Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for The CyberPower UPS V ...

 Firewall Daily

A new UPS management vulnerability in CyberPower Uninterrupted Power Supply (UPS) management software has been uncovered, revealing multiple flaws that have serious implications for the security of vital systems across various sectors. The utilization of UPS management software spans a wide array of sectors, ranging   show more ...  

from data centers to healthcare facilities and government agencies. Its role in maintaining uninterrupted operations is crucial, making any vulnerability in such software a matter of utmost concern. Understanding the CyberPower UPS Management Vulnerability [caption id="attachment_67311" align="alignnone" width="1282"] Source: Cyble[/caption] The Cybersecurity and Infrastructure Security Agency (CISA), a key entity responsible for safeguarding critical infrastructure in the United States, has issued alerts highlighting the increased interest of hacktivist groups in targeting internet-exposed Industrial Control Systems (ICS) devices. Cyble Research and Intelligence Labs (CRIL) also shared an elaborate report on the rise of hackers exploiting UPS management systems to target unsuspecting victims. “CRIL researchers speculate that threat actors could soon leverage the critical vulnerabilities disclosed in PowerPanel in upcoming campaigns. With the potential for exploitation looming, urgent attention to patching and mitigation measures is imperative to preemptively thwart any attempts to exploit these weaknesses”, said CRIL. [caption id="attachment_67315" align="alignnone" width="1536"] Source: Cyble[/caption] Against this CyberPower UPS vulnerability, the official report details critical information about the flaw and the mitigation strategies, including opting for the latest patch updates across multiple devices.  PowerPanel is a UPS management software designed to offer advanced power management capabilities for various critical systems such as Uninterrupted Power Supply, Power Distribution Units, and Automatic Transfer Switches. Its features include real-time monitoring, remote management, event logging, automatic shutdown, and energy management, among others, providing organizations with the tools needed to ensure continuous power availability and optimize energy usage. Overview of the UPS Management Vulnerability The disclosed vulnerabilities in PowerPanel Business Software, version 4.9.0 and prior, present a technical risk to system integrity and security. These vulnerabilities range from the use of hard-coded passwords and credentials to active debug code and SQL injection flaws. Exploitation of these vulnerabilities could potentially allow attackers to bypass authentication, gain administrator privileges, execute arbitrary code, and compromise sensitive data. [caption id="attachment_67317" align="alignnone" width="309"] Source: Cyble[/caption] Past incidents involving cyberattacks on UPS systems highlight the potential consequences of such vulnerabilities. Groups like GhostSec and TeamOneFist have targeted UPS systems in various campaigns, demonstrating the disruptive capabilities of such attacks. While the impact of these incidents may vary, the direct access to UPS systems by attackers remains a critical concern. [caption id="attachment_67318" align="alignnone" width="495"] Source: Cyble[/caption] Addressing the vulnerabilities in PowerPanel Business Software requires a proactive approach, including timely patching and implementation of mitigation measures. Organizations are advised to implement robust patch management strategies, conduct regular security audits and penetration testing, and enhance user awareness. Additionally, measures such as network segmentation and the use of Multi-Factor Authentication (MFA) can help bolster defenses against potential attacks. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Attackers Leverage T ...

 Firewall Daily

A new VPN vulnerability has emerged on the internet, compromising the very essence of online privacy and data protection. The TunnelVision vulnerability, lurking within VPN applications since 2002, has the potential to render VPN connections useless, leaving users vulnerable to data interception and snooping by   show more ...  

malicious actors. The TunnelVision vulnerability represents a sophisticated method of breaching VPN encryption, allowing attackers to intercept and snoop on unencrypted traffic while masquerading under the guise of a secure VPN connection.  This emergence of this flaw, detailed in a comprehensive report by Leviathan Security, highlights the exploitation of a longstanding vulnerability within the Dynamic Host Configuration Protocol (DHCP), specifically targeting option 121—a mechanism intended for configuring static routes on client systems. Decoding the TunnelVision Vulnerability [caption id="attachment_67149" align="alignnone" width="700"] Source: TunnelVision Vulnerability Exploitation Process by Leviathan[/caption] The modus operandi of attackers involves the setup of rogue DHCP servers strategically positioned to intercept VPN traffic. By manipulating routing tables, all VPN-bound data is diverted away from the encrypted tunnel, exposing it to interception on local networks or malicious gateways. Leviathan Security's report shed light on a phenomenon known as "decloaking," where VPN traffic is stripped of its encryption, leaving it vulnerable to interception. Despite the presence of VPN control channels and kill switches, these defenses prove ineffective against TunnelVision, leaving users unaware of the breach and their data exposed. The implications of this VPN vulnerability are profound, especially for individuals reliant on VPNs for sensitive communications, such as journalists and whistleblowers. Urgent action is needed to address this issue and safeguard the integrity of VPN connections. Mitigation Against the TunnelVision VPN Vulnerability Proposed solutions include the adoption of network namespaces, a technique employed by known protocols to mitigate similar vulnerabilities. By segregating interfaces and routing tables, network namespaces offer a promising avenue for protecting VPN traffic from interception. Understanding the underlying mechanisms of DHCP, VPNs, and networking is crucial in comprehending the full extent of TunnelVision's impact. DHCP, initially designed to dynamically allocate IP addresses, now serves as a gateway for attackers to exploit vulnerabilities in VPN connections. Additionally, the implementation of DHCP option 121 routes opens up avenues for attackers to manipulate routing tables and compromise VPN security. Mitigation efforts must prioritize the identification and rectification of these vulnerabilities to ensure the continued efficacy of VPNs in safeguarding user data. The implications of TunnelVision extend beyond geographical location as it has ability to expose data from almost any country with access to internet connection.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Police Arrest Six in ...

