Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Tesla’s Ultra-Wide ...

 Firewall Daily

A new study reveals that Tesla's keyless entry system in its latest Model 3 remains vulnerable to relay attacks despite its upgrade to ultra-wideband (UWB) radio which had been touted as a solution to relay attacks. A relay attack tricks a car into unlocking by relaying signals from an owner's key fob or   show more ...  

smartphone, often from a distance. This technique has been used to steal numerous car models for years as it tricks cars entry systems to respond as if the real owner was nearby. Relay Attacks Remain a Concern for Ultra-Wideband Keyless Systems For over a decade, car thieves have used relay attacks to steal vehicles with keyless entry systems. This technique, which requires minimal equipment, has remained a significant threat despite advancements in car security technology. The ultra-wideband technology was touted by some as a supposed fix and possible end to these relay attacks, with a pending patent filed by Ford Global Technologies LLC (an R&D subsidiary of Ford Motor) describing it as 'most advanced known solution to relay attacks'. [caption id="attachment_69869" align="alignnone" width="1034"] Source: patents.google.com[/caption] However, recent research from cybersecurity firm GoGoByte reveals that some of the latest high-end cars such as the Tesla Model 3 incorporating the ultra-wideband technology, remain vulnerable.The researchers, demonstrated a successful relay attack against the latest Tesla Model 3 despite its UWB upgrade, using less than $100 worth of radio equipment to unlock the car instantly. This vulnerability is particularly concerning as the keyless entry system also controls the car immobilizer that prevents engines from starting until the right key is recognized, potentially allowing an attacker to drive away with the car when successfully compromised. PIN-to-Drive Feature Advised as Critical Safeguard In 2021, documents supposedly originating from a Tesla filing to the US Federal Communications Commission, detailed the implementation of the ultra-wideband technology and described it as immune to relay attacks. However, the founder of the cybersecurity firm emphasized the importance of enabling Tesla's optional PIN-to-drive feature. When enabled, this option requires a four-digit security code to be entered before starting the car, serving as a crucial defense against relay attacks. According to the Wired report, Tesla responded to an email of the researcher's findings by acknowledging the issue but stated that the behavior was as expected and the ultra-wideband technology was not intended to stop relay attacks or intended to prevent car theft. The automotive company stated that it was working on improving the reliability of the technology and that ranging enforcements would be implemented when reliability upgrades were completed. The researchers noted that at least two other carmakers implementing the technology in their cars, also faced the same vulnerability. Noting the ability of Tesla to push over-the-air(OTA) updates to to its cars, the researchers stated that a future update could possibly contain a fix to deal with relay attacks. However, the researchers expressed their belief that the public should be aware of this issue while realizing they were far from immune until then. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Irene Corpuz Urges S ...

 Firewall Daily

The prestigious Habtoor Palace in Dubai is currently hosting the highly anticipated The Cyber Express World Cybercon 3.0 META Cybersecurity Conference. This event has drawn cybersecurity professionals and enthusiasts from around the globe, eager to engage in discussions and gain insights into the evolving landscape of   show more ...  

digital security in the META region. The conference commenced with a welcome note from The Cyber Express Editor-in-Chief, Augustin Kurian, setting an enthusiastic tone for the proceedings. A standout moment of the conference so far has been the keynote address by Irene Corpuz, a distinguished cybersecurity expert and co-founder of Women in Cyber Security Middle East. Corpuz delivered a compelling speech highlighting the increasing risks that cyberattacks pose to startup organizations, stressing that even small startups are prime targets for cybercriminals. The Vulnerability of Startups to Cyber Threats Irene Corpuz emphasized that startups, despite their smaller size and often limited resources, possess valuable intellectual property that can be highly appealing to cybercriminals. “Even small startups are enticing prey to cybercriminals,” Corpuz remarked, underlining the critical need for startups to embed cybersecurity measures from the very beginning of their journey. Her warning comes at a time when the cybersecurity landscape is witnessing a surge in attacks targeting startups.  The Imperative of Security by Design (SBD) Corpuz introduced the concept of Security by Design (SBD) as a crucial strategy for startups to safeguard their operations. SBD involves integrating security measures into every phase of a startup’s lifecycle, from ideation through to scaling and beyond.  “Every startup should integrate security into the startup lifestyle - do SBD,” she urged. This proactive approach ensures that potential security risks are identified and mitigated early, thereby reducing the likelihood of breaches as the company grows. Key Practices of Security by Design Early Identification of Risks: From the initial stages of ideation and prototyping, startups should assess potential security vulnerabilities in their products or services. By addressing these issues early, they can prevent them from becoming significant threats later on. Implementing Robust Security Measures: As startups move towards launching their products or services, it’s critical to incorporate comprehensive security protocols to protect systems and data from external threats. This includes encryption, secure coding practices, and regular security audits. Continuous Monitoring and Improvement: Once operational, startups must maintain a proactive stance by continuously monitoring their security posture. Regular updates and improvements to security measures are essential to stay ahead of evolving cyber threats. Rising Awareness and Adoption of Cyber Insurance The increasing frequency of cyberattacks has made startup founders acutely aware of the risks they face. As a result, there is a growing trend of startups viewing cyber insurance as an indispensable component of their risk management strategy. A recent survey highlighted that many startup leaders are now prioritizing cybersecurity and actively seeking ways to navigate the volatile threat landscape. Conclusion: A Call to Action for Startups Irene Corpuz’s keynote at the ongoing World Cybercon 3.0 META Cybersecurity Conference serves as a crucial reminder of the vulnerabilities that startups face in today’s digital landscape. By advocating for Security by Design and highlighting the importance of continuous monitoring and improvement, Corpuz provided a clear roadmap for startups to enhance their cybersecurity posture. The rising awareness among startup founders about the necessity of robust cybersecurity measures and the adoption of cyber insurance are positive trends. However, as cyber threats continue to evolve, it is imperative for startups to remain vigilant and proactive in safeguarding their intellectual property and customer data. As The Cyber Express World Cybercon 3.0 continues, the insights shared by experts like Irene Corpuz will undoubtedly play a pivotal role in shaping the cybersecurity strategies of startups across the Middle East and beyond. This conference stands as a testament to the critical importance of cybersecurity in an increasingly digital world. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Threat Actor “Unfa ...

