Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for LockBit Ransomware R ...

 Firewall Daily

The notorious LockBit ransomware group has recently struck again, allegedly targeting a diverse range of entities and adding ten new victims to their dark web portal. Among the victims of this latest LockBit cyberattack are Silver Airways, Taiwan Textiles, CABC, Plexus Teleradiology, Fiduciaire Cornelis & Budts,   show more ...  

Palterton Primary School, Immobiliare Camarotto, SEALCO, Fédération Envie, and Diener Precision Pumps.  Operating via their dark web portal, LockBit infiltrates networks, encrypting critical data and demanding ransom. A countdown timer on the portal adds pressure, signaling the impending permanent loss of data. This latest LockBit ransomware cyberattack highlights the group’s relentless tactics, targeting organizations regardless of intent and location.  LockBit Ransomware Cyberattack: 10 New Victims Added! Source: FalconFeeds on X One of the posts reads, “Silver Airways is a leading regional U.S. airline operating flights between gateways in Florida, the Southeast, and The Ba r Airways, ital, is headquartered in Fort Taiwan Textiles-Sustainable Innovation – Textile Export Promotion Project by. Taiwan Textile Federation.” This demonstrates the brazen nature of the cybercriminals, who openly flaunt their exploits. Source: FalconFeeds on X The Cyber Express reached out to some of the affected organizations to gather insights into the impact of the LockBit cyberattack. However, as of now, no official statements have been released by the victims, leaving the claims of the ransomware attack unverified. Source: FalconFeeds on X LockBit ransomware has gained notoriety for its involvement in numerous cyberattacks, surpassing other ransomware variants in activity. What sets LockBit apart is its preference for targeting small-to-medium-sized organizations, with victims facing an average ransom demand of approximately $85,000 per incident, reported BlackBerry. The Evolution of LockBit Ransomware Group The evolution of LockBit is evident from its history: first observed in September 2019, it has since undergone iterations, with LockBit 2.0 surfacing in 2021 and the current version, LockBit 3.0, discovered in June 2022. The tactics employed by LockBit are sophisticated, often leveraging purchased access, unpatched vulnerabilities, insider information, and zero-day exploits to gain initial entry into target networks. Once inside, LockBit establishes control, exfiltrated sensitive data, and encrypts files, leaving victims in a state of distress. A particularly nefarious aspect of LockBit’s strategy is its use of double extortion, wherein victims are coerced into paying not only to regain access to their encrypted files but also to prevent the exposure of their stolen data to the public. This strategy has proven highly lucrative for ransomware operators. Furthermore, LockBit often operates as a Ransomware-as-a-Service (RaaS), wherein an Initial Access Broker (IAB) facilitates the initial breach, selling access to the primary LockBit operators who then execute the second-stage exploitation. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for French Pastry Shop L ...

 Firewall Daily

Lili’s Brownies, a renowned confectionery specializing in delectable treats since 1991, has allegedly become a victim of a cyberattack orchestrated by the infamous 8BASE ransomware group.  This Lili’s Brownies cyberattack, which surfaced on the dark web, marks another addition to the long list of   show more ...  

organizations targeted by cybercriminals. Based in Le Ulis (91), France, Lili’s Brownies is celebrated for its high-quality semi-finished products, cakes, cookies, and cupcakes tailored for catering establishments.  Despite the company’s rich history and dedication to culinary excellence, its online presence, represented by the website lilisbrownies.fr, fell prey to malicious intent. Lili’s Brownies Cyberattack: No Immediate Signs of the Intrusion Source: FalconFeeds on X The Lili’s Brownies cyberattack, attributed to the 8BASE ransomware group, highlights the vulnerabilities inherent in digital platforms. The threat actor’s post, dated 9th January 2024, highlighted the infiltration posed by the 8BASE ransomware group. Built on the WordPress platform and hosted by Combell NV, the website for Lili’s Brownies (lilisbrownies.fr) is operational at the moment.  While the site appears functional outwardly, the looming threat of compromised databases lurks beneath the surface since most ransomware groups target the databases and vulnerabilities in the systems instead of launching a direct attack like defacing.  The Cyber Express has reached out to Lili’s Brownies to learn more about this 8BASE ransomware attack claims. However, at the time of writing this, no official statement or response has been received, leaving the claims for the Lili’s Brownies unverified at this point. Modus Operandi of 8BASE Ransomware Group The modus operandi of the 8BASE ransomware group follows a pattern observed in previous attacks. Operating since early 2023, the group adopted a multi-extortion model in May of the same year, leveraging a TOR-based victim blog site to propagate fear and coercion. According to a SentinelOne report, while the group’s origins trace back to smaller campaigns in 2022, formal affiliations with ransomware families like Phobos, RansomHouse, and Hive remain speculative. Primarily targeting sectors such as finance, manufacturing, IT, and healthcare, 8BASE casts a wide net, ensnaring victims predominantly in the US and Brazil. Initial access is often gained through phishing emails or intermediaries, facilitating the deployment of malicious payloads like SmokeLoader. Upon infiltration, 8BASE encrypts local drives and shared networks, rendering critical data inaccessible to legitimate users. The use of advanced encryption algorithms and obfuscation techniques complicates recovery efforts, amplifying the impact on affected organizations. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Dalmahoy Hotel & Cou ...

