Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Credential phishing ...

 Business

Mailing lists that companies use to contact customers have always been an interesting target for cyberattacks. They can be used for spamming, phishing, and even more sophisticated scams. If, besides the databases, the attackers can gain access to a legitimate tool for sending bulk emails, this significantly increases   show more ...  

the chances of success of any attack. After all, users who have agreed to receive emails and are accustomed to consuming information in this way are more likely to open a familiar newsletter than some unexpected missive. Thats why attackers regularly attempt to seize access to companies accounts held with email service providers (ESPs). In the latest phishing campaign weve uncovered, the attack method has been refined to target credentials on the website of the ESP SendGrid by sending phishing emails directly through the ESP itself. Why is phishing through SendGrid more dangerous in this case? Among the tips we usually give in phishing-related posts, we most often recommend taking a close look at the domain of the site in the button or text hyperlink that youre invited to click or tap. ESPs, as a rule, dont allow direct links to client websites to be inserted in an email, but rather serve as a kind of redirect — inside the link the email recipient sees the domain of the ESP, which then redirects them to the site specified by the mail authors when setting up the mailing campaign. Among other things, this is done to collect accurate analytics. In this case, the phishing email appears to come from the ESP SendGrid, expressing concern about the customers security and highlighting the need to enable two-factor authentication (2FA) to prevent outsiders from taking control of their account. The email explains the benefits of 2FA and provides a link to update the security settings. This leads, as youve probably already guessed, to some address in the SendGrid domain (where the settings page would likely be located if the email really was from SendGrid). To all email scanners, the phishing looks like a perfectly legitimate email sent from SendGrids servers with valid links pointing to the SendGrid domain. The only thing that might alert the recipient is the senders address. Thats because ESPs put the real customers domain and mailing ID there. Most often, phishers make use of hijacked accounts (ESPs subject new customers to rigorous checks, while old ones whove already fired off some bulk emails are considered reliable). An email seemingly from SendGrid sent through SendGrid to phish a SendGrid account. Phishing site This is where the attackers originality comes to an end. SendGrid redirects the link-clicking victim to a regular phishing site mimicking an account login page. The site domain is sendgreds, which at first glance looks very similar to sendgrid. A site mimicking the SendGrid login page. Note the domain in the address bar How to stay safe Since the email is sent through a legitimate service and shows no typical phishing signs, it may slip through the net of automatic filters. Therefore, to protect company users, we always recommend deploying solutions with advanced anti-phishing technology not only at the mail gateway level but on all devices that have access to the internet. This will block any attempted redirects to phishing sites. And yes, for once its worth heeding the attackers advice and enabling 2FA. But not through a link in a suspicious email, but in the settings in your account on ESPs website.

image for Transatlantic Cable ...

 News

In todays episode of the Transatlantic Cable podcast, the team look at news that companies at the fore-front of generative AI are looking to take action on deceptive AI in upcoming elections. From there, the team discuss news that the Canadian government is set to take action against devices such as Flipper Zero, in   show more ...  

an apparent fight against criminal activity. To wrap up, the team discuss news that international police agencies have taken down LockBit – the infamous ransomware gang. Additionally, the team discuss a bizarre story around Artificial Intelligence, blue aliens and job applications – yes, really. If you liked what you heard, please consider subscribing. Big tech vows action on deceptive AI in elections Feds Want to Ban the Worlds Cutest Hacking Device UK leads disruption of major cyber-criminal gang Service Jobs Now Require Bizarre Personality Test From AI Company

image for New Leak Shows Busin ...

 A Little Sunshine

A new data leak that appears to have come from one of China’s top private cybersecurity firms provides a rare glimpse into the commercial side of China’s many state-sponsored hacking groups. Experts say the leak illustrates how Chinese government agencies increasingly are contracting out foreign espionage   show more ...  