 Hacker News

A recently discovered cyber threat actor, dubbed 'Unfading Sea Haze', has been targeting organizations in the South China Sea region since 2018. The threat actor group remained undetected for over five years, despite its attacks on several high-profile military and government entities. Researchers observed   show more ...  

that its operations align with Chinese geopolitical interests in the region. Unfading Sea Nations Likely Affiliated with Chinese Government Bitdefender researchers discovered that the group's TTPs (tactics, techniques, and procedures) and toolset overlaps with that of other Chinese state-sponsored threat actors such as APT41 (BARIUM). Unfading Sea Haze employs a multi-stage attack chain, often beginning with spear-phishing emails carrying malicious LNK files disguised within seemingly innocuous documents. Upon clicking these LNK files, a lengthy obfuscated PowerShell command checks for the presence of an ESET executable (ekrn.exe). If found, the attack halts; otherwise, the PowerShell script directly compiles malware into Windows memory using Microsoft's legitimate msbuild.exe command-line compiler. The attackers use scheduled tasks to side-load malicious DLLs and modify the disabled default administrator account to maintain persistence. They reset the password for the local administrator account, enable it, and hide it from the login screen via Registry modifications. This step provides the threat actors with a hidden administrator account for further attacks. Once access is established, Unfading Sea Haze uses a custom keylogger named 'xkeylog' to capture keystrokes, an browser-data stealer to target data stored in Chrome, Firefox, or Edge browsers, along with various PowerShell scripts to extract information from browser databases. Unfading Sea Haze's campaign employs a wide arsenal of custom-developed malware and publicly available tools. The group's initial campaigns involved the use of tools such as the xkeylog keylogger for credential theft and SharpJSHandler, a web shell alternative for remote code execution. The group later shifted towards the use of stealthier options, such as iterations of the Gh0st RAT malware family including SilentGh0st, TranslucentGh0st, and newer, more modular variants like FluffyGh0st, InsidiousGh0st, and EtherealGh0st. This recent shift demonstrates an ongoing effort to adapt their toolkit for maximum effectiveness and evasion. Unfading Sea Haze also uses commercial Remote Monitoring and Management (RMM) tools, such as Itarian RMM, in the attack chain to establish a foothold on compromised networks. Unfading Haze Shares Similarities with APT41 Adding to the concern, the investigation revealed Unfading Sea Haze's repeated success in regaining access to previously compromised systems. This persistence points to a critical vulnerability often exploited by malicious actors: poor credential hygiene and inadequate patching practices within targeted organizations. Researchers suggest the use of various Gh0st RAT variants by the Unfading Sea Haze group could imply a close connection to the Chinese threat actor ecosystem, where the sharing of closed-source RATs and tools is common among state-sponsored actors. The campaign's integration of the SharpJSHandler module to execute script shares similarities with the invoke command found in the funnyswitch backdoor, which has been frequently employed by APT41 in its campaigns. Both SharpJSHandler and funnyswitch load .NET assemblies and execute JScript code. However, these similarities are limited, as funnyswitch contains additional features not present in SharpJSHandler. No further overlaps with APT41's tooling were discovered during the investigation. Researchers Share Recommendations Researchers note that the Unfading Sea Haze group has demonstrated a high level of sophistication in their attacks, with the usage of a custom malware arsenal for additional flexibility and evasiveness. The shift towards modularity, dynamic elements, and in-memory execution indicates the group's continuous efforts to circumvent traditional security measures. As attackers persistently adapt their tactics, researchers have recommended a comprehensive and layered security approach for likely victims. This includes prioritizing vulnerability management, implementation of strong authentication techniques, network segmentation, traffic monitoring and effective logging. Researchers have also shared IOC (Indicator of Compromise) information on the campaign such as associated IP addresses, domains used, MD5 file hashes and storage file paths. Additionally the researchers have linked to a full report featuring an in-depth look at the Gh0st RAT family and other malware samples. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for PSNI Facing £750,00 ...

 Firewall Daily

The Police Service of Northern Ireland (PSNI) is bracing for a hefty £750,000 fine following last year’s data breach. The PSNI data breach saw the exposure of approximately 10,000 officers and staff who had their personal information inadvertently exposed online.  The PSNI data breach occurred last August when   show more ...  

details, including surnames, initials, ranks, and roles of all serving police personnel, were mistakenly published in response to a Freedom of Information (FOI) request. PSNI Data Breach and £750,000 Fine The gravity of the situation became apparent when it was revealed that this sensitive information remained accessible online for two-and-a-half hours before being removed. Worse, it was confirmed that the data had fallen into the hands of dissident republicans, posing what the Information Commissioner's Office (ICO) described as a "tangible threat to life. In response to this PSNI data leak, the ICO has announced its intention to levy a £750,000 fine on the PSNI, citing inadequate internal procedures and sign-off protocols for the safe disclosure of information. However, it's worth noting that this fine has been mitigated by the organization's public sector approach, which aims to avoid undue impact on public services. Had this approach not been applied, the PSNI could have been facing a staggering fine of £5.6 million. John Edwards, the UK Information Commissioner, emphasized the severity of the breach, highlighting the "perfect storm of risk and harm" it created, particularly given the sensitivities in Northern Ireland. Edwards noted that during the investigation, numerous accounts emerged of the distressing consequences faced by those affected, including having to relocate, sever ties with family members, and drastically alter their daily routines due to genuine fears for their safety. Understanding the Depth of the PSNI Data Leak The proposed fine remains provisional, allowing the PSNI to make representations before a final decision is made. Edwards stressed that while the potential fine could have been significantly higher, discretion was exercised to ensure that public funds were not diverted from essential services. In addition to the fine, the PSNI has been issued a preliminary enforcement notice mandating improvements in personal information security protocols when responding to FOI requests. Edwards pointed out that simple and practical policies could have prevented this incident and urged all organizations to review and enhance their disclosure procedures to safeguard entrusted personal information. A previous independent review concluded that the breach was not an isolated incident but rather the culmination of systemic shortcomings in data security measures within the PSNI. This underscores the need for proactive measures to better secure and protect sensitive data. Despite the financial implications, the PSNI remains committed to addressing the fallout from the breach. Deputy Chief Constable Chris Todd affirmed ongoing efforts to identify and prosecute those responsible for the data loss, with several arrests already made in connection to the investigation. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Chinese Threat Actor ...