 Firewall Daily

The notorious Hunters ransomware group allegedly claimed the Dalmahoy Hotel & Country Club cyberattack, adding the UK-based 4-star hotel to its victim list.  The perpetrators, identified as the Hunters’ ransomware group, claimed to have breached the security of this establishment.  Situated near Edinburgh,   show more ...  

Dalmahoy Hotel & Country Club boasts an impressive revenue of $13.0 million and a workforce of 58 employees. According to the threat actor, the intrusion began on the evening of February 10, 2024 and was later posted on dark web. Dalmahoy Hotel & Country Club Cyberattack: What Data Was Accessed? Source: VenariX en Español on X The severity of the situation was further highlighted by the revelation that the attackers had obtained access to a staggering 949.4 GB of data, comprising a vast repository of 769,590 files. This Dalmahoy Hotel & Country Club attack not only threatens the integrity of sensitive information but also poses challenges to the hotel’s operations and reputation. Dalmahoy Hotel & Country Club, a distinguished 4-star hotel located near Edinburgh, offers a range of luxurious amenities including upscale accommodations, championship golf courses, fine dining experiences, and venues for weddings and events. However, the tranquility of this Dalmahoy Hotel & Country Club cyberattack has been disrupted by the looming specter of a cyberattack. The Cyber Express sought to obtain clarity on the situation by reaching out to the hotel for comment. However, as of the time of publication, no official statement or response has been issued by Dalmahoy Hotel & Country Club, leaving the claims regarding the cyberattack unverified. The Saga of Hunters Ransomware Group The perpetrators behind this attack, identified as the Hunters International ransomware group, operate under the guise of Ransomware-as-a-Service (RaaS), a nefarious business model that facilitates cybercrime. Emerging in the third quarter of 2023, Hunters International drew attention due to similarities between its code and that of the notorious Hive ransomware strain. While the group has denied any association with the Hive cartel, forensic analysis by cybersecurity researchers suggests an overlap in their methodologies. Hunters International ransomware is designed with a primary objective: to exfiltrate sensitive data from its targets and then extort them for ransom. Previous victims of their operations have reported the encryption of files and the placement of ransom notes containing instructions for contacting the attackers on the dark web. This Dalmahoy Hotel & Country Club cyberattack is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the Dalmahoy Hotel & Country Club attack or any official statement from the hotel.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Swiss Beauty Brand L ...

 Firewall Daily

La Colline, the renowned Swiss Riviera Beauty Treatment brand, has allegedly fallen victim to a cyberattack claimed by the infamous LockBit ransomware group. The threat actor behind the La Colline cyberattack issued a ransom ultimatum, setting a deadline for March 3, 2024, threatening to publish the compromised files.   show more ...  

  La Colline, known for its commitment to excellence and Swiss values, is now grappling with the aftermath of this cyber intrusion. The Cyber Express has reached out to the organization to learn more about this alleged cyberattack on La Colline.  However, at the time of writing this, no official statement or response has been received, leaving the claims for the La Colline cyberattack stand unverified.  Decoding the La Colline Cyberattack Claim by LockBit Source: X Visitors to La Colline’s website (http://lacolline-skincare.com) might find it operational, displaying no overt signs of the cyberattack. However, ransomware groups such as LockBit have a history of targeting the backend of the websites instead of attacking the public-facing elements. Cybercriminals often exploit vulnerabilities in databases and web applications to gain unauthorized access or disrupt systems, as exemplified by the LockBit ransomware group’s modus operandi.  Source: Original Footwear This group has a track record of targeting high-profile entities, with recent victims including Original Footwear, a prominent American boots manufacturer, and Manchester Fertility, a renowned fertility clinic. Source: X Original Footwear found itself thrust into the spotlight after claims of a cyberattack by the LockBit ransomware group surfaced on the dark web. Similarly, Manchester Fertility, a pioneer in reproductive medicine, faced a similar fate when details of a cyber threat emerged, accompanied by a ransom demand and a deadline. The LockBit Ransomware Operation  LockBit operates on a ransomware-as-a-service (RaaS) model, providing malicious actors with the tools to execute attacks in exchange for payment. The group’s tactics involve not only encrypting data and demanding ransom but also threatening to leak sensitive information if their demands are not met. According to the Cybersecurity and Infrastructure Security Agency (CISA), LockBit was the most prevalent ransomware variant globally in 2022 and continues to pose a significant threat. Affiliates utilizing LockBit have targeted organizations across various sectors, including finance, healthcare, and government, making it a pervasive and adaptable threat. To combat the escalating threat posed by LockBit ransomware attacks, cybersecurity authorities recommend implementing robust mitigation strategies. By proactively enhancing network defenses and staying vigilant against evolving cyber threats, organizations can bolster their resilience against ransomware attacks and safeguard sensitive data from falling into the wrong hands. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for BlackSuit Ransomware ...