 Cybersecurity News

A coordinated multi-nation law enforcement action has led to a takedown of an Austria-based crypto scam where half a dozen suspects were arrested and assets worth hundreds of thousands of Euros were seized. This followed a separate investigation in the United Kingdom, which led to the sentencing of two Brits involved   show more ...  

in an international crypto scam worth millions. Takedown of Austria-based Crypto Scam The law enforcement agencies from Austria, Cyprus and Czechia have arrested six Austrians responsible for an online cryptocurrency scam that was launched in December 2017. Between 2017 and February 2018, the scammers assured and convinced its victims of having set up a legitimate online trading company that had launched a new cryptocurrency coin. The scammers offered an initial coin offering of 10 million tokens or respective rights to the new currency for sale. Considering the returns on investment from Bitcoin at the time, which was up nearly 39% in Dec. 2017, investors likely saw the opportunity in the new crypto coin and paid them in regular crypto values such as Bitcoin and Ethereum. To gain investors’ confidence and credibility, the Austrian fraudsters also claimed of having developed their own software and algorithm for the sale of the tokens. “Traditionally, an ICO will build upon transparency and communicate clearly about each team member responsible for it. In this instance, there was a lack of transparency regarding both the team members involved and the algorithm underpinning the cryptocurrency,” said Europol, who coordinated the multi-nation operation. Two months into the scheme, the perpetrators in February 2018 shuttered all their social media accounts and took offline the fake company’s homepage. Following this, it became obvious to the investors that they were defrauded in an exit scam. Not all victims of this crypto scam have been identified yet, but it is estimated that they lost around EUR 6 million, in totality. The law enforcement agencies raided six houses and seized over EUR 500,000 (approximately $537,120) in cryptocurrencies, EUR 250,000 (approximately $268,560) in fiat currency and froze dozens of bank accounts linked to the perpetrators and their fraudulent crypto scams. Two cars and a luxury property worth EUR 1.4 million was also seized. Two Brits Jailed for International Crypto Scam Law enforcement in Europe is further tightening screws against crypto scammers as is evident in another instance where two men who stole more than 5.7 million pounds (approximately $7.1 million) worth of cryptocurrency from victims worldwide were sentenced following an investigation of the South West Regional Organized Crime Unit (SWROCU). [caption id="attachment_67275" align="aligncenter" width="243"] James Heppel (credit: SWROCU)[/caption]   Jake Lee, aged 38, and James Heppel, aged 42, admitted guilt to three counts of conspiracy to commit fraud. Bristol Crown Court sentenced Lee to four years and Heppel to 15 months on May 3. [caption id="attachment_67274" align="aligncenter" width="227"] Jake Lee (Credit: SWROCU)[/caption]   The duo conducted the fraud by spoofing the domain of the online cryptocurrency exchange Blockchain[.]com to pilfer victims’ Bitcoin wallets, stealing their money and login credentials. They together targeted 55 victims across 26 countries, amassing £835,000 in cash, including £551,000 handed over by Lee in January, along with £64,000 in cryptocurrency, a Banksy print valued at £60,000 and three vehicles. [caption id="attachment_67271" align="aligncenter" width="1024"] £551k in cash voluntarily handed over by Lee (Credit: SWROCU)[/caption] A confiscation order of nearly £1 million was issued against Lee to compensate the victims. DS Matt Brain from SWROCU’s Regional Cyber Crime Unit stated, “Our investigation started back in 2018 after colleagues at Avon and Somerset Police arrested Lee on suspicion of money laundering.” “Officers from the force seized digital devices and three laminated Bitcoin wallet recovery seeds. At the same time, our unit had started an investigation into a cryptocurrency scam reported by a Wiltshire victim who had £11k worth of Bitcoin from his Blockchain wallet.” “We took on the investigation into Lee and when we analyzed his devices, we established he was a central figure involved in a sophisticated domain spoofing fraud and worked to identify numerous victims.” Brain added that the fact they both pleaded guilty to all counts also showed the strength of evidence that the police secured against them.” Pamela Jain, a prosecutor with the Crown Prosecution Service, noted, “Jake Lee and James Heppel defrauded people in 26 countries, including 11 victims in the UK, by diverting Bitcoin into wallets over which they had control. This was a complex and time-consuming prosecution which involved enquiries with numerous victims and prosecuting authorities all over the world.” Lee has already been served a confiscation order but “confiscation proceedings against James Heppel are ongoing,” Jain said. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Data Breach Victim I ...

 Data Breach News

A class action lawsuit has been filed against J.P. Morgan Chase & Co., alleging that the financial giant failed to implement adequate security measures, leading to the exposure of sensitive personal data of its clients. Benjamin Valentine, a former employee of the Long Island Railroad, filed a complaint alleging   show more ...  

that his personal information was improperly obtained in a recent J P Morgan data breach that compromised the accounts of thousands of users. J P Morgan Data Breach Compromised Thousands of Users [caption id="attachment_67262" align="alignnone" width="971"] Source: Chase[/caption] According to documents filed in the U.S. District Court for the Southern District of New York on May 3, Valentine's case is detailed in a Class Action Complaint (Case 1:24-cv-03438-JLR). The lawsuit contends that J.P. Morgan, a significant player in the financial industry offering a wide array of services to millions of customers, failed to adequately safeguard the personal information of its clients' employees, resulting in substantial harm. Valentine's complaint outlines how J.P. Morgan collected and maintained sensitive personally identifiable information (PII) of its clients' employees, including names, addresses, payment details, and Social Security numbers. This information, crucial for financial transactions and security, was compromised in the J P Morgan data breach and fell into the hands of cybercriminals. The lawsuit asserts that as a consequence of the breach, Valentine and approximately 451,000 other affected individuals suffered tangible damages, including invasion of privacy, identity theft, and the loss of trust and value in their personal information. Moreover, the breach exposed them to ongoing risks of fraud and further misuse of their data. The Legal Action on J P Morgan The legal action further alleges that J.P. Morgan's failure to implement adequate cybersecurity measures and its reckless handling of sensitive data contributed directly to the breach. Despite claims by J.P. Morgan that the breach was not the result of a cyberattack, the lawsuit argues that the company's negligence made it a target for such malicious activities. Valentine's complaint highlights J.P. Morgan's purported lack of transparency and timely notification regarding the breach, leaving affected individuals uninformed about the root cause and remedial actions taken. This, the lawsuit claims, exacerbates the emotional and financial distress experienced by victims. The Cyber Express has reached out to the organization to learn more about this J P Morgan data leak. However, J.P. Morgan has not provided an official statement regarding the cyber incident. Following the incident, a regulatory filing revealed that the breach stemmed from a software issue, which the company addressed promptly upon discovery. Valentine seeks various forms of relief through the lawsuit, including compensation for damages, injunctive relief, and reimbursement of legal fees. He is represented by the law firm Milberg Coleman Bryson Phillips Grossman LLC, based in Garden City, New York. As the legal proceedings unfold, The Cyber Express will be closely monitoring the situation and we’ll update this post once we have more information on the data breach or any new updates about the lawsuit.   Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Hong Kong Fire Depar ...