 Firewall Daily

Cybersecurity defenders have widely relied on blocking attacker IP addresses through identified IOCs in response to threat actor campaigns. However, Chinese threat actors are rapidly rendering this usual strategy obsolete through the widespread adoption of ORB Networks. ORBs are complex, multi-layered networks,   show more ...  

typically managed by private companies or entities within the Chinese government. They offer access to a constantly shifting pool of IP addresses, allowing multiple threat actors to mask their activities behind seemingly innocuous traffic. Use of ORB Networks by Threat Actors Present Additional Challenges to Defenders Researchers from Mandiant stated that the sheer size and scope of these networks, often hundreds of thousands of nodes deep, provide a great deal of cover and make it difficult for defenders to attribute and learn more about attackers. Additionally, the geographic spread of ORBs allows hackers in China to circumvent geographic restrictions or appear less suspicious by connecting to targets from within their own region. Most importantly, ORB nodes are short-lived, with new devices typically cycled in and out every month or few months, making it difficult for defenders to tie IPs to their users for any good amounts of time. These operational relay box networks (ORBs) are maintained by private companies or elements within the Chinese government and are made up of five layers: Chinese servers, virtual private servers (VPS), traversal nodes, exit nodes, and victim servers. ORBs can be classified into two groups: provisioned, which use commercially rented VPS's, and nonprovisioned, built on compromised and end-of-life routers and Internet of Things (IoT) devices. These networks are akin to botnets and ORB network administrators can easily grow the size of their network with little effort and create a constantly evolving mesh network that can be used to conceal espionage operations. The researchers cited two prominent examples to illustrate the sophistication of these networks: ORB3/SPACEHOP: A provisioned network linked to APT5 and APT15, targeting entities in North America, Europe, and the Middle East. Known for exploiting vulnerabilities like CVE-2022-27518. ORB2/FLORAHOX: A hybrid network employing compromised Cisco, ASUS, and DrayTek routers, alongside TOR network relays and VPS servers. Linked to APT31 and Zirconium, demonstrating a multi-layered approach to traffic obfuscation. Adapting to the Threat of ORB Networks Researchers have advised that instead of simply blocking adversary infrastructure, defenders must now consider temporality, multiplicity of adversaries, and ephemerality. They recommend approaching these ORB networks as distinct entities with distinct tactics, techniques, and procedures (TTPs) rather than the use of inert indicators of compromise. By analyzing their evolving characteristics - including infrastructure patterns, behaviors, and TTPs - defenders can gain valuable insights into the adversary's tactics and develop more effective defenses. While leveraging proxy networks for attack obfuscation isn't new, the rise of the ORB network industry in China points to long-term investments in equipping cyber operators with more sophisticated tactics and tools. The evolution of these ORBs networks also highlight that a static defense may be a losing defense. To counter this growing threat and level the playing field, enterprises must embrace a mindset of continuous adaptation, while investing in advanced threat intelligence, behavioral analysis tools, and skilled personnel. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for First Nations Health ...

 Firewall Daily

The First Nations Health Authority (FNHA) in British Columbia is currently grappling with the aftermath of a recent cyberattack on its corporate network. This First Nations Health Authority cyberattack, discovered on May 13, 2024 has prompted swift investigation and action from the authority. FNHA, renowned as the   show more ...  

first and sole provincial health authority of its kind across Canada, detected what it termed as "unusual activity" within its corporate network. Acting promptly, the authority intercepted an unauthorized entity that had breached its network perimeter.  Although certain employee information and limited personal data were compromised, FNHA assures that its clinical information systems remained unaffected. Understanding the First Nations Health Authority Cyberattack [caption id="attachment_69815" align="alignnone" width="631"] Source: First Nations Health Authority[/caption] This cyber intrusion marks the latest in a string of cybersecurity incidents across British Columbia. While FNHA asserts no direct link between this attack and previous breaches, the province has been on high alert following similar incidents, including attempted ransomware attacks on B.C. libraries and a cybersecurity breach impacting the operations of a major retailer, London Drugs. In response to the cyberattack, FNHA has mobilized a comprehensive response strategy. The authority has engaged third-party cybersecurity experts to contain and remediate the breach while conducting a thorough forensic investigation to gauge the extent of the incident. Moreover, FNHA has promptly notified law enforcement and the Office of the Information and Privacy Commissioner of British Columbia. Acknowledging the severity of the situation, Premier David Eby highlighted earlier in the month the presence of "sophisticated cybersecurity incidents" targeting government networks. This sentiment highlights the urgent need for heightened vigilance and robust cybersecurity measures across all sectors, particularly within critical infrastructure like healthcare. Mitigation Against the FNHA Cyberattack In light of these developments, Caelan Drayer, a solutions architect at Dyrand Systems, emphasized the vulnerability of health authorities to cyber threats due to the sensitive nature of the data they handle.  Drayer noted that cyber attackers often target health authorities due to perceived weaknesses in cybersecurity practices and the valuable personal information they possess. He further advised individuals potentially affected by the FNHA cyberattack to secure their email accounts, employ strong passwords, and enable two-factor authentication to mitigate risks. As investigations continue and the fallout from the cyberattack on FNHA unfolds, affected individuals have been urged to remain vigilant, monitor their financial accounts, and report any suspicious activity promptly. While the FNHA endeavors to restore normalcy and bolster its cybersecurity posture, the First Nations Health Authority cyberattack is one of the latest string of cyberattacks on the healthcare industry.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Unsaflok: how to for ...