campaigns to the nation’s burgeoning and highly competitive cybersecurity industry. A marketing slide deck promoting i-SOON’s Advanced Persistent Threat (APT) capabilities. A large cache of more than 500 documents published to GitHub last week indicate the records come from i-SOON, a technology company headquartered in Shanghai that is perhaps best known for providing cybersecurity training courses throughout China. But the leaked documents, which include candid employee chat conversations and images, show a less public side of i-SOON, one that frequently initiates and sustains cyberespionage campaigns commissioned by various Chinese government agencies. The leaked documents suggest i-SOON employees were responsible for a raft of cyber intrusions over many years, infiltrating government systems in the United Kingdom and countries throughout Asia. Although the cache does not include raw data stolen from cyber espionage targets, it features numerous documents listing the level of access gained and the types of data exposed in each intrusion. Security experts who reviewed the leaked data say they believe the information is legitimate, and that i-SOON works closely with China’s Ministry of Public Security and the military. In 2021, the Sichuan provincial government named i-SOON as one of “the top 30 information security companies.” “The leak provides some of the most concrete details seen publicly to date, revealing the maturing nature of China’s cyber espionage ecosystem,” said Dakota Cary, a China-focused consultant at the security firm SentinelOne. “It shows explicitly how government targeting requirements drive a competitive marketplace of independent contractor hackers-for-hire.” Mei Danowski is a former intelligence analyst and China expert who now writes about her research in a Substack publication called Natto Thoughts. Danowski said i-SOON has achieved the highest secrecy classification that a non-state-owned company can receive, which qualifies the company to conduct classified research and development related to state security. i-SOON’s “business services” webpage states that the company’s offerings include public security, anti-fraud, blockchain forensics, enterprise security solutions, and training. Danowski said that in 2013, i-SOON established a department for research on developing new APT network penetration methods. APT stands for Advanced Persistent Threat, a term that generally refers to state-sponsored hacking groups. Indeed, among the documents apparently leaked from i-SOON is a sales pitch slide boldly highlighting the hacking prowess of the company’s “APT research team” (see screenshot above). i-SOON CEO Wu Haibo, in 2011. Image: nattothoughts.substack.com. The leaked documents included a lengthy chat conversation between the company’s founders, who repeatedly discuss flagging sales and the need to secure more employees and government contracts. Danowski said the CEO of i-SOON, Wu Haibo (“Shutdown” in the leaked chats) is a well-known first-generation red hacker or “Honker,” and an early member of Green Army — the very first Chinese hacktivist group founded in 1997. Mr. Haibo has not yet responded to a request for comment. In October 2023, Danowski detailed how i-SOON became embroiled in a software development contract dispute when it was sued by a competing Chinese cybersecurity company called Chengdu 404. In September 2021, the U.S. Department of Justice unsealed indictments against multiple Chengdu 404 employees, charging that the company was a facade that hid more than a decade’s worth of cyber intrusions attributed to a threat actor group known as “APT 41.” Danowski said the existence of this legal dispute suggests that Chengdu 404 and i-SOON have or at one time had a business relationship, and that one company likely served as a subcontractor to the other. “From what they chat about we can see this is a very competitive industry, where companies in this space are constantly poaching each others’ employees and tools,” Danowski said. “The infosec industry is always trying to distinguish [the work] of one APT group from another. But that’s getting harder to do.” It remains unclear if i-SOON’s work has earned it a unique APT designation. But Will Thomas, a cyber threat intelligence researcher at Equinix, found an Internet address in the leaked data that corresponds to a domain flagged in a 2019 Citizen Lab report about one-click mobile phone exploits that were being used to target groups in Tibet. The 2019 report referred to the threat actor behind those attacks as an APT group called Poison Carp. Several images and chat records in the data leak suggest i-SOON’s clients periodically gave the company a list of targets they wanted to infiltrate, but sometimes employees confused the instructions. One screenshot shows a conversation in which an employee tells his boss they’ve just hacked one of the universities on their latest list, only to be told that the victim in question was not actually listed as a desired target. The leaked chats show i-SOON continuously tried to recruit new talent by hosting a series of hacking competitions across China. It also performed charity work, and sought to engage employees and sustain morale with various team-building events. However, the chats include multiple conversations between employees commiserating over long hours and low pay. The overall tone of the discussions indicates employee morale was quite low and that the workplace environment was fairly toxic. In several of the conversations, i-SOON employees openly discuss with their bosses how much money they just lost gambling online with their mobile phones while at work. Danowski believes the i-SOON data was probably leaked by one of those disgruntled employees. “This was released the first working day after the Chinese New Year,” Danowski said. “Definitely whoever did this planned it, because you can’t get all this information all at once.” SentinelOne’s Cary said he came to the same conclusion, noting that the Protonmail account tied to the GitHub profile that published the records was registered a month before the leak, on January 15, 2024. China’s much vaunted Great Firewall not only lets the government control and limit what citizens can access online, but this distributed spying apparatus allows authorities to block data on Chinese citizens and companies from ever leaving the country. As a result, China enjoys a remarkable information asymmetry vis-a-vis virtually all other industrialized nations. Which is why this apparent data leak from i-SOON is such a rare find for Western security researchers. “I was so excited to see this,” Cary said. “Every day I hope for data leaks coming out of China.” That information asymmetry is at the heart of the Chinese government’s cyberwarfare goals, according to a 2023 analysis by Margin Research performed on behalf of the Defense Advanced Research Projects Agency (DARPA). “In the area of cyberwarfare, the western governments see cyberspace as a ‘fifth domain’ of warfare,” the Margin study observed. “The Chinese, however, look at cyberspace in the broader context of information space. The ultimate objective is, not ‘control’ of cyberspace, but control of information, a vision that dominates China’s cyber operations.” The National Cybersecurity Strategy issued by the White House last year singles out China as the biggest cyber threat to U.S. interests. While the United States government does contract certain aspects of its cyber operations to companies in the private sector, it does not follow China’s example in promoting the wholesale theft of state and corporate secrets for the commercial benefit of its own private industries. Dave Aitel, a co-author of the Margin Research report and former computer scientist at the U.S. National Security Agency, said it’s nice to see that Chinese cybersecurity firms have to deal with all of the same contracting headaches facing U.S. companies seeking work with the federal government. “This leak just shows there’s layers of contractors all the way down,” Aitel said. “It’s pretty fun to see the Chinese version of it.”

image for The LockBit Takedown ...

 Firewall Daily

The cybersecurity community was rocked by a massive event when LockBit Ransomware once a powerful domain suddenly changed, displaying flags of nations united against cybercrime. On February 20, 2024, the Department of Justice, working with law enforcement agencies worldwide, dealt a major blow to LockBit’s   show more ...  

