continuous deployment (CI/CD) software that could be exploited by threat actors to take over susceptible instances. The vulnerability, tracked as CVE-2024-23917, carries a CVSS rating of 9.8 out of 10, indicative of its severity. "The vulnerability may enable an unauthenticated

 Feed

2024 will be the year of the vCISO. An incredible 45% of MSPs and MSSPs are planning to start offering vCISO services in 2024. As an MSP/MSSP providing vCISO services, you own the organization’s cybersecurity infrastructure and strategy. But you also need to position yourself as a reliable decision-maker, navigating professional responsibilities, business needs and leadership

 Feed

A coalition of dozens of countries, including France, the U.K., and the U.S., along with tech companies such as Google, MDSec, Meta, and Microsoft, have signed a joint agreement to curb the abuse of commercial spyware to commit human rights abuses. The initiative, dubbed the Pall Mall Process, aims to tackle the proliferation and irresponsible use of commercial cyber intrusion tools by

 Feed

The maintainers of shim have released version 15.8 to address six security flaws, including a critical bug that could pave the way for remote code execution under specific circumstances. Tracked as CVE-2023-40547 (CVSS score: 9.8), the vulnerability could be exploited to achieve a Secure Boot bypass. Bill Demirkapi of the Microsoft Security Response Center (MSRC) has been&

 Feed

The threat actors behind the KV-botnet made "behavioral changes" to the malicious network as U.S. law enforcement began issuing commands to neutralize the activity. KV-botnet is the name given to a network of compromised small office and home office (SOHO) routers and firewall devices across the world, with one specific cluster acting as a covert data transfer system for other Chinese

 CISA's

Source: www.govinfosecurity.com – Author: 1 Government , Industry Specific US Joint Cyber Defense Collaborative Suffering From ‘Growing Pains,’ Experts Say Chris Riotta (@chrisriotta) • February 6, 2024     The U.S. federal government’s Joint Cyber Defense Collaborative hasn’t been   show more ...  

an unqualified success. (Image: Shutterstock) The U.S. Cybersecurity and Infrastructure Security Agency is failing to use […] La entrada CISA’s Flagship Cyber Collaborative Faces Growing Criticism – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Thank you for registering with ISMG Complete your profile and stay up to date Need help registering? Contact Support Original Post URL: https://www.govinfosecurity.com/webinars/live-webinar-protecting-your-cloud-assets-cis-benchmarks-cis-controls-w-5386 Category   show more ...  

& Tags: – La entrada Live Webinar | Protecting Your Cloud Assets with CIS Benchmarks & CIS Controls – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 In times of war, such as the Israel-Hamas war that began on Oct. 7, 2023, intelligence becomes even more important than it is in peacetime. Yet, cyber defenders often focus more on getting inside the adversary’s system to listen to their attack plans than they   show more ...  

do on using tabletop exercises […] La entrada How to Win a Cyberwar: Use a Combined Intelligence Strategy – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Banking

Source: www.govinfosecurity.com – Author: 1 Cybercrime , Finance & Banking , Fraud Management & Cybercrime Mispadu Trojan Is Compromising Windows Security, Posing Threat to Banking Systems Prajeet Nair (@prajeetspeaks) • February 6, 2024     Image: Shutterstock The novel variant of the banking   show more ...  

Trojan Mispadu is targeting Latin American countries, especially Mexico, by exploiting a […] La entrada New Banking Trojan Exploits Patched Windows SmartScreen Flaw – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.govinfosecurity.com – Author: 1 Bill Bernard VP, Security Strategy, Deepwatch Bill Bernard currently serves as Deepwatch’s VP, Security Strategy. He is a seasoned security expert with 20+ years of experience collaborating with customers to select and deploy the right security solutions for their   show more ...  

business. Bill has held various solutions architecture roles throughout his career […] La entrada Live Webinar | Utilizing SIEM and MDR for Maximum Protection – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 check

Source: www.govinfosecurity.com – Author: 1 Intrusion Prevention Systems (IPS) , Network Firewalls, Network Access Control , Security Operations Company Co-Founder Will Take Role as Executive Chairman After Appointing Successor Michael Novinson (MichaelNovinson) , David Perera (@daveperera) • February 6, 2024   show more ...  

    Gil Shwed, founder and CEO, Check Point Software Firewall maker Check Point Software […] La entrada Gil Shwed to Step Down as Check Point CEO – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Court

Source: www.govinfosecurity.com – Author: 1 Governance & Risk Management , Healthcare , Industry Specific Judge Denies Kochava’s Motion to Dismiss Agency’s Claim of Privacy Violations Marianne Kolbasuk McGee (HealthInfoSec) • February 6, 2024     Image: Kochava, FTC A federal judge has   show more ...  

denied Kochava’s latest attempt to ditch a Federal Trade Commission lawsuit that accuses […] La entrada Court: FTC Privacy Suit Against Data Broker Can Move Ahead – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 Malware-as-a-Service (MaaS) infections were the biggest threat to organizations in the second half of 2023, according to a new Darktrace report. The 2023 End of Year Threat Report highlighted the cross-functional adaption of many of the malware strains. This   show more ...  

includes malware loaders like remote access trojans (RATs) being combined with […] La entrada Malware-as-a-Service Now the Top Threat to Organizations – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 Nearly two million Brits may have had their identity stolen and used by fraudsters to open a financial account in 2023, according to FICO’s new Fraud, Identity and Digital Banking Report. The analytics firm found that 4.3% of respondents had their identity   show more ...  

