Oktacron - Cyber Security RSS Feeds History

NCB Buenos Aires Faces Alleged Threat from XSS and CSRF Vulnerabilities

cyberexpress Jun 25, 2024 Firewall Daily

The National Central Bureau (NCB) Buenos Aires, a vital division of Interpol in Argentina, has been listed by a dark web actor, claiming to leak methods to exploit XSS and CSRF vulnerabilities in the domain of the Argentine Division of Interpol. The alleged leak came to light when a threat actor known as “emocat” show more ...

posted on BreachForums detailing techniques to exploit these vulnerabilities within the domain. The threat actor also shared a URL hinting at a potential error message on the affected web page. XSS and CSRF Vulnerabilities Targeting Interpol in Argentina The disclosure has raised concerns within the governmental and law enforcement sectors, affecting not only Interpol but also Argentina's broader cybersecurity landscape. Despite Emocat's claims, there is currently no confirmed evidence of active exploitation on the NCB Buenos Aires website, interpol.gov.ar. As of now, the website remains operational without visible signs of compromise, suggesting that the vulnerabilities disclosed have not yet been exploited. [caption id="attachment_78793" align="alignnone" width="1563"] Source: Dark Web[/caption] The Cyber Express has reached out to the National Central Bureau (NCB) Buenos Aires to learn more about this leak of XSS and CSRF vulnerabilities or any confirmation of active exploitation. However, at the time of writing this, no official statement or response has been received, leaving the claims for this exploitation of XSS and CSRF vulnerabilities to stand unverified. This lack of official confirmation highlights the uncertain nature of the current threat status regarding Interpol's operations in Buenos Aires. What are XSS and CSRF Vulnerabilities? XSS (Cross-Site Scripting) and CSRF (Cross-Site Request Forgery) are critical security vulnerabilities that pose significant risks to web applications and user data. XSS involves attackers injecting malicious scripts, typically JavaScript, into web pages viewed by other users. These scripts execute in the victim's browser context, allowing attackers to steal sensitive information, hijack sessions, modify page content, or redirect users to malicious sites. XSS vulnerabilities come in several forms: reflected, where the script is part of the request URL and reflected in the response; stored, where the script is permanently stored on the server and executed whenever the affected page is accessed; and DOM-based, where the attack occurs within the client-side script itself. In contrast, CSRF exploits the trust that a web application has in a user's browser after authentication. Attackers trick users into unwittingly performing actions on a trusted site where they are authenticated. This is achieved by crafting a malicious request that appears legitimate to the application but originates from a different site visited by the victim. CSRF attacks can lead to unauthorized actions such as changing account settings, making purchases, or transferring funds without the victim's knowledge. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Exploiting a Use-After-Free Vulnerability in the Linux Kernel: A Zero-Day Threat Emerges

cyberexpress Jun 25, 2024 Firewall Daily

A security threat has surfaced on dark web forums: a zero-day exploit targeting a use-after-free (UAF) vulnerability in the Linux Kernel, specifically version 6.6.15-amd64. This use-after-free vulnerability, advertised for sale by an actor known as Cas, promises capabilities that include privileged code execution and show more ...