 Cybersecurity News

The Hong Kong fire department uncovered a recent breach in its computer system that exposed the personal information of over 5,000 department personnel and hundreds of residents. The Hong Kong Fire Department data breach, the third incident involving government data in less than a week, stems from an unauthorized   show more ...  

change in privileged access rights during a data migration procedure by an outsourced contractor, according to a statement from the Fire Services Department (FSD). The Hong Kong Fire Services Department is an emergency firefighting government service that conducts rescue operations on land and sea. The department is also responsible for providing emergency ambulance service for sick and injured as well in providing fire protection advice to the general public. However, there is no evidence that the leaked data from the Hong Kong Fire Department data breach had been published online. Systems Suspended Following Hong Kong Fire Department Data Breach [caption id="attachment_67236" align="alignnone" width="1000"] Source: Shutterstock[/caption] Following the discovery of the intrusion, the fire department suspended the affected system and launched an investigation along with the third-party contractor. The department immediately revoked the contractor's access rights to prevent further data leakage and implemented enhanced security measures to prevent similar incidents. The compromised data included the last names and phone numbers of approximately 480 individuals who reported tree collapse incidents during the Super Typhoon Saola in September 2023. Additionally, personal details such as names, phone numbers, and ranks of around 5,000 FSD staff were at risk, with 960 personnel having their incomplete identity card numbers exposed in the breach. Details regarding the breach were notified to the relevant authorities including the Police, Security Bureau, Privacy Commissioner for Personal Data, and Government Chief Information Officer. "The FSD believes that the incident happened when the outsourced contractor handled the data migration procedure. During the process, the access right of the data was found altered without authorisation, posing a potential risk of data leakage," a Fire Services Department spokesperson stated. The Hong Kong Fire Services Department apologised for the incident and notified those affected through text messages or phone calls. However the department assured the public that there was no evidence that the data had been leaked as of yet. Data Breach Follows Two Cyber-Incidents within the Same Week This Hong Kong Fire Department data breach follows similar data breach incidents involving the Electrical and Mechanical Services Department (EMSD) and the Companies Registry last week, where data stored on their servers had been compromised. Lawmaker Elizabeth Quat who heads the Panel on Information Technology and Broadcasting has called for improved data security measures and a punishment mechanism for future incidents and similar blunders. The Electrical and Mechanical Services Department (EMSD) system glitch last Tuesday allowed for unauthorized access to the names, telephone numbers, identity card numbers and addresses of around 17,000 individuals through the server platform without requiring a password. The Companies Registry stated last Friday that security flaws in its online e-Services Portal developed by a third-party contractor resulted in the transmission of additional personal data beyond what was requested by the client computer during searches. While this additional data was not displayed directly, it could be obtained through the use of web developer tools. The additional data was estimated to affect about 110,000 data subjects and included their names, full passport numbers, identity card numbers, residential addresses, telephone numbers and email addresses. The city's privacy watchdog reported a significant increase in data breach notifications last year, signaling a growing concern for data protection. In a recent case involving Cyberport, a government-owned tech hub, the watchdog identified lapses in security audits and unnecessary retention of personal data, highlighting the need for better oversight in handling sensitive information. The string of government-related data breaches highlights the possibility of security weaknesses introduced through dependence on external third-party contractors. This weakness remains a major problem globally as observed in the recent incident UK Ministry of Defense data breach stemming from an external payroll provider. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Google Brings Gemini ...

 Cyber Essentials

Google has brought together its Gemini AI model with its Mandiant cybersecurity unit and VirusTotal threat Intelligence to enhance threat landscape accessibility and efficiency. The company also plans to use its Gemini 1.5 Pro large language model, released in February, to ease the understanding of threat reports for   show more ...  

a broader audience. At the RSA Conference in San Francisco, Google unveiled their latest AI-based solution to add more value to threat intelligence. Tackling the long-standing challenges of fragmented threat landscapes and cumbersome data collection processes, Google Threat Intelligence integrates Mandiant's frontline expertise, real-time contributions from VirusTotal's global community and Google's visibility into extensive user and device footprint to deliver a comprehensive defense against evolving cyber threats. Bernardo Quintero, founder of VirusTotal called this initiative a “sharing knowledge, protecting together” mission, which it has embraced with Google and Mandiant. “I want to assure our entire community, from security researchers and industry partners to individual users, that VirusTotal's core mission remains unchanged. We remain deeply dedicated to collective intelligence and collaboration, fostering a platform where everyone can come together to share knowledge, access valuable threat information, and contribute to the fight against cyber threats,” Quintero said. “VirusTotal remains committed to a level playing field, ensuring all partners, including Google Threat Intelligence, have equal access to the crowdsourced data VirusTotal collects. We also want to assure you that the core features and functionalities of VirusTotal will remain free and accessible to everyone, as always,” he added, clearing the air around VirusTotal’s future. “The strength of VirusTotal lies in its network of contributors and the vast amount of data they provide. This data serves as a valuable resource for the entire security industry, empowering our partners and others to enhance their products and contribute to a more secure digital world. This collaborative approach, based on transparency and equal access, strengthens the industry as a whole, ultimately leading to better protection for everyone.” Challenges Addressed and Google’s Gemini AI Integration For years, organizations have grappled with two primary hurdles in threat intelligence: a lack of holistic visibility into the threat landscape and the arduous task of collecting and operationalizing intelligence data. Google's new offering aims to address these challenges head-on providing insights and operational efficiency to security teams worldwide. The integration of Gemini, Google's AI-powered agent, enhances the operationalization of threat intelligence, streamlining the analysis process and accelerating response times. Using the Gemini 1.5 Pro large language model, Google claims to significantly reduce the time required to analyze malware attacks. For instance, the model took only 34 seconds to dissect the WannaCry virus and identify a kill switch, demonstrating its efficacy in threat analysis. Another key feature of Gemini AI is its ability to summarize threat reports into natural language, aiding companies in assessing potential attacks' impact and prioritizing responses. Threat Intelligence also offers a comprehensive threat monitoring network, empowering users to gain insights into the cybersecurity landscape and prioritize their defense strategies. Mandiant's experts, acquired by Google in 2022, play a vital role in assessing security vulnerabilities in AI projects through the Secure AI Framework. They conduct rigorous testing to fortify AI models against potential threats like data poisoning, ensuring their resilience against malicious exploitation. While Google is pioneering the integration of AI into cybersecurity, other tech giants like Microsoft are also exploring similar avenues, underscoring the growing significance of AI in safeguarding digital assets against evolving threats. As cyber threats continue to evolve, proactive defense strategies are more critical than ever. With Google Threat Intelligence, organizations can leverage cutting-edge technology to detect, analyze, and mitigate threats effectively, ensuring the security and resilience of their digital infrastructure in an increasingly complex threat landscape.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for LockBit Ransomware T ...