 Firewall Daily

The BlackSuit ransomware attack has claimed a new victim: the Campaign for Tobacco-Free Kids, an American non-profit organization dedicated to advocating for reduced tobacco consumption. The announcement for this Campaign for Tobacco-Free Kids cyberattack surfaced via a dark web channel, where the group boasted about   show more ...  

its latest cyber incursion. Headquartered in Washington, D.C., Campaign for Tobacco-Free Kids is a prominent non-profit organization renowned as a leading anti-tobacco entity by esteemed publications like the New York Times.  The BlackSuit Ransomware Attack  Source: X The BlackSuit ransomware group’s announcement, made on February 12, 2024, highlights the brazen nature of their operations. Unlike more widely recognized cybercriminal factions, BlackSuit has been steadily expanding its sphere of influence, with previous attacks including breaches at educational institutions in central Georgia and even a zoo in Tampa Bay. Adding to the mounting concerns, DePauw University in Indiana recently disclosed a targeted intrusion, resulting in the unauthorized access of sensitive data pertaining to specific individuals. This breach, attributed to the same BlackSuit ransomware group, highlighted the indiscriminate nature of their attacks and the breadth of their capabilities. To learn more about the situation, The Cyber Express reached out to the Campaign for Tobacco-Free Kids for comment. However, as of the time of writing, no official statement has been issued by the organization, leaving the claims of the Campaign for Tobacco-Free Kids attack unverified. No Visible Intrusion and Modus Operandi of BlackSuit Ransomware  Despite these big bold claims, the Campaign for Tobacco-Free Kids’ website remains operational, showing no overt signs of the reported cyberattack. Nevertheless, the gravity of the situation cannot be understated, given BlackSuit’s track record of encrypting files on both Linux and Windows systems, appending a “.blacksuit” extension to affected files, altering desktop wallpapers, and distributing ransom notes. Cybercrime researcher Graham Cluley has shed light on BlackSuit’s modus operandi, detailing their encryption techniques and ransom demands. The US Department of Health and Human Services (HHS) issued a warning linking BlackSuit ransomware to previous groups like Royal and Conti, suggesting it as a direct successor.  The BlackSuit ransomware group’s latest victims, Southwest Binding & Laminating and Western Municipal Construction, further highlight the indiscriminate nature of their targeting. While Southwest Binding & Laminating’s website remains operational, Western Municipal Construction’s site is conspicuously offline, raising suspicions of yet another BlackSuit ransomware attack. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Navigating the risks ...

 Privacy

Navigating the current dating landscape can be perplexing; its filled with apps, websites, catfishing, and lurking stalkers. While pre-Tinder dating had its challenges, it sure seemed to be less intricate. Complicating matters is the heightened uncertainty about the identity of your virtual conversational partner, and   show more ...  

