Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Apple has released a ...

 Privacy

The widespread use of quantum computers in the near future may allow hackers to decrypt messages that were encrypted with classical cryptography methods at astonishing speed. Apple has proposed a solution to this potential problem: after the next update of their OSes, conversations in iMessage will be protected by a   show more ...  

new post-quantum cryptographic protocol called PQ3. This technology allows you to change the algorithms of end-to-end encryption with a public key so that they can work on classical non-quantum computers, but will provide protection against potential hacking coming from using future quantum computers. Today well go over how this new encryption protocol works, and why its needed. How PQ3 works All popular instant messaging applications and services today implement standard asymmetric encryption methods using a public and private key pair. The public key is used to encrypt sent messages and can be transmitted over insecure channels. The private key is most commonly used to create symmetric session keys that are then used to encrypt messages. This level of security is sufficient for now, but Apple is playing it safe – fearing that hackers may be preparing for quantum computers ahead of time. Due to the low cost of data storage, attackers can collect huge amounts of encrypted data and store it until it can be decrypted using quantum computers. To prevent this, Apple has developed a new cryptographic protection protocol called PQ3. The key exchange is now protected with an additional post-quantum component. It also minimizes the number of messages that could potentially be decrypted. Types of cryptography used in messengers. Source The PQ3 protocol will be available in iOS 17.4, iPadOS 17.4, macOS 14.4, and watchOS 10.4. The transition to the new protocol will be gradual: firstly, all user conversations on PQ3-enabled devices will be automatically switched to this protocol; then, later in 2024, Apple plans to completely replace the previously used protocol of end-to-end encryption. Generally, credit is due to Apple for this imminent security boost; however, the company isnt the first to provide post-quantum cybersecurity of instant messaging services and applications. In the fall of 2023, Signals developers added support for a similar protocol PQXDH, which provides post-quantum instant messaging security for users of updated versions of Signal when creating new secure chats. How the advent of PQ3 will affect the security of Apple users In essence, Apple is adding a post-quantum component to iMessages overall message encryption scheme. In fact, PQ3 will only be one element in its security approach along with traditional ECDSA asymmetric encryption. However, relying solely on post-quantum protection technologies isnt advised. Igor Kuznetsov, Director of Kasperskys Global Research and Analysis Team (GReAT), commented on Apples innovations as follows: Since PQ3 still relies on traditional signature algorithms for message authentication, a man-in-middle attacker with a powerful quantum computer (yet to be created) may still have a chance of hacking it. Does it offer protection against adversaries capable of compromising the device or unlocking it? No, PQ3 only protects the transport layer. Once a message is delivered to an iDevice, theres no difference – it can be read from the screen, extracted by law enforcement after unlocking the phone, or exfiltrated by advanced attackers using Pegasus, TriangleDB or similar software. Thus, those concerned about the protection of their data should not rely only on modern post-quantum cryptographic protocols. Its important to ensure full protection of your device to make sure third-parties cant reach your instant messages.

image for Quik Pawn Shop Falls ...

 Dark Web News

The Akira ransomware group has allegedly claimed the Quik Pawn Shop cyberattack on the dark web, adding yet another victim to their list. The cyberattack on Quik Pawn Shop, which occurred on February 22, 2024, has left Quik Pawn Shop grappling with the aftermath of a data breach. Established in 1978, Quik Pawn Shops   show more ...  

has been serving customers across 15 locations in the Montgomery, Birmingham, Mobile, and Tuscaloosa areas. Offering a range of financial services including pawn loans, title loans, cash advances, installment loans, and check cashing, the company has been a trusted resource for many in need of quick financial solutions. Quik Pawn Shop Cyberattack Claimed by Akira Ransomware Source: X The cybercriminals behind the attack have claimed to have obtained 140 GB of files from Quik Pawn Shop’s systems, along with a database containing extensive customer information. This data includes millions of records containing sensitive details such as dates of birth, addresses, Social Security numbers, and financial transaction histories. “We obtained 140GB of files from this organization and make them available for you soon. There is also a BD with complete information about their customers. Millions of lines with DOB, addresses, SSNs, financial transactions, and stuff like that”, read the threat actor post. The Cyber Express has tried reaching out to Quik Pawn Shop to learn more about this Akira ransomware attack. However, at the time of writing this, the company’s website appears to be offline. Visitors to the site are met with an error message stating, “This site can’t be reached. Check if there is a typo in quikpawnshop.com.” This outage has hindered communication with the organization, leaving customers in the dark about the extent of the breach and its implications. Decoding the Error Codes and Cyberattacks on Pawn Shops The sudden disruption of the website is a common consequence of cyberattacks, which can take various forms including Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks. These malicious activities overload the website’s servers, rendering them inaccessible to legitimate users. Additionally, DNS hijacking may have occurred, redirecting traffic away from the intended destination or disrupting normal website functionality. The error message “DNS_PROBE_FINISHED_NXDOMAIN”, visible on the Quik Pawn Shop website, was encountered by users typically signifying a failure in the Domain Name System (DNS) lookup process. This prevents the browser from resolving the domain name to an IP address, resulting in the inability to load the website. Data security breaches like the one experienced by Quik Pawn Shop can have severe repercussions, compromising the confidentiality and integrity of sensitive information. In the context of pawn shops, where personal data is routinely collected from customers, the risk of exposure is particularly high. Names, addresses, Social Security numbers, and financial details stored in databases are prime targets for cybercriminals seeking to exploit such information for financial gain or other malicious purposes. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for ThreeAM Ransomware H ...