 Business

A group of researchers has published information about the so-called Unsaflok attack, which exploits a number of vulnerabilities in the company dormakabas Saflok hotel door locks. We explain how this attack works, why its dangerous, and how hotel owners and guests can protect themselves against it. How the Unsaflok   show more ...  

attack works The most important thing to know about the Unsaflok attack is that it permits the forging of keycards for electronic Saflok locks, which are widely used in hotels around the world. All an attacker needs is a RFID key from a targeted hotel where these locks are installed. Getting hold of one is easy: for example, the keycard to the attackers own room would suffice. Data obtained from this card would be enough to program a keycard so it can open any door in the hotel. No particularly exotic equipment is required for this either: to read legitimate keycards and also forge keycards, an attacker can use a laptop with an RFID card reader/writer connected to it. Even a regular Android smartphone with NFC can do the trick. A laptop with a contactless smart-card reader/writer can be used to forge keycards. However, a regular Android smartphone with NFC would also do. Source Various hacking tools that work with RFID — such as the popular Flipper Zero or the somewhat more exotic Proxmark3 — can also be used for the Unsaflok attack. It turns out the researchers discovered the possibility of attacking Saflok locks back in 2022. However, adhering to responsible vulnerability disclosure procedures, they gave the manufacturer considerable time to develop protective measures and begin updating the locks. To protect the safety of hotels and their guests, full details of the attack mechanism as well as the proof-of-concept have not yet been published. The researchers promise to share more details about Unsaflok in the future. Which locks are vulnerable to the Unsaflok attack According to researchers, all locks using the dormakaba Saflok system are vulnerable to the attack, including (but not limited to) the RT Series, MT Series, Quantum Series, Saffire Series, and Confidant Series. According to the dormakaba website, Saflok locks have been manufactured since 1988 — for more than 30 years. The Saflok RT series is one of the most common types of dormakaba Saflok locks. Source How common are these locks? As the researchers themselves say, vulnerable Saflok locks are used in over 13,000 hotels in 131 countries worldwide — installed on around three million doors. If data is to be believed stating that there are a total of 17.5 million hotel rooms in the world, it turns out that roughly one in six hotel locks is vulnerable to the Unsaflok attack. dormakaba developed an update that protects against the Unsaflok attack and began updating the locks in November 2023. However, were talking about thousands of hotels and millions of locks, each of which must be individually updated or completely replaced, as well as vast quantities of related equipment. Therefore, the update process takes a considerably long time. According to the researchers, by March 2024, 36% of the vulnerable locks had been updated. Safety tips for guests Saflok locks are easy to recognize — the most popular series, which youre most likely to encounter in hotels, were shown in the illustrations above. And here you can see what the other models of vulnerable locks look like. However, its not possible to distinguish a vulnerable lock from an already updated one by appearance, as outwardly they look exactly the same. However, the type of keycard can help with that: if the hotel uses MIFARE Classic keycards with Saflok locks, then these locks are still vulnerable to the Unsaflok attack. If the hotel has already switched to MIFARE Ultralight C keycards, this is a sign that the locks have been updated. You can determine the keycard type by using the NFC TagInfo by NXP app (Android, iOS). The researchers emphasize that the mere use of MIFARE Classic keycards doesnt necessarily mean that the hotels locks are insecure — other lock systems that use these same cards havent been found to have problems. The danger lies specifically in the combination of MIFARE Classic cards and Saflok locks. If you come across this combo, be aware that the lock may not provide reliable protection against unauthorized entry into the given room. Its worth noting that the internal latch in Saflok locks is also electronically controlled and can be opened with a keycard — including a forged one. Therefore, its pointless using it to protect against intrusion. Instead, you should lock the door with a chain, or a separate deadbolt if there is one. Safety tips for hotel owners The researchers note that they arent aware of any real-life cases of the Unsaflok attack being used against hotels. However, they dont rule out the possibility that someone had already discovered the vulnerabilities in Saflok locks before them — after all, these locks have been on the market for several decades. Therefore, its quite possible that malicious actors are already using this attack to break into hotel rooms, and since such an intrusion looks the same as legitimate use of the lock, its not so easy to notice a break-in. The researchers mention that its possible to detect an Unsaflok attack by examining the entry/exit logs using the Saflok HH6 programmer: due to the nature of the vulnerability, entry with a forged key for all doors might be attributed to an incorrect keycard or incorrect employee. And of course, the main advice: eliminate the vulnerabilities in your dormakaba Saflok locks so as not to put your clients and their property at risk. As you might guess, this means updating your locks as soon as possible. For questions regarding updating Saflok locks, contact the manufacturers technical support service.

image for Transatlantic Cable ...

 News

Episode 348 of the Transatlantic Cable podcast kicks off with news that Google plan to introduce a new AI tool to help detect if youre being scammed in a phone call – a boon for those who fall prey to scams.  From there the team discuss news that Scarlett Johansson isnt best pleased about the likeness of ChatGPTs   show more ...  

new voice, which sounds eerily familiar to her own. To wrap up the team discuss two stories, firstly around how an AI porn-maker (yes people, thats now a job) accidentally leaked his own customer data. The second story centres around BTs decision to move away from copper-cable landlines in the UK to an all-digital future – and its got several people annoyed. If you liked what you heard, please consider subscribing. Android is getting an AI-powered scam call detection feature ChatGPT suspends Scarlett Johansson-like voice as actor speaks out against OpenAI Nonconsensual AI Porn Maker Accidentally Leaks His Customers Emails BT scraps digital landline switch deadline

image for Seizing Control of t ...