the disconcerting possibility of digital stalking. In fact, we recently commissioned a report on digital stalking to ascertain the reality of these risks and concerns. We engaged with over 21,000 participants to cast light on the alarming prevalence of digital abuse experienced by those in pursuit of love. Revelations from the survey As per our survey findings, 34% of respondents believe that googling or checking social media accounts of someone theyve just started dating is a form of due diligence. While seemingly harmless, 23% reported encountering some form of online stalking from a new romantic interest, suggesting that some individuals may take a swift Google search a bit too far. Furthermore, and somewhat alarmingly, over 90% of respondents expressed a willingness to share or consider sharing passwords that grant access to their location. While seemingly innocuous on the surface, there can loom there specter of stalkerware: silent software capable of continuously tracking user whereabouts and spying on messages. How to protect yourself? Tips from the experts Weve compiled advice from leading online security, dating, and safety experts to help you navigate the waters of love safely this Valentines Day! Enhanced password safety measures Create complex passwords using a mix of letters, numbers, and symbols. Never reuse passwords across different sites and apps; keep them private. Use two-factor authentication for an added layer of security. Change your password immediately if youve shared it with someone youve been dating but are no longer in touch with. Use a password manager to keep all your passwords strong and safe. Proactive verification techniques of online dating profiles Run a reverse-image search for that profile; if it appears on multiple pages under various names, its likely a catfisher. Look for inconsistencies in daters stories and profile details. Be wary of sudden, intense expressions of love, or requests for money. Use video calls to verify a daters identity before meeting in person. Maximizing online dating profile security: Conduct your own privacy audit of your social media accounts to understand whats publicly visible. Customize your privacy settings to control who can see your posts and personal information. Regularly review your friends/followers list to ensure you know who has access to your information. Strategic sharing guidelines: Avoid posting details that could disclose your location, workplace, or routines. Think twice before sharing emotionally charged or intimate content. Be mindful of metadata or other identifiable clues in photos (like geotags) that can reveal your identity, location, or details youd rather keep private. Set personal boundaries on the type of information you share early on in a relationship; only reveal personal details gradually as trust builds over time. Listen to your instincts – if something feels off, take a step back and give yourself a moment. Consider how the data you share could be used to piece together a profile or compromise your physical safety. Comprehensive safety plan for offline meetings: Choose well-lit, public places for initial meetings. Avoid sharing or displaying personal items that might reveal your address or sensitive information. Arrange your own transportation to and from the meeting place. Have a check-in system with a friend or family member. As we embrace the possibilities for romance and connection in the digital age, lets not forget the importance of our safety and wellbeing. By implementing these strategies, you can confidently explore the world of online dating while safeguarding both your digital and physical self. For more details, please take a look at our safe dating guide. And our premium security solution with identity protection and privacy features can help you keep calm and carry on… dating!

image for Dark Storm Team Anno ...

 Dark Web News

The hacking group Dark Storm Team has issued a menacing ultimatum, vowing to unleash a wave of cyberattacks targeting the services and government websites of NATO countries, Israel, and those nations lending support to the Israeli cause. Dark Storm Team, known for its sophisticated cyber warfare tactics and notorious   show more ...  

history of breaching high-security systems, issued the threat through various clandestine channels. The threat, which comes amid escalating tensions in several geopolitical hotspots, highlights the growing vulnerability of digital infrastructure to malicious actors seeking to disrupt operations, sow chaos, and inflict damage on critical systems. Source: Daily Dark Web Dark Storm Team: NATO Countries on High Alert The North Atlantic Treaty Organization (NATO) member states, comprising some of the world’s most technologically advanced nations, are now on high alert following the ominous threat from Dark Storm Team. With cyber warfare increasingly becoming a tool of modern conflict, the prospect of a coordinated attack on critical infrastructure and government systems poses a significant challenge to the collective security of NATO allies. Tensions in the Middle East The announcement from Dark Strom Team comes against the backdrop of heightened tensions in the Middle East, particularly amidst the ongoing conflict between Israel and Hamas. The long-standing dispute has escalated in recent years, with periodic outbreaks of violence resulting in casualties and widespread destruction. Dark Storm Team’s decision to target Israel and its supporters further exacerbates an already volatile situation, potentially fueling retaliatory measures and escalating cyber warfare in the region. Implications of the Cyberattack The implications of Dark Storm Team’s cyberattack could be far-reaching and multifaceted. Beyond the immediate disruption to government services and critical infrastructure, such an assault could have significant geopolitical repercussions. It could strain diplomatic relations between affected countries, trigger economic losses, and undermine trust in digital systems and networks. Moreover, the targeting of NATO countries highlightss the evolving nature of cyber threats and the challenges faced by governments and cybersecurity experts in safeguarding against sophisticated attacks Hacker Groups’ Announcement Channels Dark Storm Team’s announcement follows a trend observed in recent years, where hacker groups utilize online platforms to broadcast their intentions and coordinate attacks. Similar to the collaboration between LulzSec France and Moroccan Black Cyber Army targeting Denmark in January 2024, Dark Storm Team’s declaration was likely disseminated through encrypted channels or underground forums frequented by hackers and cybercriminals. The use of such channels enables these groups to communicate securely while amplifying the psychological impact of their threats on targeted entities and the broader public. By leveraging social media platforms or specialized forums, hacker groups can attract attention, sow fear, and garner support from sympathizers or individuals with similar ideological motives. Calls for Enhanced Cybersecurity Measures In response to the looming threat posed by the Dark Storm Team and other malicious actors, governments, multinational organizations, and cybersecurity firms must intensify efforts to enhance their defenses and cooperation in combating cyber threats. This could include investment in advanced technologies, collaboration on threat intelligence sharing, and the development of international norms and regulations to govern cyberspace. Moreover, there is a growing recognition of the need for proactive measures to deter and mitigate cyberattacks, including diplomatic engagement, economic sanctions, and legal frameworks to hold perpetrators accountable. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for MEDUSA Strikes Again ...