abused in this way, which would equate to […] La entrada Safer Internet Day: Two Million Brits Victims of Financial Identity Fraud – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 A fake video showing US President Joe Biden inappropriately touching his adult granddaughter’s chest sparked calls for Meta to change its policy on deepfakes and manipulated content. The video clip, which is sometimes accompanied by a caption describing Biden   show more ...  

as a “pedophile,” started to circulate in May 2023 on Facebook […] La entrada Meta’s Oversight Board Urges a Policy Change After a Fake Biden Video – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cybertalk.org – Author: slandau By Akshai Joshi, Head of Industry and Partnerships, Centre for Cybersecurity, World Economic Forum. According to the World Economic Forum’s Global Risks Report 2024, cyber insecurity is a global risk over multiple time horizons, with risks including malware,   show more ...  

deepfakes and misinformation. Cyber inequity is growing, while an increase in digital […] La entrada Reflections on Davos 2024: The state of cyber security – Source: www.cybertalk.org se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 check

Source: www.darkreading.com – Author: Jeffrey Schwartz, Contributing Writer Source: Tero Vesalainen via Alamy Stock Photo Microsoft has added facial matching to its Entra Verified ID service, which lets organizations create and issue verifiable credentials to validate claims such as employment, education,   show more ...  

certifications, and residence. The new Face Check feature is available as a free public […] La entrada Microsoft Adds Face Check to Entra Verified ID – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.techrepublic.com – Author: Drew Robb Threat actors love phishing because it works. It is particularly effective in cloud infrastructure—once they’re inside, they gain access to anything else related to that cloud. According to Hornetsecurity’s Cyber Security Report 2024, there were 1.6 billion   show more ...  

potentially harmful emails sent during 2023. Almost half of them used phishing […] La entrada Spear Phishing vs Phishing: What Are The Main Differences? – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register It’s an annual meme that DEF CON infosec conference has been canceled, but this time it actually happened. The world’s largest hacking conference, held since 1993 and lately drawing in as many as 30,000 attendees, has been held in venues owned by   show more ...  

the Caesars Entertainment for well over a […] La entrada DEF CON is canceled! No, really this time – but the show will go on – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan A Chinese cyber-espionage group breached the Dutch Ministry of Defence last year and deployed malware on compromised devices, according to the Military Intelligence and Security Service (MIVD) of the Netherlands. However, despite backdooring the hacked   show more ...  

systems, the damage from the breach was limited due to network segmentation. “The effects of […] La entrada Chinese hackers infect Dutch military network with malware – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Keiana King In our recent webinar, Mastering SBOMs: Best Practices, speakers, including Ilkka Turunen, Field CTO, Sonatype, Roger Smith, Global Testing and Digital Assurance Lead, DXC Technology, and Marc Luescher, Solution Architect, AWS, shed light on the importance of   show more ...  

software bills of materials (SBOMs) in software development. *** This is a […] La entrada Mastering SBOMs: Best practices – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chinese

Source: www.databreachtoday.com – Author: 1 Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime Beijing Used FortiGate Vulnerability to Install Trojan Akshaya Asokan (asokan_akshaya) • February 6, 2024     Caption: The Dutch General Intelligence and Security Service headquarters at   show more ...  

night (Image: Shutterstock) Chinese espionage hackers penetrated Dutch military systems in early 2023, using a […] La entrada Chinese Hackers Penetrated Unclassified Dutch Network – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Children

Source: www.schneier.com – Author: Bruce Schneier HomeBlog Comments Clive Robinson • February 6, 2024 3:23 PM @ Bruce, ALL, I never did pull a genuine one apart to reverse engineer… But there were several stories floating around… One of which was the genuine Furby randomly recorded and played back audio   show more ...  

it identified as Speach… If […] La entrada Documents about the NSA’s Banning of Furby Toys in the 1990s – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Beware

Source: thehackernews.com – Author: . Feb 06, 2024NewsroomSocial Engineering / Malvertising Threat actors are leveraging bogus Facebook job advertisements as a lure to trick prospective targets into installing a new Windows-based stealer malware codenamed Ov3r_Stealer. “This malware is designed to   show more ...  

steal credentials and crypto wallets and send those to a Telegram channel that the threat […] La entrada Beware: Fake Facebook Job Ads Spreading ‘Ov3r_Stealer’ to Steal Crypto and Credentials – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: heimdalsecurity.com – Author: Livia Gyongyoși AnyDesk confirmed recently that a cyberattack has affected their product systems. The hackers accessed the source code and private code signing keys. Initially, the 170,000 customers remote access software company claimed an unplanned maintenance to explain   show more ...  

why client logins failed between January 29th and February 1st. A few days […] La entrada AnyDesk System Breach Raises Concerns Among MSP Users – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 A Little Sunshine

Source: krebsonsecurity.com – Author: BrianKrebs In 2021, the exclusive Russian cybercrime forum Mazafaka was hacked. The leaked user database shows one of the forum’s founders was an attorney who advised Russia’s top hackers on the legal risks of their work, and what to do if they got caught. A review of   show more ...  

this user’s hacker identities […] La entrada From Cybercrime Saul Goodman to the Russian GRU – Source: krebsonsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-02
Aggregator history
Wednesday, February 07
THU
FRI
SAT
SUN
MON
TUE
WED
FebruaryMarchApril