 Feed

Much like an airplane's dashboard, configurations are the way we control cloud applications and SaaS tools. It's also the entry point for too many security threats. Here are some ideas for making the configuration process more secure.

 Malware and Vulnerabilities

There are plenty of widely-used code snippet plugins available but in this case the attackers decided to use a very obscure plugin called Dessky Snippets, with only a few hundred active installations at the time of writing.

 Malware and Vulnerabilities

Patchstack discovered the critical flaw in the plugin’s password reset mechanism, specifically within the userpro_process_form function, which allowed unauthenticated users to change the passwords of other users under certain conditions.

 Malware and Vulnerabilities

Apple is one of several companies, along with Google, Skyhook, and others, that operate a WPS. They offer client devices a way to determine their location that's more energy efficient than using the Global Positioning System (GPS).

 Govt., Critical Infrastructure

Former White House National Security Council cyber staff member Jeff Greene, the current cybersecurity programs director at the Aspen Institute think tank, is joining the CISA next month, the agency confirmed.

 Incident Response, Learnings

The U.S. Securities and Exchange Commission (SEC) announced today that a major player in the U.S. financial system has agreed to pay a $10 million penalty for failing to timely report an April 2021 VPN breach.

 Identity Theft, Fraud, Scams

CloudSEK researchers found the fake spyware after perusing around 25,000 posts of individuals offering Pegasus and other NSO tools via channels on the messaging service Telegram.

 Incident Response, Learnings

Microsoft's new automatic screenshot retrieval feature could enable hackers to steal sensitive information such as online banking credentials, security experts warned. Additionally, the U.K ICO will probe Recall for compliance with privacy law.

 Govt., Critical Infrastructure

Much of the testimony – and concerns raised by the committee – focused on the AI advantages for cybercriminals and nation-state actors, advantages that cybersecurity officials say must be countered by increasingly building AI into products.

 Feed

Global Socket is a tool for moving data from here to there, securely, fast, and through NAT and firewalls. It uses the Global Socket Relay Network to connect TCP pipes, has end-to-end encryption (using OpenSSL's SRP / RFC-5054), AES-256 and key exchange using 4096-bit Prime, requires no PKI, has Perfect Forward Secrecy, and TOR support.

 Feed

In this paper, the authors show that Apple's WPS can be abused to create a privacy threat on a global scale. They present an attack that allows an unprivileged attacker to amass a worldwide snapshot of Wi-Fi BSSID geolocations in only a matter of days. Their attack makes few assumptions, merely exploiting the fact   show more ...  

that there are relatively few dense regions of allocated MAC address space. Applying this technique over the course of a year, they learned the precise locations of over 2 billion BSSIDs around the world. The privacy implications of such massive datasets become more stark when taken longitudinally, allowing the attacker to track devices' movements.

 Feed

Ubuntu Security Notice 6736-2 - USN-6736-1 fixed vulnerabilities in klibc. This update provides the corresponding updates for Ubuntu 24.04 LTS. It was discovered that zlib, vendored in klibc, incorrectly handled pointer arithmetic. An attacker could use this issue to cause klibc to crash or to possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 6777-4 - Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.

 Feed

Ubuntu Security Notice 6663-3 - USN-6663-1 provided a security update for OpenSSL. This update provides the corresponding update for Ubuntu 24.04 LTS. As a security improvement, OpenSSL will now return deterministic random bytes instead of an error when detecting wrong padding in PKCS#1 v1.5 RSA to prevent its use in possible Bleichenbacher timing attacks.

 Feed

Ubuntu Security Notice 6783-1 - It was discovered that VLC incorrectly handled certain media files. A remote attacker could possibly use this issue to cause VLC to crash, resulting in a denial of service, or potential arbitrary code execution.

 Feed

Red Hat Security Advisory 2024-3315-03 - Red Hat OpenShift Virtualization release 4.13.9 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.

 Feed

Red Hat Security Advisory 2024-3314-03 - Red Hat OpenShift Virtualization release 4.15.2 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.

 Feed

Red Hat Security Advisory 2024-3312-03 - An update for glibc is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Issues addressed include buffer overflow, code execution, null pointer, and out of bounds write vulnerabilities.

 Feed

Red Hat Security Advisory 2024-3309-03 - An update for glibc is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Issues addressed include buffer overflow, code execution, null pointer, and out of bounds write vulnerabilities.

 Feed

Red Hat Security Advisory 2024-3305-03 - An update for the varnish:6 module is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Issues addressed include a denial of service vulnerability.

 Feed

Microsoft on Wednesday outlined its plans to deprecate Visual Basic Script (VBScript) in the second half of 2024 in favor of more advanced alternatives such as JavaScript and PowerShell. "Technology has advanced over the years, giving rise to more powerful and versatile scripting languages such as JavaScript and PowerShell," Microsoft Program Manager Naveen Shankar said. "These languages

 Feed

Ivanti on Tuesday rolled out fixes to address multiple critical security flaws in Endpoint Manager (EPM) that could be exploited to achieve remote code execution under certain circumstances. Six of the 10 vulnerabilities – from CVE-2024-29822 through CVE-2024-29827 (CVSS scores: 9.6) – relate to SQL injection flaws that allow an unauthenticated attacker within the same network to

 Feed

Conversations about data security tend to diverge into three main threads: How can we protect the data we store on our on-premises or cloud infrastructure? What strategies and tools or platforms can reliably backup and restore data? What would losing all this data cost us, and how quickly could we get it back? All are valid and necessary conversations for technology organizations of all shapes