 Dark Web News

Despite the major collaborative effort by law enforcement agencies resulting in the exposure and sanctioning of Dmitry Yuryevich Khoroshev, the Russian national thought to be at the helm of LockBit's widespread hacking operations, the hacker group shows no signs of ceasing its activities. LockBit has reportedly   show more ...  

launched a cyberattack on Wichita, Kansas, targeting state government and various local entities. The news of the Wichita cyberattack emerged on LockBit's previously inactive platforms, which were reactivated after the shutdown of their official website. Cyberattack on Wichita Post LockBit Leader Arrest [caption id="attachment_67202" align="alignnone" width="402"] Source: Dark Web[/caption] The Wichita cyberattack targeted the official website (wichita.gov), prompting concerns over the security of critical municipal systems. While the ransomware group has not yet released any compromised data, they have set a deadline of May 15, 2024, for its publication.  The announcement by LockBit ransomware follows closely on the heels of an earlier notification by the city of Wichita regarding a ransomware attack on May 5, 2024, although the responsible ransomware gang was not initially disclosed. Wichita, the largest city in the state of Kansas, serves as the county seat of Sedgwick County and is a populous urban center in the region.  The Cyber Express has reached out to the state government to learn more about this cyberattack on Wichita. However, at the time of writing this, no official statement or response has been received. However, the city of Wichita denoted a ransomware attack that targeted various government and private organizations within the city.  Security Update from Wichita: Ransomware Group Remains Unnamed! According to a press release by the city of Wichita, the recent posts from the state's Cyber Security Incident Update indicate ongoing efforts by the city's information technology department and security partners to address the cyberattack.  “Many City systems are down as security experts determine the source and extent of the incident. There is no timetable for when systems could be coming back online. We appreciate your patience as we work through this incident as quickly and as thoroughly as possible”, reads the official press release.  In the meantime, various city services and amenities have been impacted by the cyber incident, prompting adjustments to normal operations. Water systems remain secure and functional, with provisions in place for those experiencing difficulties paying bills or facing water shut-offs.  Transit services, city vendors, park and recreation facilities, licensing procedures, and municipal court operations have all been affected to varying degrees, necessitating alternative arrangements such as cash payments and in-person transactions. Similarly, services provided by cultural institutions, resource centers, planning departments, and housing and community services are also subject to modifications and delays as the city works to address the cyberattack. The city's airport and library services have experienced disruptions to Wi-Fi access and digital infrastructure, although essential operations continue with minimal impact on services provided to the public. This is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the cyberattack on Wichita or any new updates from the government.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Brandywine Realty Tr ...

 Firewall Daily

Brandywine Realty Trust issued a recent filing to the US Securities And Exchange Commission (SEC), where it confirmed that an unauthorized third-party had gained access to portions of its internal network. The Brandywine Realty Trust data breach is stated to have affected the functioning of some of its internal   show more ...  

systems, following preventative measures as part of the firm's incident response plan. Brandywine Realty Trust is one of the largest publicly traded real estate companies in the United States with a primary focus in the Philadelphia, Texas and Austin markets. The firm is organized as a real estate investment trust and manages 69 properties comprising of 12.7 million square feet in land spanning multiple states. Upon detecting the intrusion, the trust initiated its response protocols and took steps to contain affected systems, assess the extent of the attack and move towards remediation. Investigative efforts were held together with external cybersecurity professionals, while details were shared with law enforcement. Brandywine Realty Trust Data Breach Disrupted Trust's Operations The filing reveals that along with unauthorized access to its internal systems, the attack also involved the  encryption of some of the company's internal resources. The encryption process disrupted access to portions of the company’s business applications responsible for several of the company's internal and corporate functions, including its financial and reporting systems. The company disclosed that certain files were stolen during the attack, but that it is still working on determining the extent of sensitive and confidential information accessed during the intrusion into its IT systems, and establishing if any personal information had been accessed. However, the company believes that the intrusion had been been contained from spreading further into its systems and stated that it is working diligently to restore its IT systems back online. The Company is also  evaluating if any additional regulatory and legal notifications are required after facing the incident and will issue appropriate notifications according to its findings. Perpetrator Behind Brandywine Realty Trust Data Breach Unknown The company is known to have rented out commercial properties to various prominent firms, with its biggest tenants including IBM, Spark Therapeutics, Comcast, and the FMC Corporation. However, the attack comes during a recent period of increased ongoing volatility in the office commercial space with  Brandywine recently cutting down its quarterly dividend, from 19 cents to 15 cents a share, for the first time since 2009. In an recent interview, the company's CEO acknowledged “turbulent times” in commercial real estate space and the company aimed at covering its “danger points.” He added the company has plenty of cash and available credit, while noting that compared to its peers, the firm had a substantially lower number of leases set to expire over the next few years. As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet known. No threat actor individual or group has seemed to claim responsibility for the attack yet. The disclosure likely follows  the introduction of the new rules by the U.S. government in December 2023, where publicly traded companies are required to disclose security incidents they believe may have a material impact on the business. However, Brandywine indicated in its filing that it does not believe the incident is 'reasonably likely to materially impact the Company’s financial condition or results of operations.' Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Hacker Duo Allegedly ...

 Dark Web News

Hackers IntelBroker and Sanggiero have claimed a data breach allegedly impacting HSBC Bank and Barclays Bank. The HSBC Bank data breach, along with the breach at Barclays reportedly occurred in April 2024, involving a security incident through a third-party contractor, ultimately leading to the leak of sensitive data.   show more ...  