illegal operations.  In a decisive move, authorities targeted one of the world’s biggest ransomware groups, taking control of its systems and capturing key members.  However, amid the investigation, a troubling revelation emerged, shedding light on the deceptive practices of LockBit and the reality of ransomware collectives. Despite their claims of data deletion upon ransom payment, evidence surfaced of lingering data belonging to companies who had complied.   “Some of the data on LockBit’s systems belonged to victims who had paid a ransom to the threat actors, evidencing that even when a ransom is paid, it does not guarantee that data will be deleted, despite what the criminals have promised,” reads NCA official Statement.   It’s undeniable that the LockBit collective frequently resorts to double extortion tactics, so it’s not surprising that this occurred. Yet, this only highlights the harmful consequences of ransom payments for those affected.  Source: Twitter The statistics paint a grim picture of the ransomware domain, revealing the harsh realities faced by organizations that fall victim to these attacks. According to a report by Spin.AI, a staggering 36% of companies find themselves targeted for a second time after paying a ransom, highlighting the persistent threat posed by cybercriminals.   Even for those who comply with ransom demands, the outcome is often far from satisfactory, with 41% failing to recover all their data and over 40% forced to rebuild their systems from scratch. Additionally, nearly 30% of ransom-paying companies had their data leaked by criminals highlighting the treacherous nature of engaging with extortionists.  Despite the increasing frequency and severity of ransomware attacks, the financial toll exacted on businesses remains staggering. With an average ransom payment exceeding $800,000, the financial strain on organizations is immense.   In the face of such daunting odds, organizations must grapple with ethical and practical dilemmas. Is it worth risking further victimization to regain control of their data? Can they afford to rebuild their systems from scratch, knowing that paying the ransom may not guarantee their safety?  As we go deeper into the tangled web of ransomware, one burning issue remains: is paying the ransom ever a viable option? The latest LockBit raid, combined with dismal data and tragic victimization stories, pushes us to face the sad reality that there are no easy fixes when it comes to cyber extortion.  LockBit Ransomware Crackdown: The NCA’s Investigation   NAC’s recent investigation into LockBit, one of the most notorious cybercrime groups globally, has yielded invaluable insights into the workings of ransomware operations.   By infiltrating LockBit’s network and seizing control of their services, the NCA has dealt a significant blow to their criminal enterprise.   For four years, LockBit’s ransomware attacks have wreaked havoc on thousands of victims worldwide, resulting in staggering financial losses amounting to billions of pounds, dollars, and euros.   The group operated on a ransomware-as-a-service model, providing affiliates with the tools and infrastructure needed to execute attacks.   Despite victims paying hefty ransoms in cryptocurrency, the investigation has revealed a stark truth: paid ransoms do not guarantee the deletion of stolen data, contrary to the promises made by cybercriminals.   This revelation is extremely important in the field of cybersecurity, emphasizing the rising threat posed by ransomware and the critical necessity for strong defense methods.   As ransomware payments surged to over $1 billion in 2023, surpassing previous records, the NCA’s findings highlight the pressing need for proactive measures to mitigate the impact of cyber extortion on organizations worldwide.  Why Ransom Payment is Risky  Paying ransomware demands poses significant risks to organizations, with repercussions ranging from financial losses to reputational damage and ethical dilemmas. One of the foremost concerns is the lack of guarantee for data recovery.   Despite the hefty sums often demanded, there is no assurance that cybercriminals will provide decryption keys or restore access to encrypted systems after payment. This uncertainty leaves organizations vulnerable to prolonged downtime and data loss.  According to the Sophos report, on a global scale, when organizations paid a ransom to get their data decrypted, they ended up additionally doubling their recovery costs (US$750,000 in recovery costs versus US$375,000 for organizations that used backups to get data back).   Moreover, paying the ransom usually meant longer recovery times, with 45% of those organizations that used backups recovering within a week, compared to 39% of those that paid the ransom.  Moreover, paying ransom inadvertently fuels further attacks by emboldening criminals. By demonstrating a willingness to meet their demands, organizations incentivize cybercriminals to continue their illicit activities, perpetuating a vicious cycle of extortion and exploitation. This not only puts the paying organization at risk but also encourages ransomware gangs to target other vulnerable entities, amplifying the overall threat landscape.  “Incident costs rise significantly when ransoms are paid. Most victims will not be able to recover all their files by simply buying the encryption keys; they must rebuild and recover from backups as well. Paying ransoms not only enriches criminals, but it also slows incident response and adds cost to an already devastatingly expensive situation,” said Chester Wisniewski, field CTO, Sophos.  Ethical considerations also loom large when contemplating ransom payments. Funding criminal enterprises through ransom payments raises profound ethical concerns, as organizations become complicit in supporting illicit activities such as extortion and data theft. Moreover, in regions where paying ransom is illegal, organizations may face legal repercussions for their involvement in financing criminal operations.  Furthermore, the risks extend beyond immediate financial and legal consequences. Paying ransom does not guarantee that the ordeal ends there. Some ransomware gangs may sell stolen data to other malicious actors, leading to the potential for multiple ransom demands or even widespread identity theft.   Additionally, hackers may resort to extortion tactics, threatening to expose previous ransom payments unless further funds are provided. This not only exacerbates financial losses but also tarnishes the organization’s reputation, particularly if the incident becomes public knowledge.  So, What Can Be Alternatives to Paying Ransom?  When faced with the daunting prospect of a ransomware attack, organizations must consider alternatives to paying the ransom, safeguarding both their data and integrity. One of the most crucial alternatives is maintaining regular data backups.   By regularly backing up essential data and systems, organizations can mitigate the impact of ransomware attacks, enabling swift recovery without succumbing to extortion. Additionally, investing in robust cybersecurity measures is paramount.   Implementing multi-layered security protocols, such as firewalls, antivirus software, and intrusion detection systems, can help detect and prevent ransomware attacks before they inflict substantial damage. Moreover, organizations should prioritize cybersecurity awareness training for employees to mitigate the risk of human error and phishing attacks, which are common entry points for ransomware.  Furthermore, involving law enforcement agencies is essential. Reporting ransomware attacks to authorities not only facilitates the investigation and potential prosecution of cybercriminals but also contributes to collective efforts to combat cybercrime.   By exploring these alternatives to paying ransom, organizations can bolster their resilience against ransomware attacks and safeguard their data, finances, and reputation in an increasingly hostile digital landscape.  It is evident that the solution to ransomware extortion is not straightforward. However, by prioritizing resilience over capitulation, organizations can take a stand against cyber threats while safeguarding their integrity.   It is time to shift the narrative from compliance to defiance, from vulnerability to strength. Together, we can build a future where ransomware loses its grip, and cybersecurity becomes synonymous with empowerment.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Is the LockBit Crack ...

 Firewall Daily

In the wake of the recent crackdown on the notorious LockBit Ransomware Group, an unexpected turn unfolds as the group’s administrative staff speaks out through the verified Twitter account of vx-underground, sparking a flurry of reactions and debates across social media platforms. Vx-underground, a prominent   show more ...  

account with 271.3K followers known for its insights into cybersecurity and hacking, claimed to have engaged with LockBit’s administrative staff regarding the recent arrests made by The Department of Justice in collaboration with international law enforcement agencies. LockBit Ransomware: Casting Doubt on Arrests According to the disclosures made by LockBit’s administration, the group vehemently denies the legitimacy of the arrests, asserting that the individuals apprehended were innocent. They challenge the credibility of the FBI, NCA UK, and Europol, claiming that these agencies lack accurate information about their operations. In a bold move, LockBit offers to double the bounty to $20,000,000 for anyone who can identify their members. Moreover, LockBit’s administrators criticize the investigative prowess of law enforcement agencies, particularly targeting the FBI, NCA UK, and Europol, accusing them of relying on the group’s supposed “laziness” rather than genuine expertise in cybersecurity. This claim has sparked controversy and skepticism among cybersecurity experts and enthusiasts. Social Media Discourse: Skepticism and Speculation The revelation of LockBit’s defiance and the doubling of their bounty has ignited a storm of reactions on Twitter. While some users expressed disbelief at the audacity of referring to criminal entities as “administrative staff,” others highlighted the unfortunate reality of organized crime operating as sophisticated businesses. One user questioned the account’s safety in disseminating such information, speculating whether law enforcement agencies might target them next. To this, the account responded confidently, stating that while they tread a fine line, their operations are legitimate, with all resources and taxes paid under real identities. Despite this assurance, concerns linger regarding potential reprisals. Source: Twitter Critics suggest that LockBit’s defiance and the public spectacle could be attempts to save face and mitigate the impact of recent arrests, signaling a potential struggle within the group to maintain operations. However, the post shared by the account maintains its belief that law enforcement agencies have indeed dealt a significant blow to LockBit, even though the identity of the group’s leadership remains uncertain. Source: Twitter As the debate rages on social media platforms, one thing remains clear: the recent crackdown on LockBit represents a pivotal moment in the ongoing battle against cybercrime. While law enforcement celebrates a significant blow to the operations of a notorious ransomware group, the challenges and uncertainties that lie ahead underscore the complexity of combating digital threats in an interconnected world. The recent interaction with LockBit’s administrative staff has sparked a social media discussion, prompting many to question the veracity of the claims being made. However, without solid evidence to substantiate these assertions, doubts persist regarding their accuracy. As the dust settles on this latest development, the cybersecurity world stands at a crossroads, where the clash between law enforcement and cybercriminals shapes the contours of digital security in the 21st century. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for ALPHV/BlackCat Ranso ...