potential access to sensitive data. According to the post, which has garnered attention from cybersecurity communities, the Linux Kernel vulnerability exploit is being offered for $150,000 in either Monero or Bitcoin. The threat actor Cas has specified that interested buyers must demonstrate proof of sufficient funds before any transaction can proceed, highlighting the illicit nature and high stakes of such transactions. Use-After-Free Vulnerability Targets Linux Kernel [caption id="attachment_78815" align="alignnone" width="1553"] Source: Dark Web[/caption] The Linux Kernel vulnerability, if successfully deployed, could allow malicious actors to escalate their privileges locally within affected systems, potentially executing code with root-level permissions. This type of vulnerability poses severe risks to both individual users and organizations relying on Linux-based systems. Selling Oday Use-after free in the Linux Kernel, you can use it to do a Privileged Code Execution (LPE (Local Privilege Escalation), or execute code with root privileges), (Data Leakage )..etc Affected version: 6.6.15-amd64. Environment arch: 64-bit and Price: 150k Monero & BTC", reads the threat actor post. Moderators on these forums have highlighted another individual, known as IntelBroker, who claims to have verified the proof-of-concept (PoC) behind the exploit privately. This endorsement adds credibility to Cas's offer, despite the lack of publicly available evidence. Previous Instances and Industry Impact Earlier, cybersecurity firm Rewterz reported a similar instance involving CVE-2024-36886, where a use-after-free flaw in the Linux Kernel (version 4.1) could be exploited by remote attackers to execute arbitrary code. This use-after-free vulnerability, triggered by fragmented TIPC messages, highlights ongoing challenges in securing Linux environments against sophisticated exploits. A use-after-free (UAF) vulnerability occurs when a program continues to access memory that has already been deallocated. This issue arises when dynamic memory allocation, typically managed by functions like free() in languages such as C or C++, is mishandled. The program may inadvertently reference this freed memory, leading to unpredictable behavior such as crashes or security vulnerabilities. Exploitation of UAF vulnerabilities can allow attackers to manipulate the program's behavior, potentially executing arbitrary code or escalating privilege Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

TCE Exclusive: Zakir Hussain on Building Strong Relationships in Cybersecurity

cyberexpress Jun 25, 2024 Firewall Daily

Meet Zakir Hussain Rangwala, CEO of BD Software Distribution Pvt. Ltd., a seasoned expert with over two decades in the IT and cybersecurity realms. His journey spans from navigating traditional virus protections to spearheading AI-driven defence strategies against today's sophisticated cyber threats. In this show more ...