 Firewall Daily

ThreeAM ransomware group has struck again, this time targeting Abcor in Australia and MTM Robotics in the United States. The dark web portal of the nefarious group now lists these two companies as its latest victims, adding to the growing concern ThreeAM ransomware cyberattack. Abcor, a prominent player in the   show more ...  

industry, operates through its division, Preston General Engineering (PGE), specializing in the fabrication and assembly of metal, aluminum, and stainless steel parts. With a reputation built on delivering quality products and services, PGE’s inclusion on ThreeAM’s roster underscores the indiscriminate nature of cyberattacks. Meanwhile, MTM Robotics, known for its innovative contributions to aviation technology, has been a key player in revolutionizing aircraft manufacturing processes. Having garnered accolades such as the Airbus Innovation Award, MTM’s collaboration with major industry players reflects its significant stature in the field. Despite the seriousness of the situation, the lack of disclosure regarding the full extent of the ThreeAM ransomware cyberattack and the motives behind it leaves businesses grappling with uncertainty. The opacity surrounding the ThreeAM ransomware cyberattack raises questions about the true intentions of the ransomware group and the potential scope of the breach. Source FalconFeedsio Source: FalconFeedsio Moreover, the fact that the targeted companies’ official websites remain operational adds another layer of complexity, casting doubt on the authenticity of the ThreeAM ransomware cyberattack claims made by the threat actor. Implication ThreeAM Ransomware Cyberattack However, if proven true, the implications of such an attack could be far-reaching. Beyond the immediate financial losses incurred through potential ransom payments or remediation efforts, there are broader implications for the affected companies and their stakeholders. A successful ThreeAM ransomware cyberattack could lead to compromised sensitive data, including proprietary information, customer data, and intellectual property, resulting in reputational damage and loss of trust among clients and partners. Furthermore, the ripple effects of a ThreeAM ransomware cyberattack extend beyond the targeted companies themselves, impacting supply chain partners, customers, and the broader economy. The disruption caused by data breaches can lead to operational downtime, productivity losses, and legal ramifications, with potential regulatory penalties for non-compliance with data protection regulations. Moreover, in an increasingly interconnected digital landscape, the interconnected nature of business ecosystems means that a cyberattack on one company can have cascading effects on others. The interconnectedness of supply chains and the reliance on shared infrastructure amplify the potential for cyber threats to spread across industries and geographies. ThreeAM Ransomware Targeting SMEs The evolving threat landscape posed by groups like ThreeAM highlights the persistent danger faced by small and medium enterprises (SMEs) worldwide. Operating with the aim of financial gain through illicit means, ThreeAM exemplifies the growing sophistication of cybercriminals in exploiting vulnerabilities within organizational systems. Recent insights into the workings of ThreeAM ransomware, provided by security analysts at Intrinsic, shed light on the group’s modus operandi. Unlike more refined counterparts, ThreeAM may appear less sophisticated, yet its impact can be substantial, particularly on SMEs with limited resources and cybersecurity measures in place. Utilizing X/Twitter bots and the Rust programming language for its operations, ThreeAM represents a new entrant in the malware domain, capable of targeting unsuspecting victims with relative ease. The group’s activities, characterized by a series of calculated strikes aimed at US businesses, highlight the need for enhanced cybersecurity measures across industries. Moreover, Symantec’s report linking ThreeAM ransomware to the ex-Conti-Ryuk-TrickBot nexus underscores the complexity of these cyber threats. With Rust-based technology at its core, ThreeAM emerges as a fallback option for failed LockBit deployments, further complicating the cybersecurity landscape. A closer examination of ThreeAM’s infrastructure reveals domains masquerading as US entities and hosting servers displaying a common Apache banner. These elements serve as the backdrop for the group’s malicious activities, posing a significant challenge to cybersecurity professionals tasked with mitigating the threat posed by such ransomware groups. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Operation Cronos: La ...

 Dark Web News

In the wake of the comprehensive LockBit takedown by law enforcement agencies, the aftermath has been significant. Subsequent to the recent disruption of LockBit, law enforcement authorities have uncovered additional intelligence on the LockBit ransomware group and its network of affiliates, particularly concerning   show more ...  