 Firewall Daily

ALPHV/BlackCat ransomware group has alleged the KHS&S cyberattack on its dark web channel. The threat actor claimed the cyberattack on February 21, 2024 and shared a deadline of 3 days from the day of posting about the organization. KHS&S Contractors, a prominent company in the construction industry based in   show more ...  

the USA, is allegedly facing this ransomware group which claims access to an undisclosed amount of data. The message posted by the ALPHV/BlackCat ransomware group, directed squarely at KHS&S, was short but foreboding: “KHS&S CONTRACTORS (You have 3 days). With revenue amounting to $49.9 million, KHS&S Contractors found itself thrust into the crosshairs of cybercriminals, the extent of the damage yet to be fully comprehended. Alleged KHS&S Cyberattack Claims on Dark Web To learn more about this alleged cyberattack on KHS&S, The Cyber Express promptly reached out to the organization for clarification and insights. However, at the time of writing, the organization has not shared any official statement or response to the alleged KHS&S cyberattack, leaving the claims of the cyberattack hanging in uncertainty. Source: X Despite the lack of official acknowledgment, skepticism emerged regarding the validity of the attack. The website of KHS&S appeared operational, showing no immediate signs of disruption or compromise. However, it has been known that cyber assailants often target backend systems and databases rather than launching frontal assaults. Indeed, the KHS&S cyberattack, if confirmed, would be emblematic of a broader trend within the construction industry. Recent years have witnessed a surge in ransomware attacks targeting construction firms, with Nordlocker, a leading encryption software firm, ranking the sector as the most vulnerable to such incursions for two out of the past three years. The Vulnerabilities Within Construction Companies  The vulnerabilities inherent in the construction industry serve as an irresistible victim for cybercriminals. The reliance on modern-day digital tools, from computer-aided design (CAD) to building information modeling (BIM), exposes firms to heightened risks. Compounding the problem is the often lax cybersecurity posture of many construction companies, coupled with inadequate employee training in identifying and mitigating cyber threats. The rise of cyberattacks on construction companies becomes evident with incidents such as the cyberattack on Simpson Manufacturing in 2023. The California-based engineering firm, renowned for its wood and concrete construction products, found itself in a cyberattack that prompted the shutdown of critical IT systems. In an SEC filing, Simpson Manufacturing acknowledged the cybersecurity incident, revealing the disruptions to its IT infrastructure and applications. The company’s response included taking affected systems offline in a bid to contain the breach, highlighting the severity and persistence of cyber threats facing the construction sector. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Beware of ENS Email ...

 Firewall Daily

Crypto scammers have devised a new tactic to deceive owners of Ethereum Name Service (ENS) domains, commonly recognized by their “.eth” extension. The ENS email phishing scam involves sending emails to ENS owners, purportedly alerting them about the expiration of their domains.  However, instead of   show more ...  

directing them to legitimate renewal sites, unsuspecting victims are lured to fraudulent platforms designed to siphon their funds. Nick Bax, a prominent figure in cryptocurrency analysis, highlighted the crypto scam, suggesting that attackers may be exploiting the extensive data leak from previous data breaches. This leak potentially provides scammers with access to genuine email addresses associated with .eth accounts, facilitating the targeting of ENS owners. The ENS Email Phishing Scam Nick warns that this method represents an emerging threat and advises users to remain vigilant. Phishers have adeptly mapped ENS domains to corresponding email addresses, with the Twitter database leak likely serving as a primary data source for this malicious activity. Source: Blockfence on X The Ethereum Name Service (ENS) serves as a decentralized domain name system (DNS) built on the Ethereum blockchain. Similar to the traditional DNS used on the internet, ENS enables users to associate human-readable names with complex Ethereum addresses, simplifying transactions and interactions within the ecosystem. One reported instance of this scam involved a phishing email falsely claiming that the recipient’s ENS domain was on the brink of expiration. Source: Blockfence on X The email provided a link to a counterfeit renewal site, urging users to act promptly to avoid service disruptions. The fraudulent domain, disguised as a legitimate ENS site, aimed to deceive users into surrendering their sensitive information and cryptocurrency assets. More Ethereum Phishing Scam on the Market Despite its recent resurgence, this ENS email phishing scam is not entirely new. Just last week, Hayden Adams, the creator of the decentralized exchange Uniswap, exposed a sophisticated Ethereum phishing scam exploiting ENS domains. Victims have collectively lost over $47,600 to this elaborate ploy, demonstrating the severity of the threat, reported BNN Breaking. Hayden Adams shed light on the scam’s mechanics, which involve replicating genuine wallet addresses with deceptive .eth extensions. This manipulation misleads users into sending cryptocurrency to fraudulent addresses, resulting in substantial financial losses. The scam’s sophistication extends to the replication of legitimate addresses within user interfaces, making it difficult for individuals to discern between authentic and counterfeit domains. Additionally, scammers have adopted address poisoning tactics, whereby small transactions of real Ethereum or fake Tether are sent to potential victims, further enhancing the illusion of legitimacy. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Govt., Critical Infrastructure

The director of cybersecurity at the National Security Agency, Rob Joyce, is retiring after 34 years of service. David Luber, deputy director of the Cybersecurity Directorate, will succeed Joyce.

 Breaches and Incidents

The incident disrupted patient payments and prescription processing, affecting a significant portion of the U.S. healthcare system due to Change Healthcare's extensive reach and role in handling healthcare transactions.

 Incident Response, Learnings

The UK's National Crime Agency (NCA) has gained control of LockBit's site and has exposed the identities of the affiliates, disrupted the affiliate infrastructure, and destroyed the servers used for data exfiltration.

 Malware and Vulnerabilities

On 16th January 2024, the Ubuntu security team released critical security updates addressing several FreeImage vulnerabilities in different Ubuntu releases, including Ubuntu 16.04 and Ubuntu 18.04.