interview with The Cyber Express, Rangwala shares pivotal insights on cybersecurity dynamics, leadership strategies, and the future of digital security. Zakir Hussain Interview Excerpts TCE: With over 20 years of experience in the IT and cybersecurity industry, you must have seen many changes. What significant shifts in cybersecurity threats and defences have you witnessed over the years, and how have these changes impacted your approach to securing digital environments? Zakir Hussain: Over the past two decades, cybersecurity has evolved significantly from basic virus and malware defences to tackling advanced threats such as ransomware, nation-state attacks, and zero-day exploits. Initially centered on perimeter defences, the shift is now towards zero-trust models and sophisticated threat detection. The proliferation of cloud computing, IoT, and remote work has widened attack surfaces, requiring continuous monitoring and AI-driven analytics. Today, effective cybersecurity demands a proactive, layered approach that incorporates real-time threat intelligence, ongoing user education, and resilient defence mechanisms. This holistic strategy is essential to safeguarding complex digital environments against evolving cyber threats. TCE: Given your extensive expertise in antivirus and security solutions, what do you believe are the most critical features that a security solution should offer to effectively protect against today's sophisticated threat landscape? Are there any particular technologies or strategies that you consider indispensable? Zakir Hussain: In the current complex threat environment, an effective security solution must encompass several critical features: real-time threat detection, AI-driven analytics, and thorough endpoint protection. Zero Trust Architecture is essential, enforcing rigorous identity verification for all access attempts. Behavioural analysis plays a pivotal role in detecting anomalies in user and network behaviours. Robust encryption protocols secure data both in storage and transit. Automated incident response capabilities facilitate rapid mitigation of breaches. Integration of threat intelligence ensures defences stay ahead of emerging threats. Moreover, ongoing user education and frequent security assessments are indispensable for maintaining a strong security posture amidst continuous digital advancements. TCE: Educating and convincing distributors and partners about the importance of advanced cybersecurity measures can be challenging. How do you approach this task, and what strategies have proven most effective in gaining their buy-in and ensuring they understand the critical nature of robust cybersecurity? Zakir Hussain: Educating and convincing distributors and partners about advanced cybersecurity requires a multifaceted strategy. We provide interactive training sessions focusing on real-world cyber threats and their implications. Use case studies to illustrate the consequences of inadequate security. We provide educations to demonstrate the long-term benefits of cybersecurity investments. Foster open communication and provide ongoing support to address concerns. Implement pilot programs to showcase the effectiveness of advanced measures. Building a collaborative relationship based on shared responsibility is crucial for gaining their buy-in and commitment to enhancing cybersecurity practices. Marketing assistance, including co-branded materials and campaigns, aids partners in effectively showcasing our solutions. TCE: Emerging technologies like AI and machine learning are increasingly becoming part of the cybersecurity landscape. In your opinion, what role do these technologies play in the future of cybersecurity, and how can they be leveraged to enhance threat detection and response capabilities? Zakir Hussain: AI and machine learning are transformative in cybersecurity, revolutionizing threat detection and response capabilities. By analyzing vast datasets in real time, they identify patterns and anomalies that signal cyber threats. Machine learning models adapt to new attack vectors, enhancing accuracy in threat prediction and prevention. AI automates response actions swiftly, mitigating risks faster than manual methods. These technologies also bolster user behaviour analytics, pinpointing insider threats and minimizing false alarms. Leveraging AI and machine learning enables organizations to adopt a proactive, resilient defence stance against evolving and sophisticated cyber threats. TCE: With the proliferation of digital downloads and online services, ensuring their security is paramount. What specific measures do you recommend for safeguarding these platforms against cyber threats, and how can organizations implement these measures effectively? Zakir Hussain: To protect digital downloads and online services, organizations must prioritize secure coding practices, routine code reviews, and vulnerability assessments. Strong encryption for data in transit and at rest, coupled with multi-factor authentication (MFA), is essential to thwart unauthorized access. Regular updates and comprehensive patch management are vital to maintain system security. Web application firewalls (WAFs) should be deployed to defend against common threats such as SQL injection and cross-site scripting. Continuous threat monitoring and a well-defined incident response plan are critical for timely threat mitigation. Effective implementation requires ongoing staff training, strict adherence to security policies, and regular system audits to ensure robust protection. TCE: What initially motivated you to enter the field of IT and cybersecurity, and how has your passion for this field evolved over the years? Are there any pivotal moments or experiences that particularly influenced your career path? Zakir Hussain: I was initially drawn to IT and cybersecurity by a fascination with technology's transformative potential and a desire to solve complex puzzles. Over the years, my passion has evolved through hands-on experience, witnessing the critical importance of safeguarding digital infrastructures and data against evolving threats. Pivotal moments include encountering real-world cyber incidents that underscored the impact of security breaches, and collaborating with diverse teams globally, which broadened my perspective on international cybersecurity challenges. These experiences continue to fuel my commitment to advancing security measures and promoting resilient digital environments in an increasingly interconnected world. TCE: As a team leader, how do you keep your team motivated and informed about the latest developments in cybersecurity? What strategies do you use to foster a culture of continuous learning and adaptability within your team? Zakir Hussain: As a team leader in cybersecurity, I prioritize motivation and continuous learning by fostering an environment where knowledge sharing and professional development are central. Regular team meetings and online sessions keep everyone informed about the latest cybersecurity developments and trends. Encouraging participation in industry conferences, webinars, and certification programs ensures ongoing skill enhancement. I promote a culture of adaptability by encouraging experimentation with new tools and techniques, emphasizing learning from both successes and challenges. Recognizing and celebrating achievements further boosts morale, reinforcing the team's dedication to staying at the forefront of cybersecurity practices. TCE: In light of your extensive experience with distributors and channel partners, what advice would you give to someone looking to build strong, effective relationships within the cybersecurity industry? How can these relationships be leveraged to enhance cybersecurity efforts? Zakir Hussain: Establishing robust relationships with distributors and channel partners in cybersecurity hinges on trust, communication, and mutual benefit. Take the time to comprehend their business objectives and obstacles. Assist with training, marketing tools, and joint sales initiatives. Collaborate closely on customer deployments and incident responses. Regularly exchange insights on emerging threats and industry trends to foster a proactive alliance. By aligning goals and leveraging respective strengths, these partnerships can bolster cybersecurity efforts, enabling broader market reach, quicker response capabilities, and more enhanced solutions that address the evolving demands of customers effectively.