 Firewall Daily

The MEDUSA ransomware group has struck again, this time targeting two new victims: Amoskeag Network Consulting Group LLC and Kadac Pty Ltd. The dark web portal of the ransomware group showcased these additions, adding to their growing list of victims. However, crucial details such as the extent of the data   show more ...  

compromised and the motive behind the ransomware attack have not been disclosed by the group. MEDUSA Ransomware Group: Dual Target Amoskeag Network Consulting Group LLC, based in the United States, is likely a technology consulting firm providing a range of services such as network infrastructure management, cybersecurity solutions, and IT support to businesses. On the other hand, Kadac Pty Ltd, headquartered in Australia, might be a company involved in the distribution or retail of health and wellness products, given the nature of its operations and the Pty Ltd designation indicating a proprietary limited company. Source: Twitter Source: Twitter Despite the claims made by the ransomware group, the official websites of both companies appear to be fully functional, showing no signs of foul play. In an effort to verify the authenticity of the ransomware attack claim, The Cyber Express Team reached out to the officials of the targeted companies. Unfortunately, as of writing this report, no official response has been received, leaving the claim unverified. This lack of confirmation raises questions about the authenticity of the ransomware claim. It remains unclear whether this is a tactic employed by the group to gain attention or if they have ulterior motives behind their actions. Only an official statement from the affected companies can shed light on the true nature of the situation. However, if the claims made by the MEDUSA ransomware group are proven to be true, the implications could be far-reaching. The potential compromise of sensitive data by the group poses significant threats to the affected organizations. Previous Ransomware Attacks This is not the first time the MEDUSA ransomware group has made headlines. In January 2024, Water For People, a prominent nonprofit organization, found itself targeted by the group. With a deadline looming, the organization faced pressure to comply with the ransomware group’s demands. In a similar incident in 2023, the Canadian Psychological Association (CPA) fell victim to a cyberattack by the MEDUSA ransomware group. The group demanded hefty ransoms for the delay or deletion of compromised data, further escalating the situation. Furthermore, a recent MEDUSA ransomware attack targeted four additional organizations across different countries, including France, Italy, and Spain. The group’s modus operandi remains consistent, with announcements made on their dark web forum accompanied by deadlines and ransom demands. The recent addition of Amoskeag Network Consulting Group LLC and Kadac Pty Ltd to the MEDUSA ransomware group’s dark web portal underscores the ongoing threat posed by cybercriminals to organizations worldwide. As The Cyber Express continues to monitor this developing story, it serves as a reminder of the ever-present risks associated with cyber threats and the importance of remaining vigilant in safeguarding sensitive data and infrastructure. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Trends, Reports, Analysis

According to a report by Chainalysis, ransomware attacks caused a record-breaking $1.1 billion in financial damage in 2023, with a 49% increase in victim organizations being publicly threatened.

 Laws, Policy, Regulations

A new FCC Declaratory Ruling recognizes AI-generated voices in robocalls as "artificial" and illegal, giving State Attorneys General new tools to crack down on these scams and protect the public.

 Breaches and Incidents

The partial Facebook Marketplace database was allegedly leaked by a threat actor, exposing sensitive personal information of approximately 200,000 users, including full names, Facebook IDs, phone numbers, physical IDs, and email addresses.

 Trends, Reports, Analysis

Businesses and consumers are facing heightened levels of identity-focused attacks, with over 30% of businesses reporting growth in data and security breaches, impacting industries beyond the financial sector, according to AuthenticID.

 Trends, Reports, Analysis

In 2023, the U.S. FTC reported that Americans lost over $10 billion to scammers, a 14% increase from the previous year. Imposter scams were the most frequently reported, followed by online shopping scams and investment scams.

 Malware and Vulnerabilities

Files encrypted by Rhysida ransomware can be successfully decrypted, due to a implementation vulnerability discovered by Korean researchers and leveraged to create a decryptor.

 Feed

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a multiuser way.

 Feed

Debian Linux Security Advisory 5619-1 - Two vulnerabilities were discovered in libgit2, a low-level Git library, which may result in denial of service or potentially the execution of arbitrary code.