numerous Bitcoin addresses and financial assets. After the arrest of Russian nationals, Artur Sungatov and Ivan Gennadievich Kondratiev (aka Bassterlord), the authorities have found a trove of 30,000 Bitcoin addresses associated with the LockBit ransomware and its affiliates. This decisive move not only inflicts a substantial financial setback on cybercriminals but also sends a resounding message of deterrence to those lurking in the clandestine depths of the dark web. The LockBit takedown campaign, known as Operation Cronos, marks a crucial step in the ongoing efforts to dismantle cybercriminal networks. With 193 affiliates implicated at the time of the seizure, the scale of LockBit’s operations comes into stark relief. Notably, LockBit was also associated with other threat actors and groups, such as Evil Corp and FIN7, also known as Carbon Spider or Sangria Tempest. The LockBit Takedown: Operation Cronos’ Global Security Action Plan Through Operation Cronos, insights into the workings of LockBit and its affiliates have emerged, shedding light on the vast profits accumulated over the years. A tweet from security researcher Dominic Alvieri offers a glimpse, revealing a post from the LockBit ransomware group’s extensive financial gains amassed during their four-year operation. Source: Dominic Alvieri on X Furthermore, the affiliation of LockBit with various threat actors highlights the complex web of cybercriminal activity. EvilCorp, FIN7, and others are among the 11 threat actors associated with LockBit, emphasizing the interconnected nature of dark web actors. The National Crime Agency, working with Operation Cronos, has conducted a crypto chain analysis on the LockBit ransomware group, revealing insights into their operation. From LockBit’s systems, approximately 30,000 BTC addresses were obtained, with over 500 of them actively transacting on the blockchain.  Source: Dominic Alvieri on X The collective value of these transactions exceeds £100 million at the current BTC valuation, with over 2,200 BTC remaining unspent, totaling over £90 million. These funds consist of payments from both victims and LockBit affiliates, with a notable portion representing the 20% fee paid to LockBit. Consequently, the actual ransom payments are substantially higher than initially estimated.  These funds comprise both victim payments and LockBit’s fees, with actual ransom payments likely far surpassing these figures. LockBit Members Arrested But They Beg to Differ This news follows recent developments in the crackdown on LockBit cybercrime activities. Ukraine’s arrest of a father-son duo linked to LockBit highlights international cooperation in combating cyber threats. Similarly, the United States has brought charges against two Russian nationals for deploying LockBit ransomware tools globally, highlighting the widespread impact of criminal activities associated with LocKbit. Despite these crackdowns, LockBit’s administration denies the legitimacy of the arrests, questioning the credibility of law enforcement agencies. Offering a substantial bounty for information on their members, LockBit challenges the investigative capabilities of authorities, signaling a defiant stance in the face of intensified scrutiny. In essence, the takedown of LockBit and its affiliates represents a long awaited victory in the ongoing battle against cybercrime. However, as cybercriminals adapt and evolve, sustained collaboration and innovation will be crucial in staying one step ahead in the fight to safeguard digital ecosystems. Fixing the Fallout: Authorities Offering Decrypters to Victims Authorities are providing decryption tools to victims of the LockBit 3.0 ransomware attack. Upon accessing the designated site, users encounter a message indicating control by the UK, US, and Cronos Task Force, along with law enforcement agencies like the National Crime Agency and Europol. Source: X The site features updates on investigations, including recent indictments by the FBI and sanctions imposed by the US against cyber threat actors. Additionally, a recovery tool developed in Japan is highlighted for accessing encrypted files, expanding Europol’s #Nomoreransom initiative. Notably, a redirection ban is enforced on LockBit 3.0, while the authorities offer assistance in decryption and recovery. The site emphasizes reporting cyberattacks and provides insights into cyber choices. Recent activities in Poland and Ukraine are also documented. Overall, amidst ongoing law enforcement efforts and international cooperation, victims are encouraged to utilize available tools and resources to combat the LockBit 3.0 ransomware threat. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Infiniti USA Cyberat ...

 Dark Web News

Infiniti USA, the luxury vehicle division of the Japanese automaker Nissan, became the alleged target of a sophisticated cyberattack by a new ransomware group. The assailants, identified as the Mogilevich ransomware group, orchestrated the meticulously planned Infiniti USA cyberattack, compromising a substantial   show more ...  

amount of sensitive data.  The initial announcement of the cyberattack on Infiniti USA surfaced on the dark web, where the Mogilevich group proclaimed their success in infiltrating Infiniti USA’s systems and also posted about the organization’s revenue totaling $528.5 million. The compromised data, adding to 22GB, allegedly included a dataset of confidential information, ranging from vehicle identification numbers (VINs) to customer names, addresses, emails, and passwords.  Such a vast repository of personal data poses grave implications for both the affected individuals and the organization, highlighting the dire consequences of cyber intrusions. Mogilevich Ransomware Alleges Infiniti USA Cyberattack Moreover, the brazen nature of the threat actor’s post, accompanied by a deadline for the sale of the stolen data, signifies a new level of audacity in the realm of cybercrime. The Mogilevich group’s unabashed admission of their economic motives sets them apart from other ransomware groups, dispelling any illusions of noble intentions.  Source: X Their series of posts on the dark web further clarify their modus operandi, emphasizing professionalism, transparency, and privacy—a stark contrast to the nature of their criminal activities associated with ransomware groups on the dark web. “We are Mogilevich, a group dedicated to data extortion. Our agenda is to severely punish companies and corporations that fail to keep their infrastructure under control and security. Our operators are skilled pentesters and in contrast to other groups like ours in which they lie about their purpose, we agree from the beginning that we are doing it for economic interest. Don’t believe the bullshit of those who say that their reason is to revolutionize cyberspace”, reads the threat actor post.  The Emergence of Mogilevich Ransomware Group The Cyber Express has reached out to the organization to learn more about the Infiniti USA cyberattack and any information associated with the threat actor. However, at the time of writing, no official statement or response has been received, leaving the claims for the cyberattack on Infiniti USA stand unconfirmed.  Moreover, the implications of such a breach extend far beyond the confines of a single organization. The potential ramifications for customer trust, brand reputation, and regulatory compliance loom large, necessitating prompt action to mitigate the fallout from the incident. Source: Wikipedia The emergence of the Mogilevich ransomware group, potentially named after the infamous transnational crime boss Semion Mogilevich, adds a layer of complexity to an already convoluted situation. Drawing inspiration from its namesake, the group seeks to emulate the influence of Semion Mogilevich, posing a formidable challenge to law enforcement agencies and cybersecurity experts alike. Furthermore, the timing of the cyberattack coincides with the downfall of the LockBit ransomware group. Recently, UK Law enforcement agencies’ successfully dismantled LockBit’s infrastructure. However, the quick emergence of new threat actors such as the Mogilevich group hints at a possible network of threat actors continuously pushing and supporting each other in global collaboration.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Recruitment Firm Das ...