 Feed

Governmental entities in the Middle East, Africa, and Asia are the target of a Chinese advanced persistent threat (APT) group as part of an ongoing cyber espionage campaign dubbed Operation Diplomatic Specter since at least late 2022. "An analysis of this threat actor’s activity reveals long-term espionage operations against at least seven governmental entities," Palo Alto Networks

 Feed

Ransomware attacks targeting VMware ESXi infrastructure following an established pattern regardless of the file-encrypting malware deployed. "Virtualization platforms are a core component of organizational IT infrastructure, yet they often suffer from inherent misconfigurations and vulnerabilities, making them a lucrative and highly effective target for threat actors to abuse,"

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a security flaw impacting Apache Flink, the open-source, unified stream-processing and batch-processing framework, to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Tracked as CVE-2020-17519, the issue relates to a case of improper access control that

 Feed

The China-linked threat actor known as Sharp Panda has expanded their targeting to include governmental organizations in Africa and the Caribbean as part of an ongoing cyber espionage campaign. "The campaign adopts Cobalt Strike Beacon as the payload, enabling backdoor functionalities like C2 communication and command execution while minimizing the exposure of their custom tools," Check Point

 Apple

iPhone photos come back from the dead! Scarlett Johansson sounds upset about GPT-4o, and there's a cockup involving celebrity fakes. All this and much more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by   show more ...  

special guest Anna Brading of Malwarebytes. Plus! Don't miss our featured interview with Sandy Bird of Sonrai Security.

 Better

Source: www.darkreading.com – Author: Dark Reading Staff 2 Min Read Source: Olekcii Mach via Alamy Stock Photo The Advanced Research Projects Agency for Health (ARPA-H) pledged $50 million to bring together hospital IT staff, equipment managers, and cybersecurity experts to create software that helps hospitals   show more ...  

become cyber-resilient. ARPA-H, a funding agency created by the Biden administration, […] La entrada US Pumps $50M Into Better Healthcare Cyber Resilience – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 authentication

Source: www.darkreading.com – Author: Dark Reading Staff 1 Min Read Source: Igor Golovnov via Alamy Stock Photo A max-critical security vulnerability in GitHub’s Enterprise Server could allow attackers to bypass authentication and obtain administrative privileges. The good news is that the bug   show more ...  

(CVE-2024-4985, CVSS 10) only affects implementations that use the SAML single sign-on (SSO) […] La entrada GitHub Authentication Bypass Opens Enterprise Server to Attackers – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Paul Shomo 5 Min Read Source: Aleksia via Alamy Stock Photo COMMENTARY Artificial intelligence (AI) security, automation’s nonhuman identity problem, and the reinvention of detection and response (DR) were emerging trends at the RSA Conference 2024’s top startup   show more ...  

competition, Innovation Sandbox.  Reality Defender took the crown for deepfake detection. In the space […] La entrada Trends at the 2024 RSA Startup Competition – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Robert Lemos, Contributing Writer Data service provider Snowflake deepened its strategic partnership with cybersecurity-analytics provider Anvilogic this week with a joint offering that could further shake up the security information and event management (SIEM) market. The   show more ...  

two cloud service providers are targeting business customers that already use Snowflake’s software-as-a-service offering for […] La entrada Snowflake's Anvilogic Investment Signals Changes in SIEM Market – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Elizabeth Montalbano, Contributing Writer Source: Jack Maguire via Alamy Stock Photo A novel malware that targets vulnerable drivers to terminate and thus evade endpoint detection and response (EDR) solutions has come to light, for now used in service of an elaborate   show more ...  

cryptomining campaign. Researchers at Elastic Security Labs identified what they […] La entrada Novel EDR-Killing 'GhostEngine' Malware Is Built for Stealth – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Karl Mattson 5 Min Read Source: vska via Alamy Stock Vector COMMENTARY As our world becomes increasingly digitized, malicious actors have more opportunities to carry out attacks. Data breaches and ransomware are on the rise, and the urgency to fortify our digital defenses   show more ...  

has never been greater. With one cyberattack occurring […] La entrada Preparing Your Organization for Upcoming Cybersecurity Deadlines – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chinese

Source: www.darkreading.com – Author: Nate Nelson, Contributing Writer Source: Porntep Lueangon via Alamy Stock Photo Chinese threat actors have been quietly and gradually revolutionizing anti-analysis techniques by hiding their malicious activities behind vast global networks of proxy devices. At issue: the   show more ...  

operational relay box network (ORB), a vast infrastructure comprised of virtual private servers (VPS) […] La entrada Chinese 'ORB' Networks Conceal APTs, Render Static IoCs Irrelevant – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Critical

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer Source: batjaket via Shutterstock A critical vulnerability in the open source version of Netflix’ Genie job orchestration engine for big data applications gives remote attackers a way to potentially execute arbitrary code on systems   show more ...  

running affected versions of the software. The bug, designated as CVE-2024-4701, carries a […] La entrada Critical Netflix Genie Bug Opens Big Data Orchestration to RCE – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.schneier.com – Author: Bruce Schneier HomeBlog Comments Winter • May 22, 2024 7:33 AM I assume that pixelation is chosen to give an impression of a text. That is, the fact that it is a string of characters with a given length. So, the prudent way to do it is to first generate a […] La   show more ...  

entrada Unredacting Pixelated Text – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Dark Reading Staff 1 Min Read Source: krot studio via Shutterstock Despite the interest in AI tools and AI-enhanced technologies, many organizations are holding back because of one of three major barriers: lack of visibility, control, and protection. And there is a growing   show more ...  

consensus that broad AI adoption means a need […] La entrada WitnessAI Launches With Guardrails for AI – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . May 23, 2024NewsroomEndpoint Security / Data Privacy Microsoft on Wednesday outlined its plans to deprecate Visual Basic Script (VBScript) in the second half of 2024 in favor of more advanced alternatives such as JavaScript and PowerShell. “Technology has   show more ...  