Synnovis Confirms Data Published by Qilin Ransomware Gang as Legitimate

cyberexpress Jun 25, 2024 Ransomware News

After the Qilin ransomware gang last week published on its leak site a data subset as a proof of hacking Synnovis’ systems, the London-based pathology services provider has now confirmed its legitimacy saying the data belongs to its storage drive related to administrative work and contains fragments of patient show more ...

identifiable data. Hackers that are linked to the Russian-linked Qilin ransomware gang published on Friday around 400 gigabytes of sensitive patient data, which they claimed included names, dates of birth, NHS numbers and descriptions of blood tests stolen from Synnovis’ systems. Following the data leak on the dark web, Synnovis confirmed on Monday that the published data was legitimate but noted it was too early to determine the full extent of the compromised information. “Last week a group claiming responsibility for the cyberattack published data online. We have now been able to confirm that this data was stolen from Synnovis’ systems.” - Synnovis An initial review from Synnovis over the weekend revealed no evidence that the Laboratory Information Management Systems (LIMS) - the primary databases for patient test requests and results - were posted. However, fragments of patient-identifiable data from an administrative working drive have been published, Synnovis said. The payroll information storage area remains unaffected but further review of employee-related data that appeared in the dataset published on the dark web is underway. Synnovis emphasized the priority of understanding the compromised administrative working drive. The company is working alongside technical experts to ascertain more details and mitigate concerns among service users, employees and partners. The Information Commissioner’s Office (ICO) is investigating the breach, acknowledging the sensitivity of the leaked data and the anxiety it may cause. “While we are continuing to make enquiries into this matter, we recognize the sensitivity of some of the information in question and the worry this may have caused,” the ICO said. The ICO advises concerned individuals to visit its website and NHS England’s site for guidance and support. NHS England continues collaborating with Synnovis and the National Crime Agency to address the ransomware attack. NHS England acknowledged Synnovis’ initial analysis that confirmed the published data originated from their systems. The complex nature of such investigations means it could take weeks to identify all impacted individuals, it said. As the investigation proceeds, NHS England and Synnovis will provide updates and have established a helpline for those affected. Local health systems are working together to manage the impact on patients and have deployed additional resources to ensure urgent blood samples are processed. Laboratories can now also access historical patient records, which aids continuity of care, NHS England said. The cyberattack has significantly delayed blood tests, with some media reports stating NHS patients potentially waiting up to six months for sample collection. Earlier, Synnovis said the ransomware attack had significantly brought down the daily blood sampling count in major London hospitals from 10,000 to merely 400 per day. The Guardian cited a letter to one of the patients from the impacted hospital being told: “Sadly it appears it may be three to six months before bloods can be taken again. You will be put on a waiting list and our secretaries will contact you when bloods can be taken again. If you haven’t heard anything in the next four months please feel free to contact us on the details above. I want to apologise for this inconvenience and appreciate this will be frustrating.” The pathology service provider was processing only “clinically critical” blood samples flagged by clinicians. These delays have prompted some patients to seek private clinics for faster testing and analysis that cost significantly high. The impact of the Synnovis ransomware attack is also felt on NHS Blood and Transplant (NHSBT), as it appealed to the public earlier this month to urgently donate O blood-type (+ve and -ve) across England. The attack caused significant disruption on the hospitals’ ability to match patients’ blood types, leading to an increased demand for O-positive and O-negative blood donations that are medically considered safe for all patients.