  The compromised data, which was being offered for sale on Breachforums, allegedly includes a wide array of files such as database files, certificate files, source code, SQL files, JSON configuration files, and compiled JAR files. Preliminary analysis suggests that the data may have been sourced from the services provided by Baton Systems Inc., a post-trade processing platform, potentially impacting both HSBC Bank and Barclays Bank. However, Baton Systems has not shared any update on this alleged attack or any connection with the sample data provided by the threat actor. Hacker Duo Claims Barclays and HSBC Bank Data Breach Barclays Bank PLC and The Hong Kong and Shanghai Banking Corporation Limited (HSBC) are the primary organizations affected by this breach. With operations spanning across the United Kingdom, United States, and regions including Europe and North America, the threat actor threatens the banking systems and probably targets customers' data, however, there has been no evidence of such data getting leaked.  [caption id="attachment_67347" align="alignnone" width="2084"] Source: Dark Web[/caption] In a post on Breachforums, one of the threat actors, IntelBroker, shared details of the Barclays and HSBC Bank data breach, offering the compromised data for download. The post, dated May 8, 2024, outlined the nature of the breach and the types of data compromised, including database files, certificate files, source code, and more. The post also provided a sample of the leaked data, revealing a mixture of CSV data representing financial transactions across different systems or entities. While talking about the stolen data, IntelBroker denoted that he is "uploading the HSBC & Barclays data breach for you to download. Thanks for reading and enjoy! In April 2024, HSBC & Barclays suffered a data breach when a direct contractor of the two banks was breached. Breached by @IntelBroker & @Sanggiero". A Closer Look at the Sample Data  A closer look at the sample data reveals three distinct datasets, each containing transaction records with detailed information about financial activities. These records encompass a range of information, from transaction IDs and timestamps to descriptions and account numbers involved. The datasets provide a comprehensive view of various transactions, offering valuable insights for financial analysis and tracking. The Cyber Express has reached out to both the banks to learn more about these alleged data breaches. However, at the time of writing this, no official statement or response has been shared by the banks. This lack of communication leaves the claims regarding the Barclays and HSBC Bank data breach unverified.  Moreover, the two hackers in question, IntelBroker and Sanggiero, have claimed similar attacks in the past, targeting various global organizations. In an exclusive interview with The Cyber Express, one of the hackers, IntelBroker shed light on their hacking activities and the motivations behind their operations. IntelBroker had also praised Sanggiero from BreachForums for “his exceptional intellect and understated contributions to the field are deserving of far greater recognition and respect.” Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for MedStar Health Repor ...

 Cybersecurity News

MedStar Health, a prominent non-profit healthcare provider disclosed a data breach that impacts more than 183,000 patients from its hundreds of care locations which it operates in the Baltimore-Washington area in the U.S. The not-for-profit healthcare provider is worth $7.7 billion and is one of the largest employers   show more ...  

in the region with more than 34,000 associates working across 300 care locations including 10 hospitals and 33 urgent care clinics, ambulatory care centers and primary and specialty care providers. They together treat hundreds of thousands of patients on a yearly basis. The impacted individuals' personal data may have been compromised when an outsider gained access to emails and files of three employees, MedStar Health said in a statement on the data breach. MedStar Health reported notifying 183,709 affected patients via letters and filed a notice with the Department of Health and Human Services. The unauthorized access occurred sporadically between January and October last year, with patient information found in breached files and emails. Although there's no indication of actual acquisition or viewing of patient data, the company couldn't rule out such access. Patient information including names, addresses, dates of birth, service dates, provider names and insurance details, were contained in the compromised emails and files, MedStar Health said. The healthcare provider urged affected patients to monitor healthcare statements for any unusual activities and assured implementation of new safeguards to prevent future breaches. Earlier MedStar Health Data Breach The digital woes of the healthcare provider are not new. In fact, this is the second time in a decade that MedStar Health is facing a massive data breach scare. In 2016, a virus, likely a ransomware malware infected the computer network of MedStar Health. This prompted a complete shutdown of services for the healthcare giant, which resulted in diversion of new patients to other hospitals and the care givers had to resort to pen and paper to continue regular operations. The impact was such that the FBI was called in to investigate the MedStar Health data breach, which followed similar cyberattacks on at least three other medical institutions in California and Kentucky. Healthcare Breaches on the Rise This incident adds to a growing list of healthcare breaches and ransomware attacks, including the Change Healthcare that caused widespread disruptions across U.S. Initially described as an “enterprise-wide connectivity issue,” the severity of the attack went a bar above when Blackcat – also known as Alphv – ransomware gang claimed responsibility for it. The Russia-based ransomware and extortion gang claimed to have stolen millions of Americans’ sensitive health and patient information, a tactic commonly employed by ransomware gangs to exert pressure on victims. However, on February 29, Blackcat withdrew its claim on the breached data of the healthcare group, raising questions if a ransom was paid. The company did confirm that is paid a $22 million ransom later but it now faces multiple lawsuits for alleged negligence in safeguarding clients' personal information. The parent company UnitedHealth has allocated over $2 billion to fight the fallout of the Change Healthcare data breach. The company last week also stated that a lack of multi-factor authentication (MFA) resulted into the massive hack. Blackcat in September 2023 claimed a similar data breach on McLaren Healthcare, where nearly 6 terabytes worth of data was siphoned. Owing to such large scale healthcare data breaches, the U.S. Cybersecurity and Infrastructure Security Agency in March unveiled a cybersecurity toolkit for healthcare sector that would help them implement advanced tools, that fortify their defenses against evolving threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for How to protect yours ...