 Feed

Debian Linux Security Advisory 5627-1 - Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or spoofing.

 Feed

Gentoo Linux Security Advisory 202402-29 - Multiple vulnerabilities have been found in LibreOffice, the worst of which could result in user-assisted code execution. Versions greater than or equal to 7.5.9.2 are affected.

 Feed

There exists an unauthenticated command injection vulnerability in the QNAP operating system known as QTS and QuTS hero. QTS is a core part of the firmware for numerous QNAP entry and mid-level Network Attached Storage (NAS) devices, and QuTS hero is a core part of the firmware for numerous QNAP high-end and   show more ...  

enterprise NAS devices. The vulnerable endpoint is the quick.cgi component, exposed by the device's web based administration feature. The quick.cgi component is present in an uninitialized QNAP NAS device. This component is intended to be used during either manual or cloud based provisioning of a QNAP NAS device. Once a device has been successfully initialized, the quick.cgi component is disabled on the system. An attacker with network access to an uninitialized QNAP NAS device may perform unauthenticated command injection, allowing the attacker to execute arbitrary commands on the device.

 Feed

Ubuntu Security Notice 6649-1 - Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. Alfred Peters   show more ...  

discovered that Firefox did not properly manage memory when storing and re-accessing data on a networking channel. An attacker could potentially exploit this issue to cause a denial of service.

 Feed

Ubuntu Security Notice 6648-1 - It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Zhenghan Wang discovered that the   show more ...  

generic ID allocator implementation in the Linux kernel did not properly check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service.

 Feed

Red Hat Security Advisory 2024-0937-03 - An update for kpatch-patch is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Issues addressed include a privilege escalation vulnerability.

 Feed

Red Hat Security Advisory 2024-0934-03 - An update is now available for Red Hat Virtualization 4 Tools for Red Hat Enterprise Linux 8, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, and Red Hat Virtualization Engine 4.4. Issues addressed include a bypass vulnerability.

 Feed

Red Hat Security Advisory 2024-0853-03 - Network Observability is an OpenShift operator that deploys a monitoring pipeline to collect and enrich network flows that are produced by the Network Observability eBPF agent.

 Feed

In this paper, the authors show that the design of DNSSEC is flawed. Exploiting vulnerable recommendations in the DNSSEC standards, they developed a new class of DNSSEC-based algorithmic complexity attacks on DNS, they dubbed KeyTrap attacks. All popular DNS implementations and services are vulnerable. With just a   show more ...  

single DNS packet, the KeyTrap attacks lead to a 2.000.000x spike in CPU instruction count in vulnerable DNS resolvers, stalling some for as long as 16 hours. This devastating effect prompted major DNS vendors to refer to KeyTrap as "the worst attack on DNS ever discovered". Exploiting KeyTrap, an attacker could effectively disable Internet access in any system utilizing a DNSSEC-validating resolver.

 Data Breach News

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), has announced a settlement with Green Ridge Behavioral Health, LLC, a Maryland-based psychiatric practice. This settlement, made under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), follows an investigation   show more ...  

into a ransomware attack that compromised the protected health information of more than 14,000 individuals. Ransomware, malicious software designed to block access to data until a ransom is paid, has become increasingly prevalent, posing a significant threat to patient privacy and healthcare providers’ operations. HHS Second Settlement This settlement represents the second instance where OCR has taken action against a HIPAA-regulated entity in response to a ransomware attack. Earlier, in November 2023, HHS concluded an investigation into a 2018 data breach involving Doctors’ Management Services, culminating in a settlement wherein they levied a penalty of US$100,000 to resolve the issue. According to OCR Director Melanie Fontes Rainer, ransomware attacks leave patients extremely vulnerable, depriving them of access to their medical records and hindering informed decision-making about their health. The severity of these cyberattacks highlights the urgent need for healthcare providers to implement enhanced cybersecurity measures to safeguard patients’ protected health information. “These attacks cause distress for patients who will not have access to their medical records, therefore they may not be able to make the most accurate decisions concerning their health and well-being. Health care providers need to understand the seriousness of these attacks and must have practices in place to ensure patients’ protected health information is not subjected to cyber-attacks such as ransomware,” stated OCR Director Melanie Fontes Rainer in an official release. Investigation Findings: HIPAA Violations Green Ridge Behavioral Health reported a breach to OCR in February 2019, disclosing that their network server had been infected with ransomware, causing the encryption of company files and all patients’ electronic health records. OCR’s subsequent investigation discovered potential violations of the HIPAA Privacy and Security Rule. Among these results, Green Ridge Behavioral Health did not undertake a thorough investigation to identify potential risks and vulnerabilities to electronically protected health information. Furthermore, insufficient security measures were in place to reduce these risks to an acceptable level, and insufficient monitoring of health information system activity made them vulnerable to cyberattacks. As part of the settlement, Green Ridge Behavioral Health has agreed to pay US$40,000 and undertake a corrective action plan overseen by OCR for three years. Key components of the corrective action plan include conducting comprehensive risk analyses, designing a risk management plan, revising policies and procedures to comply with HIPAA Rules, providing workforce training, auditing third-party arrangements, and reporting non-compliance to OCR. The settlement with Green Ridge Behavioral Health sheds light on the escalating cyber threat posed by ransomware and hacking in the healthcare sector. Over the past five years, there has been a significant increase in large breaches involving hacking and ransomware, with hacking alone accounting for 79% of large breaches reported to OCR in 2023. Best Practices: Mitigating Cyber Threats To mitigate and prevent cyber threats, OCR recommends several best practices for healthcare providers, health plans, clearinghouses, and business associates covered by HIPAA. These include reviewing vendor relationships to ensure appropriate agreements are in place, integrating risk analysis into business processes, implementing audit controls, utilizing multi-factor authentication, encrypting protected health information, providing regular training, and incorporating lessons learned from previous incidents into security management processes. The settlement with Green Ridge Behavioral Health serves as a reminder of the critical importance of cybersecurity measures in protecting patient privacy and maintaining trust in the healthcare industry. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Cybersecurity News

Following a sophisticated cyber breach by Chinese hackers targeting senior US government officials, Microsoft has announced a significant expansion of free logging capabilities to strengthen cybersecurity defenses across federal institutions. The action follows revelations that a cyberattack went unnoticed for months,   show more ...  