 Firewall Daily

Das Team Ag, a prominent national job placement agency with 25 branches across Switzerland and the Principality of Liechtenstein, confirmed that they fell victim to a cyberattack by the notorious Black Basta ransomware group. The Das Team Ag cyberattack targeted the company’s website and was listed as the victim on   show more ...  

the data leak channel operated by the threat actor. In a response to TCE, the recruitment firm acknowledged the attack and asserted to “minimize the consequences for everyone involved as far as possible”. Established for over three decades, Das Team Ag has built a reputation for its expertise in personnel placement across diverse sectors such as construction, technology, pharmaceuticals, and more. Das Team Ag Cyberattack by Black Basta Ransomware Group Source: X Although the ransomware group took responsibility for the cyberattack on Das Team Ag, no concrete evidence or sample data regarding the breach has been provided. The Cyber Express has reached out to the organization to learn more about this cyberattack on Das Team Ag and the perpetrators behind it.  In a conversation with TCE, a spokesperson for Das Team Ag confirmed the attack. In a statement shared with TCE, the spokesperson said, “We can confirm that the incident happened and can assure you that we take it very seriously and that we are treating it as a top priority. We are currently working with external specialists to analyze the leaked documents and take the necessary measures to minimize the consequences for everyone involved as far as possible. All persons currently confirmed as affected have been informed and we are working with law enforcement” Despite the lack of mythology used by the threat actors to target Das Team Ag website, it’s speculated that the Black Basta ransomware group may have targeted the website’s backend rather than opting for overt tactics like Distributed Denial-of-Service (DDoS) attack or defacement.  This strategic move aligns with the modus operandi of many threat actors, who prioritize infiltrating databases to access sensitive information such as financial records and personal data. By maintaining clandestine access, cybercriminals can exploit vulnerabilities over an extended period, posing a persistent threat to both the security and reputation of the targeted organization. Cyberattacks on the Recruitment Industry  The Das Team Ag cyberattack is not an isolated event. Over the years, this sector has increasingly become a prime target for cyber threats due to the vast amounts of sensitive data it houses. From client and candidate information to financial records and personal details, recruitment agencies store a treasure trove of data that is highly coveted by malicious actors. The repercussions of such cyberattacks extend far beyond the immediate breach. Apart from tarnishing the brand reputation and eroding client trust, these incidents can lead to legal ramifications, with affected individuals potentially seeking recourse for the compromise of their personal data.  Moreover, the emotional toll on those whose privacy has been violated cannot be understated, fostering a climate of distrust that could deter future candidates from engaging with recruitment agencies. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for CISA Launches RRAP t ...

 Cybersecurity News

CISA, in collaboration with the American Samoa Department of Homeland Security, has initiated the groundbreaking Regional Resiliency Assessment Program (RRAP), marking a significant step towards strengthening critical infrastructure resilience and fostering collaborative efforts. The primary objective of the CISA   show more ...  

RRAP is to cultivate a comprehensive understanding and promote actionable measures among both public and private sector entities to fortify the resilience of a region’s critical infrastructure. Key to the success of RRAP is the establishment of partnerships encompassing federal, state, local, and territorial government agencies, as well as private sector organizations spanning various disciplines. Objective of CISA RRAP Engagement within the RRAP framework encompasses a diverse array of stakeholders, including private sector facility owners and operators, industry associations, emergency response and recovery entities, utility providers, transportation authorities, planning commissions, law enforcement agencies, academic institutions, and research centers. Source: Twitter The CISA RRAP process typically unfolds over the course of a year, involving meticulous data collection and analysis concerning the critical infrastructure within the designated region. Subsequently, ongoing technical support is provided to augment the resilience of identified infrastructure components. Each RRAP project is tailored to accommodate a spectrum of analytical activities, fostering invaluable information exchange opportunities. The overarching objective of CISA RRAP is encapsulated in the culmination of its activities: the Resiliency Assessment report. This comprehensive document encapsulates project outcomes and insights, delineating key regional resilience gaps and offering actionable strategies to address these deficiencies. Goals of CISA RRAP The goals of the CISA RRAP program are multi-faceted, aiming to: Resolve existing knowledge gaps pertaining to infrastructure security and resilience. Facilitate informed risk management decisions among stakeholders. Identify avenues and strategies to fortify infrastructure resilience. Cultivate and enhance critical partnerships spanning public and private sectors. The insights gleaned from CISA RRAP Resiliency Assessments serve as a pivotal resource for facility owners, regional entities, and government agencies. By leveraging the findings, stakeholders can strategically channel investments toward equipment, planning initiatives, training endeavors, and infrastructure development endeavors. This strategic approach is instrumental in augmenting the resilience and security not only of critical infrastructure but also of the surrounding communities and entire regions at large. The launch of the Regional Resiliency Assessment Program highlights a concerted effort to bolster critical infrastructure resilience and foster collaborative engagement across diverse sectors. As CISA RRAP endeavors continue to unfold, stakeholders remain poised to harness the program’s insights to fortify infrastructure, mitigate risks, and safeguard communities against a spectrum of threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Geopolitical, Terrorism