 Threats

One of the oldest security tips is: Only download software from official sources. Official sources are usually the main app stores on each platform, but for millions of useful and free open-source apps, the most official source is the developers repository on a dedicated site such as GitHub or GitLab. There, you can   show more ...  

find the projects source code, fixes and additions to the code, and often a ready-to-use build of the app. These sites are familiar to anyone with even the slightest interest in computers, software, and programming. Thats why it was an unpleasant discovery for many (including IT security specialists and the developers themselves) that a file accessible at a link like github{.}com/{User_Name}/{Repo_Name}/files/{file_Id}/{file_name} could be published by someone other than the developer and contain… anything. Of course, cybercriminals immediately took advantage of this. Breaking down the problem GitHub and its close relative GitLab are built around collaboration on software development projects. A developer can upload their code, and others can offer additions, fixes, or even create forks – alternative versions of the app or library. If a user finds a bug in an app, they can report it to the developer by creating an issue report. Other users can confirm the issue in the comments. You can also comment on new versions of the app. If necessary, you can attach files to the comments, such as screenshots showing the error or documents that crash the application. These files are stored on GitHub servers using links of the type described above. However, GitHub has one peculiarity: if a user prepares a comment and uploads accompanying files, but doesnt click Publish, the information remains stuck in the draft – and its invisible to both the application owner and other GitHub users. Nevertheless, a direct link to the file uploaded in the comment is created and fully operational, and anyone who follows it will receive the file from GitHubs CDN. A download link for a malicious file is generated after the file is added to an unpublished comment on GitHub Meanwhile, the owners of the repository where this file is posted in the comments cannot delete or block it. They dont even know about it! There are also no settings to restrict the upload of such files for the repository as a whole. The only solution is to disable comments completely (on GitHub, you can do this for up to six months), but that would deprive developers of feedback. GitLabs commenting mechanism is similar, allowing files to be published via draft comments. The files are accessible via a link like gitlab.com/{User_Name}/{Repo_Name}/uploads/{file_Id}/{file_name}. However, the problem in this case is mitigated somewhat by the fact that only registered, logged-in GitLab users can upload files. A gift for phishing campaigns Thanks to the ability to publish arbitrary files at links starting with GitHub/GitLab and containing the names of respected developers and popular projects (because an unpublished comment with a file can be left in almost any repository), cybercriminals are presented with the opportunity to carry out very convincing phishing attacks. Malicious campaigns have already been discovered where comments, supposedly containing cheating apps for games, are left in Microsoft repositories. A vigilant user might wonder why a gaming cheat would be in the Microsoft repository: https://github{.}com/microsoft/vcpkg/files/../Cheat.Lab.zip. But its much more likely that the keywords GitHub and Microsoft will reassure the victim, who wont scrutinize the link any further. Smarter criminals might disguise their malware even more carefully, for example, by presenting it as a new version of an app distributed through GitHub or GitLab and posting links via comments on that app. How to protect yourself from malicious content on GitHub and GitLab While this design flaw remains unfixed and anyone can freely upload arbitrary files to the CDN of GitHub and GitLab, users of these platforms need to be extremely careful. Do not download files from direct GitHub/GitLab links that you find in external sources – other websites, emails, or chats. Instead, open the project page (github{.}com/{User_Name}/{Repo_Name} or gitlab{.}com/{User_Name}/{Repo_Name}) and make sure that you can actually download the file from there. Official files from developers should be published and visible in the repository. Make sure youre on the right developer page – in GitHub, GitLab, and other open-source repositories, typosquatting is common: creating fake projects with names that differ from the original by one or two letters (for example, Chaddev instead of Chatdev). Avoid downloading applications that have few stars (likes) and have been created recently. Use protection against malware and phishing on all your computers and smartphones. Kaspersky Premium provides comprehensive protection for gamers and computer enthusiasts.

 Malware and Vulnerabilities

WPScan observed in April increased exploitation activity against WordPress sites with versions of the plugin older than 5.7.0.1, which are vulnerable to a high-severity (8.8) unauthenticated cross-site scripting flaw tracked as CVE-2023-40000.

 Malware and Vulnerabilities

A critical remote code execution (RCE) flaw, CVE-2023-49606, was found affecting nearly 52,000 Tinyproxy servers. This vulnerability was disclosed by Cisco Talos in December 2023, impacting versions 1.11.1 and 1.10.0 of Tinyproxy.

 Trends, Reports, Analysis

In a new report, Cato observed that the Log4J exploit represented 30% of the outbound vulnerability exploitations and 18% of the inbound vulnerability exploitations detected in the first quarter of 2024.

 Trends, Reports, Analysis

Ransomware operations are experiencing a decline in profitability due to various factors such as increased cyber resilience of organizations, the availability of decryptors, and more frequent law enforcement actions.

 Companies to Watch

Noname, one of the top API security vendors in the market, will enhance Akamai’s existing API Security solution and accelerate its ability to meet growing customer demand and market requirements as the use of APIs continues to expand.

 Malware and Vulnerabilities

Zeus Stealer is designed to steal sensitive information such as passwords and cryptocurrency wallets from infected systems. The attackers utilize the popularity of Minecraft to lure unsuspecting users into downloading and executing the payload.

 Companies to Watch

The healthcare cybersecurity services company intends to use the funds to broaden its offerings, including capabilities such as healthcare threat intelligence and automated response.

 Identity Theft, Fraud, Scams

As reported by the BBC, Lloyds Bank estimates that fans have lost an estimated £1m ($1.25 m) in ticket scams ahead of the UK leg of Taylor Swift’s Eras tour. Roughly 90% of these scams were said to have started on Facebook.

 Feed

A high-severity flaw impacting the LiteSpeed Cache plugin for WordPress is being actively exploited by threat actors to create rogue admin accounts on susceptible websites. The findings come from WPScan, which said that the vulnerability (CVE-2023-40000, CVSS score: 8.3) has been leveraged to set up bogus admin users with the names wpsupp‑user 

 Feed

״Defenders think in lists, attackers think in graphs,” said John Lambert from Microsoft, distilling the fundamental difference in mindset between those who defend IT systems and those who try to compromise them. The traditional approach for defenders is to list security gaps directly related to their assets in the network and eliminate as many as possible, starting with the most critical.