raising questions about the availability of critical security safeguards. What Exactly Happened? Last year in July 2023, hackers affiliated with the Chinese government exploited a Microsoft signing key to breach the email accounts of high-ranking U.S. government officials. The breach, which remained undetected until the U.S. State Department utilized an expensive logging option, highlighted the critical importance of cybersecurity measures in safeguarding sensitive government information. Microsoft faced intense scrutiny following the revelation, particularly regarding its practice of charging premiums for essential security features. In response, the tech giant swiftly announced plans to enhance the accessibility of logs, acknowledging the necessity of such measures in combating evolving cyber threats. This is How Microsoft Responded The latest development sees Microsoft extending free logging capabilities to all Purview Audit standard customers, including U.S. federal agencies. This expansion follows six months of collaboration with key stakeholders, including the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), and the Office of the National Cyber Director (ONCD). Under the new initiative, the tech giant will automatically enable expanded logs for customer accounts, doubling the default log retention period from 90 to 180 days. This enhancement aligns with CISA’s Secure by Design guidance, which advocates for the provision of high-quality audit logs to customers at no additional cost. The collaboration between Microsoft and federal agencies has also yielded a new Expanded Cloud Log Implementation Playbook, designed to equip agencies with detailed insights into leveraging available logs for threat detection and incident response operations. Eric Goldstein, CISA’s Executive Assistant Director for Cybersecurity, lauded the progress made, emphasizing the importance of accessible security logs in fortifying the nation’s cybersecurity posture. “We look forward to continued progress with our partners to ensure that every organization has access to necessary security logs– a core tenet of our Secure by Design guidance in support of the National Cybersecurity Strategy. Every organization has the right to safe and secure technology, and we continue to make progress toward this goal,” said Goldstein in an official statement. Chris DeRusha, Federal Chief Information Security Officer and Deputy National Cyber Director, echoed Goldstein’s sentiments, emphasizing the pivotal role of upgraded logging features in enhancing threat detection capabilities amidst the federal government’s transition to cloud environments. “The upgraded logging features now available to Microsoft’s government community cloud customers will provide greater visibility, and enable our network defenders to enhance their threat detection capabilities,” said DeRusha. Candice Ling, Senior Vice President at Microsoft Federal, reaffirmed the company’s dedication to partnering with the federal government to bolster cybersecurity defenses. Ling stressed the vital role of advanced logging in countering sophisticated cyber threats, particularly those orchestrated by well-resourced state-sponsored actors. “Microsoft will continue to play a critical role in partnering with the federal government to reinforce our commitment to secure by design and further enhance the security baseline of our nation,” said Ling. This initiative to expand free logging capabilities represents a significant step towards enhance the nation’s cyber defenses, reinforcing the principle of secure-by-design in an ever-changing digital landscape. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Firewall Daily

Tangerine, one of the country’s prominent telcos, found itself grappling with a recent cyber intrusion. The Tangerine data breach led to the unauthorized exposure of personal details belonging to 232,000 customers. The data leak, which occurred on February 18, 2024, came to light when Tangerine’s   show more ...  

management was alerted on February 20, 2024. According to a statement released by the company on February 21, 2024, the compromised information included full names, dates of birth, mobile numbers, email addresses, postal addresses, and Tangerine account numbers.  However, reassuringly, sensitive information such as credit or debit card numbers, driver’s license numbers, ID documentation details, banking details, or passwords remained secure as the company does not store this data. Tangerine Data Breach: The Official Response  Andrew Branson, CEO of Tangerine, expressed his deep regret over the Tangerine data breach incident, emphasizing the company’s dedication to its customers’ security. “No one is more disappointed than me,” Branson stated. “As a founder-led organization, my brother and I put everything we can into the business along with a very talented, committed team. Anything that negatively impacts our loyal customer base hurts, and we sincerely apologize to them for this incident”, reads the press release.  Branson highlighted the proactive measures Tangerine had taken in recent years to safeguard customer data, including a review of the necessity of retaining certain information. “Moving forward,” he affirmed, “we are fully committed to learning from this incident and implementing necessary improvements to prevent similar occurrences in the future.” Upon discovering the Tangerine data leak, the telecommunication organization promptly launched an investigation to identify the root cause. Initial findings revealed that the breach stemmed from a legacy customer database and was traced back to the login credentials of a single user engaged on a contract basis. The company immediately took steps to prevent further unauthorized access, revoking network and system access for the individual user and changing all other team usernames and passwords. Additionally, access to the affected legacy database was promptly closed. Tangerine has engaged external cybersecurity specialists to conduct a comprehensive investigation and is collaborating with the Australian Cyber Security Centre while also notifying the Office of the Australian Information Commissioner of the incident. All impacted customers, spanning from June 2019 to July 2023, were notified via email on February 21, 2024. Cyberattacks on Australia: A Concerning Trend for Organizations Despite the Tangerine breach data incident, the organization assured customers that all accounts are protected with Multi-Factor Authentication (MFA), which remains unaffected. The incident has not disrupted the availability or operation of Tangerine’s services, including NBN and mobile services, which continue to operate as normal and remain safe to use. The Tangerine data breach adds to a concerning trend of cyberattacks targeting Australia’s critical infrastructure and businesses. According to the Annual Cyber Threat Report by the Australian Signals Directorate, cyber incidents in Australia rose by 23% in the fiscal year ending June, with the average damage increasing by 14%. Large businesses suffered average costs of 71,600 Australian dollars ($46,375). The report highlights the seriousness of cyber threats to vital infrastructure entities, exemplified by the November 10 attack on one of Australia’s major port operators, which paralyzed operations at four ports, including those in Sydney and Melbourne. Foreign state actors are suspected in some cases, with Russia and China implicated in malware-based hacks on critical infrastructure. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Feed

The U.S. State Department has announced monetary rewards of up to $15 million for information that could lead to the identification of key leaders within the LockBit ransomware group and the arrest of any individual participating in the operation. "Since January 2020, LockBit actors have executed over 2,000 attacks against victims in the United States, and around the world, causing costly

 Feed

A recently open-sourced network mapping tool called SSH-Snake has been repurposed by threat actors to conduct malicious activities. "SSH-Snake is a self-modifying worm that leverages SSH credentials discovered on a compromised system to start spreading itself throughout the network," Sysdig researcher Miguel Hernández said. "The worm automatically searches through known credential

 Feed

In the past 2 years, we have observed a significant surge in hacktivism activity due to ongoing wars and geopolitical conflicts in various regions. Since the war against Ukraine began, we have witnessed a notable mobilization of non-state and state-backed actors alike, forming new groups or joining existing hacker collectives.  We understand hacktivism as a form of computer hacking that is