Russian-linked threat actors conducted a multiwave campaign, Operation Texonto, using a combination of pysops and spear-phishing to spread misinformation in Ukraine and target Microsoft 365 credentials across Europe.

 Malware and Vulnerabilities

Researchers spotted a new Migo malware targeting Redis servers to mine cryptocurrency and utilizing system-weakening commands to disable security features. Migo is distributed as a Golang ELF binary, with compile-time obfuscation and the ability to persist on Linux hosts. Organizations are expected to expedite their threat-hunting and investigation processes by leveraging IOCs associated with the malware.

 Incident Response, Learnings

Two Chinese nationals, Haotian Sun and Pengfei Xue, have been found guilty of running a fraudulent scheme targeting Apple. They sent thousands of fake iPhones to Apple for repair, hoping to receive genuine replacements.

 Firewall Daily

In a move aimed at fortifying the cybersecurity of U.S. ports and maritime cybersecurity, the Biden-Harris Administration has announced a comprehensive initiative. This initiative, set to be formalized through an Executive Order on February 22, encompasses a series of strategic steps designed to bolster cybersecurity   show more ...  

in the USA, reinforce supply chains, and revitalize domestic manufacturing capacity. The significance of cybersecurity in the USA cannot be overstated. As the backbone of the nation’s Marine Transportation System (MTS), these ports facilitate over $5.4 trillion in economic activity annually and sustain employment for more than 31 million Americans. Recognizing the integral role of maritime cybersecurity, the administration is committed to safeguarding these vital assets against evolving cyber threats. Biden-Harris Administration and Cybersecurity in the USA Central to the Biden-Harris Administration’s plan is the reinforcement of the Department of Homeland Security’s authority to address cybersecurity challenges within the maritime domain. The executive order empowers the U.S. coast guard to take proactive measures against cyber threats, including the imposition of cybersecurity standards to secure port networks and systems. Notably, this entails mandatory reporting of cyber incidents endangering maritime infrastructure. In a bid to mitigate vulnerabilities, the U.S. coast guard will issue a Maritime Security Directive focusing on cyber risk management for ship-to-shore cranes manufactured by the People’s Republic of China. This directive mandates actions to secure cranes and associated IT and OT systems, aligning with the broader objective of enhancing the digital resilience of maritime infrastructure. Furthermore, the administration is advancing regulatory frameworks to strengthen cybersecurity in the Marine Transportation System. Through a Notice of Proposed Rulemaking, minimum cybersecurity requirements will be established to mitigate unauthorized access attempts targeting MTS control systems. These efforts highlights a commitment to leveraging regulatory mechanisms in safeguarding critical infrastructure from cyber threats. Investments for the USA Cybersecurity Plan In parallel, the administration is undertaking substantial investments for the USA cybersecurity plan, totaling over $20 billion over the next five years. This funding, allocated through initiatives like the Bipartisan Infrastructure Law, aims to revitalize domestic manufacturing capacity for port cranes. PACECO Corp., a subsidiary of Mitsui E&S Co., Ltd (Japan), is positioned to lead this endeavor, marking a significant milestone in onshoring crane production after three decades. The announcement coincides with the Biden-Harris Administration’s ongoing efforts to showcase the impacts of its Investing in America agenda. By prioritizing cybersecurity in USA ports and the maritime sector, the administration highlights its commitment to bolstering national security, revitalizing domestic industries, and fortifying supply chains. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Firewall Daily

Change Healthcare, a leading U.S. healthcare technology provider has confirmed a cyberattack on its systems, causing widespread disruptions to healthcare services across the country. In a statement released Wednesday, the company acknowledged experiencing a network interruption related to a cybersecurity issue. This   show more ...  