WordPress Plugins Hit by Supply Chain Attack: Update Now!

cyberexpress Jun 25, 2024 Firewall Daily

A new supply chain attack has impacted several plugins hosted on WordPress.org. This WordPress vulnerability, discovered on June 24th, 2024, by the Wordfence Threat Intelligence team, initially centered around the Social Warfare plugin. The plugin was found to have been compromised with malicious code inserted as show more ...

early as June 22nd, 2024, according to a forum post by the WordPress.org Plugin Review team. Upon identifying the malicious file within Social Warfare, the Wordfence team promptly uploaded it to their internal Threat Intelligence platform for analysis. Subsequently, their investigation revealed that the same malicious code had infected four additional plugins. Despite efforts to notify the WordPress plugins team about these compromised plugins, the response has been limited, although the affected plugins have since been delisted from the official repository. WordPress Plugin Vulnerability Leads to Supply Chain Attack According to Wordfence researchers, the listed plugins leading to supply chain attacks include 5 popular names. Among them, Social Warfare versions 4.4.6.4 to 4.4.7.1 were compromised, but a patched version (4.4.7.3) has since been released. Blaze Widget versions 2.2.5 to 2.5.2 and Wrapper Link Element versions 1.0.2 to 1.0.3 were also affected, with no available patched versions. Interestingly, although the malicious code appears removed in Wrapper Link Element version 1.0.0, this version is lower than the infected ones, complicating the update process. Users are advised to uninstall the plugin until a properly tagged version is issued. Similarly impacted were Contact Form 7 Multi-Step Addon versions 1.0.4 to 1.0.5 and Simply Show Hooks version 1.2.1, with no patched versions currently released for either plugin. The injected malware's primary function involves attempting to create unauthorized administrative user accounts on affected websites. These accounts are then leveraged to exfiltrate sensitive data back to servers controlled by the attackers. Additionally, the attackers embedded malicious JavaScript into the footers of compromised websites, potentially impacting SEO by introducing spammy content. Ongoing Investigation and Recovery Despite the malicious code's discovery, it was noted for its relative simplicity and lack of heavy obfuscation, featuring comments throughout that made it easier to trace. The attackers appear to have begun their activities as early as June 21st, 2024, and were actively updating plugins as recently as a few hours before detection. The Wordfence team is currently conducting a thorough analysis to develop malware signatures aimed at detecting compromised versions of these plugins. They advise website administrators to utilize the Wordfence Vulnerability Scanner to check for vulnerable plugins and take immediate action—either by updating to patched versions or removing affected plugins altogether. Key indicators of compromise include the IP address 94.156.79.8, used by the attackers' server, and specific unauthorized administrative usernames such as 'Options' and 'PluginAuth'. To mitigate risks, administrators are urged to conduct comprehensive security audits, including checking for unauthorized accounts and conducting thorough malware scans.

With U.S. Plea Deal, Wikileaks Founder Assange is Free after 14-Year Legal Battle

cyberexpress Jun 25, 2024 Cybersecurity News

After a 14-year legal battle, WikiLeaks founder Julian Assange walked out of the United Kingdom’s Belmarsh prison Monday morning, where he agreed to a plea deal with the United States. According to court documents, Assange agreed to plead guilty to a single charge of conspiracy to obtain and disclose national show more ...