 Feed

LaborOfficeFree installs a MySQL instance that runs as SYSTEM and calculates the MySQL root password based on two constants. Each time the program needs to connect to MySQL as root, it employs the reverse algorithm to calculate the root password. This issue has been tested on version 19.10 exclusively, but allegedly, versions prior to 19.10 are also vulnerable.

 Feed

Ubuntu Security Notice 6631-1 - Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

 Feed

Ubuntu Security Notice 6630-1 - It was discovered that Glance_store incorrectly handled logging when the DEBUG log level is enabled. A local attacker could use this issue to obtain access_key values.

 Feed

This is additional research regarding a mitigation bypass in Windows Defender. Back in 2022, the researcher disclosed how it could be easily bypassed by passing an extra path traversal when referencing mshtml but that issue has since been mitigated. However, the researcher discovered using multiple commas can also be used to achieve the bypass.

 Feed

An issue was discovered on WyreStorm Apollo VX20 devices prior to version 1.3.58. The TELNET service prompts for a password only after a valid username is entered. Attackers who can reach the Apollo VX20 Telnet service can determine valid accounts allowing for account discovery.

 Feed

Red Hat Security Advisory 2024-0773-03 - An update for the squid:4 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Issues addressed include buffer over-read, denial of service, and null pointer vulnerabilities.

 Feed

Red Hat Security Advisory 2024-0772-03 - An update for the squid:4 module is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Issues addressed include buffer over-read, denial of service, and null pointer vulnerabilities.

 Feed

Red Hat Security Advisory 2024-0771-03 - An update for the squid:4 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Issues addressed include buffer over-read, denial of service, and null pointer vulnerabilities.

 Features

By Jonathon Dixon, Vice President and Managing Director – APJC, Cloudflare Digitization and technology are deeply rooted within the DNA of modern businesses – no matter the size or industry – as the benefits of implementing these critical tools can help increase efficiency, enable cost savings, enhance   show more ...  

customer experiences, and provide greater opportunity for data-driven decision-making. However, with this increasing reliance on and usage of technology for business-critical functions, organizations have become more vulnerable to cyber threats than ever before. Threat actors continuously seek novel methods to break into their victims’ environment, and the more tools that exist and touch data within your organization, the more opportunity there is for a breach or security incident. Instances such as data breaches, ransomware attacks, and supply chain compromises don’t just lead to financial setbacks, they can also cause the loss of critical and sensitive data, depending on the threat actor’s motive. These occurrences profoundly affect how businesses are perceived by their customers, employees, partners, and suppliers. It’s essential for organizations to understand that a security breach has the power to  inflict damage on reputation, undermining trust and potentially driving away both customers and business prospects. Prioritising Security within the Organization For businesses to effectively tackle evolving threats and boost trust, fostering a culture of security amongst employees and partners internally is crucial. The first step towards achieving this culture involves educating employees about cybersecurity fundamentals. Namely, how to spot phishing emails (which are the root cause of 90% of cyber attacks), understand social engineering tactics, and grasp the significance of strong passwords and data safeguarding. Equipping the individuals within an organization who have access to critical data and use tools and software daily that affect the business, with cybersecurity awareness empowers them as the primary defense against cyber threats. Integrating a dedicated leader across departments to lead security changes, enforce protocols, and ensure transparency throughout the organization helps hold employees accountable for their cyber hygiene. Zero Trust – Its Role in Ensuring Security Zero Trust is a cybersecurity concept that challenges traditional perimeter-based security. It operates on the ‘Never Trust, Always Verify’ principle that assumes you either have been breached or you will be breached. This approach involves strictly authenticating the identities of individuals and devices seeking access to private network resources, regardless of their location within or outside the network perimeter. A Zero Trust architecture encompasses various principles and technologies that enable  comprehensive and resilient network security. It introduces an extra layer of defense to restrict lateral movement within a network, aiming to minimize the impact of any potential security breach. Gartner reported that by 2025, 60 percent of organizations will have adopted Zero Trust as an initial security measure. And while we are still a year away,  77.8 percent of organizations implemented software-defined perimeter solutions, 52.2 percent are eyeing SD-Branch components, and 54.4 percent plan to adopt Zero Trust architecture and related security solutions in India (according to IDC). Traditional security methods are insufficient against today’s multifaceted cyber threats. Relying on perimeter-based security alone  – which trusts entities within the network – is no longer a viable strategy in today’s reality where attacks can originate both internally and externally. Embracing Zero Trust is crucial for organizations, as it fosters a security-centric workplace culture and enhances productivity, transparency, and data reliability. Under this approach, every employee must authenticate their identity before accessing sensitive information, promoting their responsibility and accountability. Benefits of Zero Trust Security Mode The Zero Trust security model offers several benefits that go beyond traditional security solutions: Increased efficiency: Unlike traditional methods, Zero Trust limits access to critical information, reducing potential damage to digital assets and enabling remote work, thus boosting productivity. Enhanced dependability: Traditional frameworks struggle with modern website complexities, while Zero Trust thoroughly verifies users and devices, ensuring smoother navigation and a better user experience. Transparency: Zero Trust verifies users at every step, enabling the identification of abnormal behavior and swift response to potential breaches. Safeguarding data integrity: Zero Trust thwarts unauthorized access to digital assets and introduces extra layers of verification to combat phishing attempts, ensuring data protection and authenticity. Risk reduction: Through rigorous identity and access verification, Zero Trust significantly diminishes the risks linked to unauthorized asset access, simplifying the detection and assessment of security breaches. Top of Form Creating a robust IT security strategy is vital for organizations – but oftentimes IT leaders and cybersecurity decision-makers grapple with the concept of and technology that underpins a Zero Trust architecture. After recent years’ large-scale breaches, leaders are coming to terms with the fact that the risk of having  sensitive company data stolen is increasing. As a result, IT leaders (88%) plan to increase the budget on cybersecurity over the next twelve months according to Zendesk. In a landscape where the number of data breaches and cyberattacks are increasing, businesses require a proactive and all-encompassing security approach to safeguard their valuable assets, secure customer data, and uphold the trust of stakeholders. And the only path forward is with Zero Trust. By adopting this security model, businesses can fortify their security posture, foster trust with stakeholders, and better shield themselves from cyber threats. Disclaimer: The views and opinions expressed in this guest post are solely those of the author(s) and do not necessarily reflect the official policy or position of The Cyber Express. Any content provided by the author is of their opinion and is not intended to malign any religion, ethnic group, club, organization, company, individual, or anyone or anything. 