cyberattack on Change Healthcare highlights the growing threat posed by malicious actors targeting critical infrastructure in the healthcare sector. Additionally, the Change Healthcare cyberattack has raised concerns about the vulnerability of healthcare organizations to cyber threats and highlights the urgent need for enhanced cybersecurity measures to protect patient data and ensure the continuity of healthcare services. Cyberattack on Change Healthcare: Immediate Action Taken The cyberattack on Change Healthcare, described as an “enterprise-wide connectivity issue,” has prompted the firm to take immediate action, disconnecting its systems to prevent further impact. The company’s security experts are actively working to address the matter, but the disruption is expected to persist at least through the day. Change Healthcare is experiencing a network interruption related to a cyber security issue and our security experts are working to address the matter. The disruption is expected to last at least through the day. We will provide updates as more information becomes available,” reads the official statement. While the specific nature of the cyberattack on Change Healthcare remains undisclosed, the Organization has assured that it is specific to its systems, and all other operations within the UnitedHealth Group, its parent company, remain operational. “At this time, we believe the issue is specific to Change Healthcare and all other systems across UnitedHealth Group are operational,” the Company informed. Nationwide Outage Affects Healthcare Organizations and Pharmacies The Change Healthcare cyberattack, which began with disruptions to some applications on February 21, has escalated into a nationwide outage affecting various healthcare organizations and pharmacies. Local reports, such as those from the Huron Daily Tribune in Michigan, indicate that pharmacies are unable to process prescriptions through patients’ insurance due to the cyberattack on Change Healthcare. Additionally, Scheurer Health, a healthcare provider in Michigan, confirmed on its Facebook page that it is unable to process prescriptions due to the “nationwide outage from the largest prescription processor in North America,” referring to Change Healthcare cyberattack. The cyberattack on Change Healthcare comes amidst the backdrop of the 2022 merger between UnitedHealth Group, Optum, and Change Healthcare in a landmark $7.8 billion deal. This merger granted Optum, a healthcare services giant, broad access to patient records of millions of Americans. Optum, which provides technology and data services to insurance companies and healthcare providers, is now grappling with the repercussions of the cyber incident affecting its subsidiary, Change Healthcare. As the situation unfolds, The Cyber Express team has attempted to gather further information from officials but has yet to receive an official response. This developing story highlights the critical importance of cybersecurity in safeguarding healthcare systems and the need for swift action to mitigate the impact on patient care. Stay tuned for updates as more information becomes available on this evolving Change Healthcare cyberattack affecting healthcare services nationwide. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Feed

Details have emerged about a now-patched high-severity security flaw in Apple's Shortcuts app that could permit a shortcut to access sensitive information on the device without users' consent. The vulnerability, tracked as CVE-2024-23204 (CVSS score: 7.5), was addressed by Apple on January 22, 2024, with the release of iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3, and 

 Feed

The U.S. Federal Trade Commission (FTC) has hit antivirus vendor Avast with a $16.5 million fine over charges that the firm sold users' browsing data to advertisers after claiming its products would block online tracking. In addition, the company has been banned from selling or licensing any web browsing data for advertising purposes. It will also have to notify users whose browsing data was

 Feed

Microsoft has released an open access automation framework called PyRIT (short for Python Risk Identification Tool) to proactively identify risks in generative artificial intelligence (AI) systems. The red teaming tool is designed to "enable every organization across the globe to innovate responsibly with the latest artificial intelligence advances," Ram Shankar Siva Kumar, AI red team

 Feed

Created by John Tuckner and the team at workflow and automation platform Tines, the SOC Automation Capability Matrix (SOC ACM) is a set of techniques designed to help security operations teams understand their automation capabilities and respond more effectively to incidents.  A customizable, vendor-agnostic tool featuring lists of automation opportunities, it's been shared

 Feed

A dormant package available on the Python Package Index (PyPI) repository was updated nearly after two years to propagate an information stealer malware called Nova Sentinel. The package, named django-log-tracker, was first published to PyPI in April 2022, according to software supply chain security firm Phylum, which detected an anomalous update to the library on February 21,

 A Little Sunshine

Source: krebsonsecurity.com – Author: BrianKrebs A new data leak that appears to have come from one of China’s top private cybersecurity firms provides a rare glimpse into the commercial side of China’s many state-sponsored hacking groups. Experts say the leak illustrates how Chinese government agencies   show more ...  

increasingly are contracting out foreign espionage campaigns to the nation’s […] La entrada New Leak Shows Business Side of China’s APT Menace – Source: krebsonsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 Cybersecurity experts at Kaspersky have uncovered a new phishing campaign that specifically targets small and medium-sized businesses (SMBs).  The attack method involves exploiting the email service provider (ESP) SendGrid to gain access to client mailing   show more ...  

lists, subsequently utilizing stolen credentials to send out convincing phishing emails. These emails are crafted […] La entrada SMBs at Risk From SendGrid-Focused Phishing Tactics – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Change

Source: www.infosecurity-magazine.com – Author: 1 Health tech firm Change Healthcare, part of Optum, has been hit by a cyber-attack, leading to delays in prescriptions being issued to patients. The US-based company is providing regular updates of the incident on the website of healthcare services giant Optum,   show more ...  

which it merged with in 2022. Optum is a […] La entrada Change Healthcare Cyber-Attack Leads to Prescription Delays – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 A joint effort by SentinelLabs and ClearSky Cyber Security has uncovered a significant propaganda and disinformation campaign, possibly orchestrated by the Russia-aligned influence operation network called Doppelgänger.  The campaign, which began in late   show more ...  