advanced over the years, giving rise to more powerful and versatile scripting […] La entrada The End of an Era: Microsoft Phases Out VBScript for JavaScript and PowerShell – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Artificial Intelligence

Source: www.techrepublic.com – Author: Megan Crouse Following the announcements of Copilot+ enabled AI PCs at the Microsoft Build developer event on May 20, Microsoft released new developer tools, enhancements to Microsoft Azure AI and new enterprise options for Copilot. GitHub Copilot received a lengthy list   show more ...  

of new capabilities enabled by first- and third-party services. Meanwhile, […] La entrada Microsoft Build 2024: Copilot AI Will Gain ‘Personal Assistant’ and Custom Agent Capabilities – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.techrepublic.com – Author: Ray Fernandez We may earn from vendors via affiliate links or sponsorships. This might affect product placement on our site, but not the content of our reviews. See our Terms of Use for details. This guide explains how you can change the location of your virtual private   show more ...  

network for privacy, security […] La entrada How to Change Your VPN Location (A Step-by-Step Guide) – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Bitdefender says it has tracked down and exposed an online gang that has been operating since 2018 nearly without a trace – and likely working for Chinese interests. A report from the antivirus maker details the miscreants – dubbed Unfading Sea Haze – and   show more ...  

their methods for breaking into […] La entrada ‘China-aligned’ spyware slingers operating since 2018 unmasked at last – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register The House Foreign Affairs Committee voted Wednesday to advance a law bill expanding the White House’s authority to police exports of AI systems – including models said to pose a national security threat to the United States. “AI has created a   show more ...  

technology revolution that will determine whether America remains […] La entrada Lawmakers advance bill to tighten White House grip on AI model exports – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register More than 100 medical industry groups have asked the Feds to make UnitedHealth Group, not them, go through the rigmarole of notifying everyone about the Change Healthcare ransomware infection. In a letter to the US Department of Health and Human Services, 102   show more ...  

national and state medical associations – whose […] La entrada Go after UnitedHealth, not us, 100+ medical groups urge Uncle Sam – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Canadian pharmacy chain London Drugs has confirmed that ransomware thugs stole some of its corporate files containing employee information and says it is “unwilling and unable to pay ransom to these cybercriminals.” In a statement to The Register,   show more ...  

the British Columbia-based biz described the April 28 intrusion, which it […] La entrada Canada’s London Drugs confirms ransomware attack after LockBit demands $25M – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register The New York Stock Exchange’s parent company has just been hit with a $10 million fine for failing to properly inform the Securities and Exchange Commission (SEC) of a 2021 cyber intrusion.  In an order published today, the SEC said that Intercontinental   show more ...  

Exchange (ICE) will pay the penalty to […] La entrada NYSE parent gets $10M wrist tap for failing to report 2021 systems break-in – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Georgia resident Malachi Mullings received a decade-long sentence for laundering money scored in scams against healthcare providers, private companies, and individuals to the tune of $4.5 million. The Department of Justice initially brought charges against the   show more ...  

31-year-old back in February 2022, accusing him of money laundering and conspiracy to […] La entrada Laundering cash from healthcare, romance scams lands US man in prison for a decade – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register The US Securities and Exchange Commission (SEC) wants to clarify guidelines for public companies regarding the disclosure of ransomware and other cybersecurity incidents. According to the breach reporting rules the federal agency adopted in July, public   show more ...  

companies must disclose material events under Item 1.05 of Form 8-K. This is […] La entrada Confused by the SEC’s IT security breach reporting rules? Read this – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securelist.com – Author: Haidar Kabibo A journey into forgotten Null Session and MS-RPC interfaces (PDF) It has been almost 24 years since the null session vulnerability was discovered. Back then, it was possible to access SMB named pipes using empty credentials and collect domain information. Most   show more ...  

often, attackers leveraged null sessions for gathering domain […] La entrada A journey into forgotten Null Session and MS-RPC interfaces – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Artificial Intelligence & Machine Learning , Next-Generation Technologies & Secure Development Thousands of People Tricked Bots into Revealing Sensitive Data in Lab Setting Rashmi Ramesh (rashmiramesh_) • May 22, 2024     Most participants in a prompt   show more ...  

injection contest were able to trick a chatbot into divulging a password. (Image: […] La entrada Anyone Can Trick AI Bots into Spilling Passwords – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Chip Gandy Lead Endpoint Engineer, Cox Communications Chip Gandy is the Lead Endpoint Engineer for Cox Communications.  He has been in the IT field for over 25 years focusing on endpoint management and better user experience through automation and tools.  Industry   show more ...  

changes over two decades have shifted from freedom to […] La entrada Webinar | Level Up Your Security Stack: EDR vs Endpoint Privilege Management – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Adversary

Source: www.databreachtoday.com – Author: 1 Ray Umerley Field CISO, Coveware Ray Umerley is the Field CISO for Coveware. With more than 20+ years of experience in a variety of security functions in the enterprise arena, Ray is helping to bring a wealth of knowledge to our clients’ security programs. Prior to   show more ...  

Coveware, Ray was the […] La entrada Live Webinar | Adversary Analysis of Ransomware Trends – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Boosts

Source: www.databreachtoday.com – Author: 1 Governance & Risk Management , Managed Detection & Response (MDR) , Managed Security Service Provider (MSSP) Purchase Fills Gap in OpenText’s Cyber Offering for Small and Mid-Sized Businesses Michael Novinson (MichaelNovinson) • May 22, 2024       show more ...  

OpenText will fill the managed detection and response gap in its cyber platform […] La entrada OpenText Boosts MDR Offering for MSPs With Pillr Acquisition – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 applications

Source: www.databreachtoday.com – Author: 1 Thank you for registering with ISMG Complete your profile and stay up to date Need help registering? Contact Support Original Post url: https://www.databreachtoday.com/webinars/secure-your-applications-learn-how-to-prevent-ai-generated-code-risks-w-5602 Category   show more ...  