 Feed

An installer for a tool likely used by the Russian Consular Department of the Ministry of Foreign Affairs (MID) has been backdoored to deliver a remote access trojan called Konni RAT (aka UpDog). The findings come from German cybersecurity company DCSO, which linked the activity as originating from the Democratic People's Republic of Korea (DPRK)-nexus actors targeting Russia. The

 Feed

Apple has announced a new post-quantum cryptographic protocol called PQ3 that it said will be integrated into iMessage to secure the messaging platform against future attacks arising from the threat of a practical quantum computer. "With compromise-resilient encryption and extensive defenses against even highly sophisticated quantum attacks, PQ3 is the first messaging protocol to reach

 0 - CT - SOC - CSIRT Operations - Red -

The content you are trying to access is private only to member users of the site. You must have a free membership at CISO2CISO.COM to access this content. You can register for free by clicking on the following link: Register for a free membership in CISO2CISO.COM Thank you so much. CISO2CISO Support Team. Username   show more ...  

or E-mail […] La entrada A Detailed Guide on Cewl se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - SOC - CSIRT Operations - Red -

The content you are trying to access is private only to member users of the site. You must have a free membership at CISO2CISO.COM to access this content. You can register for free by clicking on the following link: Register for a free membership in CISO2CISO.COM Thank you so much. CISO2CISO Support Team. La entrada A Deep Dive into Reconnaissance se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.techrepublic.com – Author: John Schoonejongen Ping Identity and Okta are among the top IAM tools on the market today and provide many of the functions large and small companies need when initiating identity and access management systems for their networks. PingOne and Okta offer cloud-based   show more ...  

technology solutions for businesses in need of security upgrades […] La entrada Ping Identity (ForgeRock) vs Okta (2024): Compare IAM software – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Australia

Source: www.techrepublic.com – Author: Ben Abbott Outages and cyber incidents can have a direct impact on a company’s brand, share price and jobs, according to Louise Roberts, managing director at Sphere Public Relations in Australia. She also noted they can cost an “extraordinary” amount of money in lost   show more ...  

revenue and fines. Louise Roberts. Source: Sphere […] La entrada Should IT and Security Teams Play a Role in Crisis Communications? – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Biden

Source: go.theregister.com – Author: Team Register President Biden has empowered the US Coast Guard (USCG) to get a tighter grip on cybersecurity at American ports – including authorizing yet another incident reporting rule. The White House on Wednesday announced Biden’s intention to sign an executive   show more ...  

order giving the Coast Guard “express authority” to deal with […] La entrada Biden asks Coast Guard to create an infosec port in a stormy sea of cyber threats – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Apple

Source: go.theregister.com – Author: Team Register Apple says it’s going to upgrade the cryptographic protocol used by iMessage to hopefully prevent the decryption of conversations by quantum computers, should those machines ever exist in a meaningful way. The protocol, dubbed PQ3, is intended to   show more ...  

safeguard users’ chats in some future era of quantum computing, when […] La entrada Apple promises to protect iMessage chats from quantum computers – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Two Chinese nationals are facing a maximum of 20 years in prison after being convicted of mailing thousands of fake iPhones to Apple for repair in the hope they’d be replaced with new handsets. This is according to the Attorney’s Office for the   show more ...  

District of Columbia following the decision […] La entrada Duo face 20 years in prison over counterfeit iPhone scam – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Infosec researchers say urgent patching of the latest remote code execution (RCE) vulnerability in ConnectWise’s ScreenConnect is required given its maximum severity score. The vulnerability has been given a maximum 10/10 CVSS rating by ConnectWise, one   show more ...  

that outside researchers agree with given the potential consequences of a successful exploit. […] La entrada Exploiting the latest max-severity ConnectWise bug is ’embarrassingly easy’ – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register The latest revelation from law enforcement authorities in relation to this week’s LockBit leaks is that the ransomware group had registered nearly 200 “affiliates” over the past two years. Affiliates are those people who buy into the   show more ...  

gang’s ransomware-as-a-service model, and happily use LockBit’s wares in exchange for a […] La entrada LockBit leaks expose nearly 200 affiliates and bespoke data-stealing malware – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Webinar The complexity facing businesses as they make the necessary transition to cloud-native applications and multi-cloud architectures keeps cloud teams firmly on the frontline when it comes to implementing security policies. The constant risks of   show more ...  

misconfiguration and malicious attack demand that already overstretched cloud security practitioners have to find […] La entrada Harness the power of security automation – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blog

Source: securityboulevard.com – Author: claude.mandy This blog originally appeared here: https://aws.amazon.com/blogs/apn/cloud-native-data-security-posture-management-deployments-on-aws-with-symmetry-systems/ With Amazon Web Services (AWS), you can manage the privacy of your data, control how it’s used,   show more ...  

where it’s stored, who has access to it, and how it’s encrypted. Services such as AWS Identity and Access Management (IAM) allows you to securely manage access to AWS services […] La entrada Cloud-Native Data Security Posture Management Deployments on AWS with Symmetry Systems – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Digital Defense by Fortra Any business that accepts credit card payments is subject to a set of security guidelines in the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS covers how customer payment data is stored, transmitted, processed, and protected to   show more ...  

prevent credit card fraud and sensitive data breaches. […] La entrada Frontline PCI-ASV Scanning Datasheet – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Aaron Linskens Wednesday, February 21, 2024 Security Boulevard The Home of the Security Bloggers Network Community Chats Webinars Library Home Cybersecurity News Features Industry Spotlight News Releases Security Bloggers Network Latest Posts Syndicate Your Blog Write for   show more ...  