November 2023, initially targeted Ukrainian affairs but has since expanded its scope to include the US, Israel, […] La entrada Russian-Aligned Network Doppelgänger Targets German Elections – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 Written by Chief information security officers now have a new tool at their disposal to get started with AI securely. The Open Web Application Security Project (OWASP) released the LLM AI Cybersecurity & Governance Checklist. This 32-page document is   show more ...  

designed to help organizations create a strategy for implementing large language […] La entrada OWASP Releases Security Checklist for Generative AI Deployment – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 cyber

Source: www.infosecurity-magazine.com – Author: 1 Most cybersecurity professionals believe that AI will have a positive impact on their jobs, helping alleviate pressures caused by the cyber skills gap, a new report by ISC2 has found. More than four in five (82%) of respondents agreed that AI will improve job   show more ...  

efficiency for cyber professionals, with 42% […] La entrada Cyber Pros Embrace AI, Over 80% Believe It Will Enhance Jobs – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chinese

Source: www.infosecurity-magazine.com – Author: 1 Two Chinese nationals have been found guilty of running a sophisticated fraud scheme in which they attempted to con Apple out of millions of dollars, by sending it thousands of fake iPhones. Haotian Sun (aka Hao Sun, Jack Sun) of Baltimore, Maryland, and   show more ...  

Pengfei Xue, 33, of Germantown, Maryland, were convicted […] La entrada Chinese Duo Found Guilty of $3m Apple Fraud Plot – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 IT admins have been urged to patch any on-premises ScreenConnect servers immediately, after reports that a recently published maximum severity vulnerability is being exploited in the wild. CVE-2024-1709 is an authentication bypass bug which has been given a   show more ...  

CVSS score of 10.0. It can be exploited without user interaction to execute […] La entrada Ransomware Warning as CVSS 10.0 ScreenConnect Bug is Exploited – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Businesses

Source: www.infosecurity-magazine.com – Author: 1 Cybersecurity is a top concern for businesses in 2024, with over two-thirds of IT decision-makers reporting increased budgets. This positive trend highlights the growing awareness of cyber threats and the need for robust defenses. This is according to findings   show more ...  

from a recent survey of 200 senior cybersecurity professionals conducted by […] La entrada Businesses Increase Cybersecurity as Budgets Surge in 2024 – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Becky Bracken, Editor, Dark Reading 2 Min Read Source: kravaivan11 via Pixabay Change Healthcare, a technology services provider for pharmacies, experienced a cyberattack from a suspected nation-state threat actor that has created widespread delays for patients who need   show more ...  

prescription refills across the US. Change Healthcare is a part of Optum Solutions, […] La entrada Pharmacy Delays Across US Blamed on Nation-State Hackers – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Cole Grolmus Cybersecurity has an unspoken narrative of mixed fortunes — a storyline we all feel but rarely can articulate. Part of me says this is normal. Public markets fluctuate, often between different extremes. But cybersecurity’s current situation   show more ...  

feels…different, or at least more nuanced. Companies like Palo Alto Networks are were […] La entrada Cybersecurity’s Class Conundrum – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman Security Bloggers Network  Home » Security Bloggers Network » USENIX Security ’23 – Junjie Wang, Zhiyi Zhang, Shuang Liu, Xiaoning Du, Junjie Chen – FuzzJIT: Oracle-Enhanced Fuzzing for JavaScript Engine JIT Compiler by Marc Handelman on February   show more ...  

22, 2024 Many thanks to USENIX for publishing their outstanding USENIX Security […] La entrada USENIX Security ’23 – Junjie Wang, Zhiyi Zhang, Shuang Liu, Xiaoning Du, Junjie Chen – FuzzJIT: Oracle-Enhanced Fuzzing for JavaScript Engine JIT Compiler – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Geo Focus: The United Kingdom , Geo-Specific , Governance & Risk Management UK Parliamentary Committee Says the Agency Is Not Likely to Meet the 2025 Deadline Akshaya Asokan (asokan_akshaya) • February 22, 2024     U.K. telecom regulatory authority Ofcom   show more ...  

faces challenges in implementing the Online Safety Act. (Image: Shutterstock) […] La entrada Report: Ofcom Unprepared to Implement UK Online Safety Bill – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CISOs

Source: www.databreachtoday.com – Author: 1 Michael Coden Board Director & Senior Advisor, Boston Consulting Group Michael Coden is a technology executive with over 40 years’ experience in technology innovation, transformation and operations, strategic planning, cybersecurity, leadership and talent   show more ...  

development. Michael serves on Boards, advises C-suites, is currently President and CEO of DBOS, Inc., Senior Advisor […] La entrada How CISOs Can Ace Cyber Risk Reporting to the Board and the SEC – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Change

Source: www.databreachtoday.com – Author: 1 Cybercrime , Fraud Management & Cybercrime , Healthcare HHS Issues Special Alert Urging Providers and Contractors to ‘Stay Vigilant’ Marianne Kolbasuk McGee (HealthInfoSec) • February 22, 2024     Image: Change Healthcare Change Healthcare –   show more ...  

a unit of Optum that provides IT services and applications to hundreds of U.S. pharmacies, […] La entrada Change Healthcare Cyber Outage Disrupts Firms Nationwide – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cryptohack

Source: www.databreachtoday.com – Author: 1 Blockchain & Cryptocurrency , Cryptocurrency Fraud , Fraud Management & Cybercrime Also: FCA Rounds Up Noncompliant Firms; GoFundMe Shuts Down Tornado Cash Fundraiser Rashmi Ramesh (rashmiramesh_) • February 22, 2024     Image: Shutterstock This week,   show more ...  