 Firewall Daily

By April Miller, Managing Editor at ReHack Magazine How close is quantum computing to breaking encryption? It might happen sooner than you think. Standard cybersecurity protocols aren’t advanced enough to defend against it. If security experts don’t find a solution in time, the digital world as you know it will   show more ...  

disappear. Is there any way to stop it? Is Quantum Computing a Cybersecurity Threat? Generally, you’ll only find quantum computers in high-end research labs and government facilities because the technology is still in its infancy. It’s also wildly expensive and requires a very specific operating environment — but that doesn’t mean it can’t fall into the wrong hands. As quantum computing technology advances, getting ahold of it gets easier. Threat actors, foreign governments and cybercriminals might get their hands on it soon, which poses a national security risk and could put your data in danger. While classical computers use ones and zeroes to process information, quantum computers rely on quantum bits — known as qubits — instead. According to the superposition principle, qubits exist in multiple states at once. In other words, they drastically increase processing speeds. Security experts believe quantum computing is a cybersecurity threat. Mainly, they’re worried it’ll make current encryption standards useless. Blockchain integrity is another concern because digital signatures rely on public-key encryption. Why is quantum computing a threat to cryptography? To encrypt something, you use complex mathematical formulas to turn data into unreadable gibberish. It works because classical computers are too weak to calculate a solution in a reasonable timeframe. Where a classical computer would take 300 trillion years to break a 2048-bit RSA key — the most common public-key encryption — quantum computers could crack it in only eight hours. Needless to say, you can see why this technology poses a threat. Impact of Quantum Computing on Cybersecurity Currently, most of the world encrypts information to securely store and send it. If quantum computing cracks standard encryption methods, constant data leaks, breaches and interceptions will become the new normal. If standard cryptography methods become useless, companies and apps won’t be able to protect your personal information. Your biometric, financial and health data will be free range, meaning your identity and credit card details are practically guaranteed to get stolen. Hospitals, military facilities and critical infrastructure also rely on encryption. If quantum computing cracks cryptography standards, secure communication and data storage will be a thing of the past — meaning the digital world as you know it will become obsolete. Anything that relies on blockchain technology is also at risk because digital signatures — transaction authenticators — rely on public key encryption. Supply chains, cryptocurrency exchanges, voting systems and healthcare networks could fall into disarray. That said, there’s a silver lining. While quantum computing might have a catastrophic impact on standard encryption protocols, it also inspires the world to adopt new technology. Since digital transformation can improve cybersecurity posture, global security standards will strengthen. If quantum computing didn’t exist, something else would take its place. Eventually, some other disruptive new technology would come along to change the game. In other words, it’s a gift in disguise. Now, the world knows it’s time to modernize cryptography standards. What Obstacles Do Security Experts Face? Security experts are rushing to create quantum-resistant solutions. The only problem is that research and development take time. Even though quantum computing is years away from cracking common cryptography standards, finding a foolproof solution might take just as long. On a related note, this technology keeps advancing. For instance, many companies are making progress in fault-tolerant development, meaning they’re getting their computers to be resistant to common errors. Accessible quantum computing will arrive sooner than you think. Since security experts have no clear timeline, research and development get challenging. Making scalable quantum-resistant solutions is complex, so not knowing what to expect isn’t ideal. They’ll have to work fast and coordinate their efforts to address the issue in time. How Do You Defend Against Quantum Computing? While quantum computing is a complex, futuristic threat, defending against it isn’t impossible. Experts around the world are already hard at work finding solutions. Quantum-resistant Cryptography If the issue is