& Tags: – La entrada Secure Your Applications: Learn How to Prevent AI Generated Code Risks – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Thank you for registering with ISMG Complete your profile and stay up to date Need help registering? Contact Support Original Post url: https://www.databreachtoday.com/webinars/webinar-mythbusting-mdr-w-5604 Category & Tags: – La entrada Webinar |   show more ...  

Mythbusting MDR – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 automation

Source: www.databreachtoday.com – Author: 1 Critical Infrastructure Security , Governance & Risk Management , Operational Technology (OT) Advisory Says Disconnecting ICS Reduces Exposure to Malicious Cyber Activities Prajeet Nair (@prajeetspeaks) • May 22, 2024     Rockwell Automation urged industry to   show more ...  

ensure that devices not configured for the internet aren’t exposed to it. (Image: Shutterstock) […] La entrada Rockwell Automation Urges Disconnection of ICS from the Internet – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Governance & Risk Management , Privacy UK Privacy Watchdog Launches Probe Into Microsoft Screenshot Storage Feature Akshaya Asokan (asokan_akshaya) • May 22, 2024     Microsoft Recall in action. (Image: Microsoft) Microsoft’s new automatic screenshot   show more ...  

retrieval feature could enable hackers to steal sensitive information such as online banking credentials, security […] La entrada Microsoft’s Recall Stokes Security and Privacy Concerns – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securelist.com – Author: Cristian Souza, Eduardo Ovalle, Ashley Muñoz, Christopher Zachor Introduction Attackers always find creative ways to bypass defensive features and accomplish their goals. This can be done with packers, crypters, and code obfuscation. However, one of the best ways of evading   show more ...  

detection, as well as maximizing compatibility, is to use the operating […] La entrada ShrinkLocker: Turning BitLocker into ransomware – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 Security researchers have revealed a series of criminal campaigns that exploit cloud storage services such as Amazon S3, Google Cloud Storage, Backblaze B2 and IBM Cloud Object Storage.  These campaigns, driven by unnamed threat actors, aim to redirect users to   show more ...  

malicious websites to steal their information using SMS messages. According […] La entrada Cybercriminals Exploit Cloud Storage For SMS Phishing Scams – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: 1 Security researchers have reported a significant increase in cyber activity targeting the upcoming Indian general election.  This surge, driven by various hacktivist groups, has resulted in the leakage of personal identifiable information (PII) of Indian   show more ...  

citizens on the dark web. The election, set to occur in seven phases from April […] La entrada Indian Election Faces Cyber-Attacks, Data Leaks on Dark Web – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 attacks

Source: thehackernews.com – Author: . May 23, 2024NewsroomRansomware / Virtualization Ransomware attacks targeting VMware ESXi infrastructure following an established pattern regardless of the file-encrypting malware deployed. “Virtualization platforms are a core component of organizational IT   show more ...  

infrastructure, yet they often suffer from inherent misconfigurations and vulnerabilities, making them a lucrative and highly effective target for threat […] La entrada Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Actively

Source: thehackernews.com – Author: . May 23, 2024NewsroomThreat Intelligence / Vulnerability, The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a security flaw impacting Apache Flink, the open-source, unified stream-processing and batch-processing framework, to the Known   show more ...  

Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Tracked as CVE-2020-17519, the issue relates to a […] La entrada CISA Warns of Actively Exploited Apache Flink Security Vulnerability – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . The China-linked threat actor known as Sharp Panda has expanded their targeting to include governmental organizations in Africa and the Caribbean as part of an ongoing cyber espionage campaign. “The campaign adopts Cobalt Strike Beacon as the payload, enabling   show more ...  

backdoor functionalities like C2 communication and command execution while minimizing the […] La entrada New Frontiers, Old Tactics: Chinese Espionage Group Targets Africa & Caribbean Govts – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . May 23, 2024NewsroomCyber Espionage / Network Security Governmental entities in the Middle East, Africa, and Asia are the target of a Chinese advanced persistent threat (APT) group as part of an ongoing cyber espionage campaign dubbed Operation Diplomatic Specter   show more ...  

since at least late 2022. “An analysis of this threat actor’s […] La entrada Inside Operation Diplomatic Specter: Chinese APT Group’s Stealthy Tactics Exposed – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Conversations about data security tend to diverge into three main threads: How can we protect the data we store on our on-premises or cloud infrastructure? What strategies and tools or platforms can reliably backup and restore data? What would losing all this data cost us,   show more ...  

and how quickly could we […] La entrada Are Your SaaS Backups as Secure as Your Production Data? – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . May 23, 2024NewsroomEndpoint Security / Vulnerability Ivanti on Tuesday rolled out fixes to address multiple critical security flaws in Endpoint Manager (EPM) that could be exploited to achieve remote code execution under certain circumstances. Six of the 10   show more ...  

vulnerabilities – from CVE-2024-29822 through CVE-2024-29827 (CVSS scores: 9.6) – relate to […] La entrada Ivanti Patches Critical Remote Code Execution Flaws in Endpoint Manager – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Business email compromise

Source: www.tripwire.com – Author: Graham Cluley A scammer has been sentenced to 10 years in prison for laundering over US $4.5 million obtained by targeting businesses and the elderly with Business Email Compromise (BEC) and romance fraud scams. Malachi Mullings, a 31-year-old from Sandy Springs, Georgia, was   show more ...  

charged with opening 20 bank accounts in the […] La entrada 10 years in prison for $4.5 million BEC scammer who bought Ferrari to launder money – Source: www.tripwire.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-05
Aggregator history
Thursday, May 23
WED
THU
FRI
SAT
SUN
MON
TUE
MayJuneJuly