 Feed

A newer version of a malware loader called Hijack Loader has been observed incorporating an updated set of anti-analysis techniques to fly under the radar. "These enhancements aim to increase the malware's stealthiness, thereby remaining undetected for longer periods of time," Zscaler ThreatLabz researcher Muhammed Irfan V A said in a technical report. "Hijack

 Feed

Permissions in SaaS platforms like Salesforce, Workday, and Microsoft 365 are remarkably precise. They spell out exactly which users have access to which data sets. The terminology differs between apps, but each user’s base permission is determined by their role, while additional permissions may be granted based on tasks or projects they are involved with. Layered on top of

 A Little Sunshine

Source: krebsonsecurity.com – Author: BrianKrebs The United States joined the United Kingdom and Australia today in sanctioning 31-year-old Russian national Dmitry Yuryevich Khoroshev as the alleged leader of the infamous ransomware group LockBit. The U.S. Department of Justice also indicted Khoroshev and   show more ...  

charged him with using Lockbit to attack more than 2,000 victims and extort […] La entrada U.S. Charges Russian Man as Boss of LockBit Ransomware Group – Source: krebsonsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.lastwatchdog.com – Author: bacohido By Byron V. Acohido SAN FRANCISCO – The already simmering MSSP global market just got hotter. Related: The transformative power of GenAI/LLM This week at RSA Conference 2024, AT&T announced the launch of LevelBlue – a top-tier managed security services   show more ...  

business formed by an alliance with AT&T and WillJam Ventures. […] La entrada RSAC Fireside Chat: AT&T, WillJam Ventures partner to launch new MSSP — LevelBlue – Source: www.lastwatchdog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.lastwatchdog.com – Author: bacohido By Byron V. Acohido SAN FRANCISCO — Cloud security is stirring buzz as RSA Conference 2024 ramps up at Moscone Convention Center here. Related: The fallacy of ‘security-as-a-cost-center’ Companies are clambering to mitigate unprecedented exposures spinning   show more ...  

out of their increasing reliance on cloud hosted resources. The unfolding disruption of Generative […] La entrada RSAC Fireside Chat: Lacework’s cloud-native security platform delivers useful context – Source: www.lastwatchdog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CISA

Source: news.sophos.com – Author: Chester Wisniewski Ransomware often feels like an insurmountable problem that will plague us forever, but recent data suggests we may be finally making progress. The key to solving the most difficult problems is to understand the size and scope of the threats, analyze their   show more ...  

inner workings, and devise strategic means to […] La entrada Defenders assemble: Time to get in the game – Source: news.sophos.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Coolest

Source: www.proofpoint.com – Author: 1 At RSA Conference 2024 this week, vendors are showcasing new products in categories including SASE, security operations and application security — with many touting newly released, GenAI-powered cybersecurity capabilities. Big RSAC Product Announcements Even as the   show more ...  

cybersecurity industry continues to maintain its rapid growth pace — leading many vendors to […] La entrada 20 Coolest Cybersecurity Products At RSAC 2024 – Source: www.proofpoint.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.proofpoint.com – Author: 1 Customers now benefit from both new pre-delivery social engineering and link protection and post-delivery behavioral AI capabilities to stop the techniques threat actors depend on SUNNYVALE, Calif. and RSA Conference 2024, SAN FRANCISCO – May 6, 2024 – Proofpoint, Inc.   show more ...  

, a leading cybersecurity and compliance company, today unveiled two industry-first innovations […] La entrada Proofpoint Sets New Industry Standard in Email Security with Adaptive Threat Protection Capabilities Across the Entire Email Delivery Chain – Source: www.proofpoint.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.proofpoint.com – Author: 1 In a special episode of Behind the Deal live from Thoma Bravo’s Annual Meeting in March 2024, Managing Partner Seth Boro welcomes Sumit Dhawan, CEO at Proofpoint, Mike Capone, CEO at Qlik, and Charlie Gottdiener, CEO at Anaplan, to the stage to discuss how their   show more ...  

companies are leveraging the power […] La entrada How AI is Fueling Software’s Growth – Live from Miami – Source: www.proofpoint.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.proofpoint.com – Author: 1 Home » Videos » Proofpoint’s Brian Reed on the Data Loss Landscape April 22, 2024 Proofpoint recently launched their inaugural Data Loss Landscape report, which showcases that humans are the cause of most data loss incidents. Brian Reed delves into the state of data   show more ...  

loss protection and explains how enterprises […] La entrada Proofpoint’s Brian Reed on the Data Loss Landscape – Source: www.proofpoint.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.proofpoint.com – Author: 1 Greg Lesnewich, senior threat researcher at Proofpoint, sits down to discuss “From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering.” Since 2023, TA427 has directly solicited foreign policy experts for their opinions on nuclear   show more ...  

disarmament, US-ROK policies, and sanction topics via benign conversation starting emails.  The research states “While […] La entrada The art of information gathering. – Source: www.proofpoint.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.schneier.com – Author: Bruce Schneier New Attack on VPNs This attack has been feasible for over two decades: Researchers have devised an attack against nearly all virtual private network applications that forces them to send and receive some or all traffic outside of the encrypted tunnel designed to   show more ...  

protect it from snooping or tampering. […] La entrada New Attack on VPNs – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Lawrence Abrams Image: DocGo Mobile medical care firm DocGo confirmed it suffered a cyberattack after threat actors breached its systems and stole patient health data. DocGo is a healthcare provider that offers mobile health services, ambulance services, and remote   show more ...  

monitoring for patients in thirty US states and across the United Kingdom. In […] La entrada DocGo discloses cyberattack after hackers steal patient health data – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas Hackers have been targeting WordPress sites with an outdated version of the LiteSpeed Cache plugin to create administrator users and gain control of the websites. LiteSpeed Cache (LS Cache) is advertised as a caching plugin used in over five million   show more ...  

WordPress sites that helps speed up page loads, improve visitor experience, and […] La entrada Hackers exploit LiteSpeed Cache flaw to create WordPress admins – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Ionut Ilascu The UK Government confirmed today that a threat actor recently breached the country’s Ministry of Defence and gained access to part of the Armed Forces payment network. The attacked system contained personal data belonging to active and reserve   show more ...  

personnel as well as some recently retired veterans. MoD core network unaffected In a statement […] La entrada UK confirms Ministry of Defence payroll data exposed in data breach – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas A new attack dubbed “TunnelVision” can route traffic outside a VPN’s encryption tunnel, allowing attackers to snoop on unencrypted traffic while maintaining the appearance of a secure VPN connection. The method, described in detail in a   show more ...  

report by Leviathan Security, relies on the abuse of Dynamic Host Configuration Protocol’s […] La entrada New attack leaks VPN traffic using rogue DHCP servers – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas Nearly 52,000 internet-exposed Tinyproxy instances are vulnerable to CVE-2023-49606, a recently disclosed critical remote code execution (RCE) flaw. Tinyproxy is an open-source HTTP and HTTPS proxy server designed to be fast, small, and lightweight. It is   show more ...  