that standard encryption is too weak, the obvious solution is to make it impossible to crack. Quantum-resistant cryptography is doing just that — its goal is to develop algorithms resistant to quantum computer attacks. The National Institute of Standards and Technology has made progress. It released draft standards for three quantum-resistant algorithms — CRYSTALS-Kyber, CRYSTALS-Dilithium and SPHINCS+ — in late 2023. Hopefully, they’ll be ready sometime in 2024. Collaborative Research and Development Collaborative research and development are key to defending against quantum computing. If researchers, government agencies and leading security experts put their heads together to find a solution, they have a much better chance of success. Quantum Key Distribution Even if you make cryptography quantum resistant, you still need to be able to securely exchange encryption keys. Using quantum mechanics, you can do just that. It’s almost ironic — who would’ve thought the problem would be the solution? Quantum key distribution uses the quantum properties of light to generate secure random keys. Since it doesn’t rely on mathematical formulas, it stays safe from quantum attacks. This way, you can exchange encryption keys without fear of interception. Quantum Cybersecurity Adoption It’s true quantum computing technology will fall into the wrong hands as it becomes more accessible. That said, the good guys will also have an easier time getting ahold of it. They can use it to improve threat detection since its processing power is so advanced. Defending Against Quantum Computing Is Possible There’s no easy way to say it — quantum computing could be catastrophic for cybersecurity. Fortunately, the brightest minds around the world are already working on solutions. Hopefully, they have a foolproof solution by the time quantum computers crack cryptography standards. Disclaimer: The views and opinions expressed in this guest post are solely those of the author(s) and do not necessarily reflect the official policy or position of The Cyber Express. Any content provided by the author is of their opinion and is not intended to malign any religion, ethnic group, club, organization, company, individual, or anyone or anything. 

 Feed

Microsoft said it's introducing Sudo for Windows 11 as part of an early preview version to help users execute commands with administrator privileges. "Sudo for Windows is a new way for users to run elevated commands directly from an unelevated console session," Microsoft Product Manager Jordi Adoumie said. "It is an ergonomic and familiar solution for users who want to elevate a command

 Feed

The U.S. Department of State has announced monetary rewards of up to $10 million for information about individuals holding key positions within the Hive ransomware operation. It is also giving away an additional $5 million for specifics that could lead to the arrest and/or conviction of any person "conspiring to participate in or attempting to participate in Hive ransomware activity."

 Feed

Incident response (IR) is a race against time. You engage your internal or external team because there's enough evidence that something bad is happening, but you’re still blind to the scope, the impact, and the root cause. The common set of IR tools and practices provides IR teams with the ability to discover malicious files and outbound network connections. However, the identity aspect - namely

 Feed

Cybersecurity researchers have uncovered an "implementation vulnerability" that has made it possible to reconstruct encryption keys and decrypt data locked by Rhysida ransomware. The findings were published last week by a group of researchers from Kookmin University and the Korea Internet and Security Agency (KISA). "Through a comprehensive analysis of Rhysida Ransomware, we identified an

 Feed

When it comes to access security, one recommendation stands out above the rest: multi-factor authentication (MFA). With passwords alone being simple work for hackers, MFA provides an essential layer of protection against breaches. However, it's important to remember that MFA isn't foolproof. It can be bypassed, and it often is.  If a password is compromised, there are several options

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced that it's partnering with the Open Source Security Foundation (OpenSSF) Securing Software Repositories Working Group to publish a new framework to secure package repositories. Called the Principles for Package Repository Security, the framework aims to establish a set of foundational rules for package

2024-02
Aggregator history
Monday, February 12
THU
FRI
SAT
SUN
MON
TUE
WED
FebruaryMarchApril