FixedFloat lost $26 million in a hack, the U.K. Financial Conduct Authority found illegal […] La entrada Cryptohack Roundup: $26 Million FixedFloat Hack – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breach

Source: www.databreachtoday.com – Author: 1 Cybercrime , Fraud Management & Cybercrime , Governance & Risk Management Also: Avast Agrees to $16.5 Million Civil Penalty to Settle Privacy Investigation Anviksha More (AnvikshaMore) • February 22, 2024     Image: Shutterstock This week: more fallout   show more ...  

from LockBit, Avast to pay $16.5M, Russia-linked group targeted mail servers, no […] La entrada Breach Roundup: More Fallout From the LockBit Takedown – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CISO Strategy

Source: www.cybertalk.org – Author: slandau EXECUTIVE SUMMARY: Approximately 60% of Australian organizations lack a comprehensive understanding of third-party data breach risks, with over 50% failing to implement impactful measures to assist with long-term third-party risk management. Authorities are   show more ...  

concerned… The Office of the Australian Information Commissioner’s recent data breach report highlights growing concern over supply […] La entrada Aussie data breach report exposes supply chain risks – Source: www.cybertalk.org se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CISO

Source: www.cybertalk.org – Author: slandau Pete Nicoletti is a Field CISO for the Americas region at Check Point. Pete has 32 years of security, network, and MSSP experience and has been a hands-on CISO for the last 17 years. Pete’s cloud security deployments and designs have been rated by Garter as #1 and   show more ...  

#2 and […] La entrada Threat prevention & defense for government agencies – Source: www.cybertalk.org se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 AI

Source: securityaffairs.com – Author: Pierluigi Paganini Microsoft released red teaming tool PyRIT for Generative AI Pierluigi Paganini February 23, 2024 Microsoft has released an open-access automation framework, called PyRIT, to proactively identify risks in generative artificial intelligence (AI) systems.   show more ...  

Microsoft has released a Python Risk Identification Tool for generative AI (PyRIT), it is an open-access automation framework […] La entrada Microsoft released red teaming tool PyRIT for Generative AI – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan Sony subsidiary Insomniac Games is sending data breach notification letters to employees whose personal information was stolen and leaked online following a Rhysida ransomware attack in November. The California-based video game developer has been part of   show more ...  

Sony Interactive Entertainment’s Worldwide Studios division (now known as PlayStation Studios) after being […] La entrada Insomniac Games alerts employees hit by ransomware data breach – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.techrepublic.com – Author: Drew Robb Identity and Access Management (IAM) is all about establishing the identity of a user and verifying that the user has the right to access certain applications and types of information. According to Statista, the global IAM market was worth $16 billion in 2022.   show more ...  

The forecast is that it will […] La entrada What Is Identity and Access Management (IAM)? – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.techrepublic.com – Author: Luis Millares Best overall free password manager: Bitwarden Best for customizability: KeePass Best for integration with third-party cloud services: Enpass Best for future-proof encryption: NordPass Best for multi-factor authentication: Zoho Vault Keeping track of our   show more ...  

online passwords has become a challenge in today’s world. Our work and personal lives increasingly rely […] La entrada 5 Best Free Password Managers for 2024 – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.techrepublic.com – Author: Cybersecurity demands and the stakes of failing to properly secure systems and networks are high. While every organization’s specific security needs form a unique and complex blend of interconnected requirements, numerous security fundamentals almost always apply to each   show more ...  

of these groups. It stands to reason that cybersecurity pros who effectively identify […] La entrada Checklist: Network and Systems Security – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Australia

Source: www.techrepublic.com – Author: Ben Abbott State-sponsored cyber intrusions have become an increasing concern to both Australian governments and organisations. Defence Minister Richard Marles warned just last year that the country was seeing a greater interest from state actors in critical infrastructure.   show more ...  

Nathan Wenzler, chief security strategist at cyber security firm Tenable, said state-sponsored threat […] La entrada Tenable: Cyber Security Pros Should Worry About State-Sponsored Cyber Attacks – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Artificial Intelligence

Source: www.techrepublic.com – Author: Megan Crouse Most cybersecurity professionals (88%) believe AI will significantly impact their jobs, according to a new survey by the International Information System Security Certification Consortium; with only 35% of the respondents having already witnessed AI’s   show more ...  

effects on their jobs (Figure A). The impact is not necessarily a positive or negative […] La entrada ISC2 Research: Most Cybersecurity Professionals Expect AI to Impact Their Jobs – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CISSP

Source: www.techrepublic.com – Author: TechRepublic Academy Published February 22, 2024 We may earn from vendors via affiliate links or sponsorships. This might affect product placement on our site, but not the content of our reviews. See our Terms of Use for details. If you’re ready to start moving up to   show more ...  

higher positions in the lucrative […] La entrada Develop Advanced Cybersecurity Skills for Just $80 – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-02
Aggregator history
Friday, February 23
THU
FRI
SAT
SUN
MON
TUE
WED
FebruaryMarchApril