specifically tailored for UNIX-like operating systems and is commonly used by small businesses, public WiFi […] La entrada Over 50,000 Tinyproxy servers vulnerable to critical RCE flaw – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas BetterHelp has agreed to pay $7.8 million in a settlement agreement with the U.S. Federal Trade Commission (FTC) over allegations of misusing and sharing consumer health data for advertising purposes. Founded in 2013, BetterHelp is an alternative   show more ...  

to traditional face-to-face therapy sessions. It provides a mental health platform for direct […] La entrada BetterHelp to pay $7.8 million to 800,000 in health data sharing settlement – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Adobe

Source: www.techrepublic.com – Author: Matthew Sainsbury There is growing consensus on how to address the challenge of deepfakes in media and businesses, generated through technologies such as AI. Earlier this year, Google announced that it was joining the Coalition for Content Provenance and Authenticity as a   show more ...  

steering committee member — other organisations in the C2PA […] La entrada Combatting Deepfakes in Australia: Content Credentials is the Start – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Artificial Intelligence

Source: www.techrepublic.com – Author: Matthew Sainsbury In recent weeks, the Australian government has announced several objectives and initiatives that are intended to drive towards a single outcome: a far more robust local manufacturing industry. For Australia to be able to achieve this, it’s going to need   show more ...  

a highly capable and equally well-resourced IT sector working […] La entrada The Australian Government’s Manufacturing Objectives Rely on IT Capabilities – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Amazon

Source: www.techrepublic.com – Author: Megan Crouse The tech industry courses people are taking online can tell a lot about which IT skills are in demand and what paths to careers look like today. Udemy is an online learning platform that collects data quarterly about which courses on its platform are most in   show more ...  

demand. We’ve dialed […] La entrada Udemy Report: Which IT Skills Are Most in Demand in Q1 2024? – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Interview This year is an unfortunate anniversary for information security: We’re told it’s a decade since ransomware started infecting corporations. Extortionists had been hitting normal folk in the early 2010s with file-scrambling malware.   show more ...  

Eventually criminals figured out that there was much more money to be made hitting business networks […] La entrada Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Challenge

Source: thehackernews.com – Author: . Permissions in SaaS platforms like Salesforce, Workday, and Microsoft 365 are remarkably precise. They spell out exactly which users have access to which data sets. The terminology differs between apps, but each user’s base permission is determined by their role,   show more ...  

while additional permissions may be granted based on tasks or […] La entrada A SaaS Security Challenge: Getting Permissions All in One Place  – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . May 08, 2024NewsroomData Encryption / Hardware Security Researchers have discovered two novel attack methods targeting high-performance Intel CPUs that could be exploited to stage a key recovery attack against the Advanced Encryption Standard (AES) algorithm. The   show more ...  

techniques have been collectively dubbed Pathfinder by a group of academics from the University […] La entrada New Spectre-Style ‘Pathfinder’ Attack Targets Intel CPU, Leak Encryption Keys and Data – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . May 08, 2024NewsroomEncryption / Information Stealer A newer version of a malware loader called Hijack Loader has been observed incorporating an updated set of anti-analysis techniques to fly under the radar. “These enhancements aim to increase the   show more ...  

malware’s stealthiness, thereby remaining undetected for longer periods of time,” Zscaler ThreatLabz researcher […] La entrada Hijack Loader Malware Employs Process Hollowing, UAC Bypass in Latest Version – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 cloud

Source: thehackernews.com – Author: . ״Defenders think in lists, attackers think in graphs,” said John Lambert from Microsoft, distilling the fundamental difference in mindset between those who defend IT systems and those who try to compromise them. The traditional approach for defenders is to list   show more ...  

security gaps directly related to their assets in the network […] La entrada The Fundamentals of Cloud Security Stress Testing – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . May 08, 2024NewsroomWeb Security / Vulnerability A high-severity flaw impacting the LiteSpeed Cache plugin for WordPress is being actively exploited by threat actors to create rogue admin accounts on susceptible websites. The findings come from WPScan, which said that   show more ...  

the vulnerability (CVE-2023-40000, CVSS score: 8.3) has been leveraged to set […] La entrada Hackers Exploiting LiteSpeed Cache Bug to Gain Full Control of WordPress Sites – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securelist.com – Author: Kaspersky Ransomware attacks continue to be one of the biggest contemporary cybersecurity threats, affecting organizations and individuals alike on a global scale. From high-profile breaches in healthcare and industrial sectors – compromising huge volumes of sensitive data or   show more ...  

halting production entirely – to attacks on small businesses that have become relatively […] La entrada State of ransomware in 2024 – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Lea Kissner Site reliability engineers (SREs) and security teams are more powerful when they work together, and being able to combine our efforts can make or break our teams’ experiences and outputs. Lea Kissner, Chief Information Security Officer, Lacework May 8,   show more ...  

2024 5 Min Read Source: Prostock-studio via Alamy Stock Photo […] La entrada Security Teams & SREs Want the Same Thing: Let’s Make It Happen – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer Source: MAXSHOT.PL via Shutterstock Microsoft will make organizational changes and hold senior leadership directly accountable for cybersecurity as part of an expanded initiative to bolster security across its products and services.   show more ...  

Microsoft’s executive vice president of security, Charlie Bell, announced the plans in a blog post last […] La entrada Microsoft Will Hold Executives Accountable for Cybersecurity – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Tara Seals, Managing Editor, News, Dark Reading Source: Bonaventura via Alamy Stock Photo Law enforcement in Australia, Europe, and the US unmasked “LockBitSupp,” the ringleader behind the infamous ransomware crime gang, in a move that could have financial   show more ...  

implications for companies operating in those regions. The crew’s mastermind turns out to […] La entrada LockBit Honcho Faces Sanctions, With Aussie Org Ramifications – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chinese

Source: www.darkreading.com – Author: Nate Nelson, Contributing Writer Source: Kristoffer Tripplaar via Alamy Stock Photo China-linked hackers deployed a roster of different backdoors and Web shells in the process of compromising the MITRE Corporation late last year. Last month news broke that MITRE, best known   show more ...  

for its Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework, […] La entrada Chinese Hackers Deployed Backdoor Quintet to Down MITRE – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-05
Aggregator history
Wednesday, May 08
WED
THU
FRI
SAT
SUN
MON
TUE
MayJuneJuly