Security Boulevard Webinars Upcoming Webinars Calendar View On-Demand Webinars Events Upcoming Events On-Demand Events […] La entrada Why SBOMs are essential for every organization – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 configuration management

Source: securityboulevard.com – Author: Garrett Foster TL;DR: SCCM sites configured to support high availability can be abused to compromise the entire hierarchy I previously wrote about how targeting site systems hosting the SMS Provider role can be used to compromise a SCCM hierarchy. In that blog, I   show more ...  

discussed high availability (HA) for the SMS Provider […] La entrada SCCM Hierarchy Takeover with High Availability – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: AJ Starita Containers offer many benefits, including lightweight portability from one environment to another, but they add a layer of complexity to application security that can introduce additional risks.  There are many ways a container can become vulnerable to attack:   show more ...  

through its source code, how the container is built, how the […] La entrada How is a Container Scan Done? – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the   show more ...  

organizations YouTube channel. *** This is a Security Bloggers Network syndicated blog from Infosecurity.US authored […] La entrada USENIX Security ’23 – William E. Bodell III, Sajad Meisami, Yue Duan – Proxy Hunting: Understanding and Characterizing Proxy-based Upgradeable Smart Contracts in Blockchains – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Colleges

Source: securityboulevard.com – Author: Kevin Smith Keeping students’ data safe from prying eyes and malicious actors isn’t as simple as it used to be.  Students are constantly engaging online with each other, teachers, and educational platforms. Since the Covid pandemic, education has become even more   show more ...  

digitized, and the threat has only expanded. More than 90% […] La entrada How Schools Can Comply with the Three Biggest Online Student Privacy Laws – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Cyborg Security Get ready to elevate your threat hunting skills with Cyborg Security’s exhilarating and interactive workshop, focusing on the pivotal MITRE ATT&CK Tactic: Initial Access. This isn’t just another workshop; it’s an opportunity to immerse yourself   show more ...  

in the world of advanced threat hunting, guided by the expertise of Cyborg Security’s […] La entrada Threat Hunting Workshop 10: Hunting for Initial Access – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Best Practices

Source: securityboulevard.com – Author: Tal Zacks Find out the key capabilities of secret scanners and what to consider when searching for a solution.  Background In today’s software development ecosystem, software architectures rely on rapid communication between microservices and access to cloud and   show more ...  

third-party resources. Facilitating these transactions are a multitude of authentication credentials, commonly referred […] La entrada What to Look for in a Secrets Scanner – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Wes Wright Identify and address at-risk assets to protect your healthcare enterprise On November 20, 2023, the Cybersecurity Infrastructure and Security Agency (CISA) issued guidance for healthcare delivery organizations (HDOs) struggling to secure their data and systems   show more ...  

against a growing and pernicious onslaught of attacks from threat actors across the globe. […] La entrada CISA Mitigation Guide for Healthcare Organizations: Part Three – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: grahamcluley.com – Author: Graham Cluley Heaven’s above! Scammers are exploiting online funerals, and Lockbit – the “Walmart of Ransomware” – is dismantled in style by cyber cops. All this and more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity   show more ...  

veterans Graham Cluley and Carole Theriault. Warning: This podcast may […] La entrada Smashing Security podcast #360: Lockbit locked out, and funeral Facebook scams – Source: grahamcluley.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team By Yiyi Miao, Chief Product Officer, OPSWAT In the ever-changing domain of cybersecurity, organizations continue to face multifaceted challenges with protecting their digital assets and infrastructure. A new report, written by MIT professor Stuart Madnic   show more ...  

and funded by Apple, showed 20 percent more data breaches in the first nine […] La entrada Building a Better Perimeter Defense Strategy to Meet the Challenges of 2024 – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team By Alan Bavosa, VP of Security Products, Appdome The significant growth and mass adoption of mobile applications has completely transformed the way users engage with brands today. From managing finances to indulging in leisurely pursuits, mobile apps have   show more ...  

become an integral and expected part of our daily lives. In […] La entrada New Year, New Consumer Demands in Cybersecurity: Navigating the Landscape of Consumer Expectations and App Developer Responsibility in Mobile App Security – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: cyberdefensewebinars.com – Author: Nick SIGN UP NOW Most organizations have some kind of processes established for their day-to-day cyber security program, but most are missing the fact that while cyber security is important, information security is the focal point of many areas in which organizations   show more ...  

are struggling. How can an organization manage all of […] La entrada Webinar: Managing Without Governing? Why Your Organization Needs a Management System to Govern Your Information Resilience Program – Source: cyberdefensewebinars.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team What we can expect from advanced threat actor groups in the new year. By Jason Martin, Co-founder and Co-CEO at Permiso Security In 2023, we started to witness a change in the way both attackers and defenders thought about cloud security. The days when   show more ...  

attackers target a single service […] La entrada How The Security of The Cloud’s Supply Chain Will Shift in 2024 – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team By Divakar Kolhe, Digital Marketer, Market Research Future (Part of Wantstats Research and Media Private Limited) Hyperautomation: Revolutionizing the Security Market In today’s digital age, the security landscape is constantly evolving, presenting new   show more ...  

challenges and threats that require innovative solutions. With the growing complexity of cyber threats and the […] La entrada Hyperautomation: Revolutionizing the Security Market – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team By Neil Serebryany, CEO and Founder of CalypsoAI Generative artificial intelligence (GenAI) models, including large language models (LLMs) have been the focal point of the business world’s attention since ChatGPT made its debut just a year ago. They   show more ...  

have revolutionized operational practices across sectors, from streamlining supply chains to […] La entrada Four Ways Genai Will Change the Contours Of The Corporate Landscape In 2024 – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team A NEW era of global instability is dawning. By Sebastian Schaub, CEO, hide.me Russia’s ongoing invasion of Ukraine continues to fan the flames of war in Europe. American and Chinese global interests appear increasingly incompatible, threatening a second   show more ...  

Cold War. And now that Israel’s long-standing conflict with Palestine has […] La entrada VPNs in Times of War: Why a Rise in Global Conflicts Mean Citizens Now Need VPNs More Than Ever – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team By Kevin Kennedy, SVP Products, Vectra AI Now more than ever, companies need effective security solutions. The cost of global cybercrime is projected to grow by seventeen percent each year, reaching a staggering $12 trillion USD, cumulatively, by 2025.   show more ...  

Thankfully, fire can be used to fight fire: AI can help […] La entrada Getting AI Right for Security: 5 Principles – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team By Caroline McCaffrey, CEO and Co-founder, ClearOPS Most people find themselves in cybersecurity because they find its ever-changing landscape interesting. 2023 did not disappoint with new concerns over liability in the CISO role coupled with greater   show more ...  

restrictions from the SEC and various state privacy laws. These concerns and, frankly, […] La entrada From Virtual Visions to Tangible Profits: A Founder’s Guide to Launching a vCISO Firm in 2024 – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.techrepublic.com – Author: Franklin Okeke We may earn from vendors via affiliate links or sponsorships. This might affect product placement on our site, but not the content of our reviews. See our Terms of Use for details. Explore the top open source IAM (Identity and Access Management) tools, their   show more ...  

features and how they can […] La entrada 6 Best Open Source IAM Tools in 2024 – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-02
Aggregator history
Thursday, February 22
THU
FRI
SAT
SUN
MON
TUE
WED
FebruaryMarchApril