defense information, which violates espionage law in the United States. The sole charge carries a sentence of 62 months in prison, but under the plea deal the time he has already served in the UK prison — a little over 62 months — will be counted as time served. Thus, Assange will not be required to spend any more time behind bars in the U.S., the UK or anywhere else. WikiLeaks Celebrates Assange Release In a statement on platform X, WikiLeaks wrote, “Julian Assange is free.” “He left Belmarsh maximum security prison on the morning of 24 June, after having spent 1901 days there. He was granted bail by the High Court in London and was released at Stansted airport during the afternoon, where he boarded a plane and departed the UK.” – WikiLeaks Assange is being flown to Saipan, the capital of the Northern Mariana Islands and a U.S. commonwealth in the Western Pacific Ocean. The formal hearing and sentencing is set to take place in the U.S. District Court for the Northern Mariana Islands at 9 a.m. local time Wednesday. Assange was reluctant to fly to the mainland U.S., his prosecutors said, and thus Saipan was decided as an alternative due to its proximity with Australia. If the guilty plea is approved by the judge – as is expected – the WikiLeaks founder will head to Australia after the sentencing. Brief Timeline of Julian Assange Espionage Case Julian Assange, the founder and Editor-in-Chief of WikiLeaks, gained prominence after the site published more than 90,000 classified U.S. military documents on the Afghanistan war and about 400,000 classified U.S. documents on the Iraq war. After the release of these documents via WikiLeaks, Assange was indicted by the U.S. on 18 counts, including 17 espionage charges under the 1917 Espionage Act and one for computer misuse, where he allegedly gained unauthorized access to a government computer system of a NATO country. In 2012, Assange communicated directly with a leader of the hacking group LulzSec (who by then was cooperating with the FBI), and provided a list of targets for LulzSec to hack, the indictment said. With respect to one target, Assange asked the LulzSec leader to look for (and provide to WikiLeaks) mail and documents, databases and PDFs. In another communication, Assange told the LulzSec leader that the most impactful release of hacked materials would be from the CIA, NSA, or the New York Times. WikiLeaks obtained and published emails from a data breach committed against an American intelligence consulting company by an “Anonymous” and LulzSec-affiliated hacker. According to that hacker, Assange indirectly asked him to spam that victim company again. An August 2010 arrest warrant for sexual assault allegations in Sweden was initially dropped but later reopened, leading to an international arrest warrant against him. Assange then sought refuge in the Ecuadorian embassy in London. In 2019, Ecuador revoked his asylum, and he was arrested by London police and sentenced to 50 weeks in prison for breaching bail conditions. Swedish prosecutors dropped their case in 2019 because the passage of time had weakened evidence, but they said they retained confidence in the complainant. Assange’s Freedom Starts 'a New Chapter' Stella Assange, the WikiLeaks founder’s wife, was elated and thanked everyone who stood by her husband. “Throughout the years of Julian’s imprisonment and persecution, an incredible movement has been formed. People from all walks of life from around the world who support not just Julian ... but what Julian stands for: truth and justice,” Stella Assange said. “What starts now with Julian’s freedom is a new chapter.”

GrimResource: New Microsoft Management Console Attack Found in Wild

cyberexpress Jun 25, 2024 Cybersecurity News

Threat actors are using a new attack technique that allows them to evade detection and gain full code execution of Microsoft Management Console using specially crafted management saved console (MSC) files. Elastic Security Labs researchers uncovered the new technique after a sample was uploaded to VirusTotal on June 6 show more ...

– and it has yet to trigger static detections by antivirus tools on the site. The researchers are calling the new infection technique GrimResource. GrimResource Attack Uses Old XSS Flaw GrimResource is a “a novel, in-the-wild code execution technique leveraging specially crafted MSC files,” the researchers wrote. “GrimResource allows attackers to execute arbitrary code in Microsoft Management Console (mmc.exe) with minimal security warnings, ideal for gaining initial access and evading defenses.” The key to the attack technique is an old XSS flaw present in the apds.dll library. “By adding a reference to the vulnerable APDS resource in the appropriate StringTable section of a crafted MSC file, attackers can execute arbitrary javascript in the context of mmc.exe,” they said. Attackers can combine the technique with DotNetToJScript to gain arbitrary code execution. The sample begins with a TransformNode obfuscation technique, which was recently reported by open source tool developer Philippe Lagadec in unrelated macro samples. The obfuscation technique helps evade ActiveX security warnings and leads to an obfuscated embedded VBScript, which sets the target payload in a series of environment variables before leveraging the DotNetToJs technique to execute an embedded .NET loader. The researchers named that component PASTALOADER. PASTALOADER retrieves the payload from environment variables set by the VBScript and “spawns a new instance of dllhost.exe and injects the payload into it. This is done in a deliberately stealthy manner using the DirtyCLR technique, function unhooking, and indirect syscalls. In this sample, the final payload is Cobalt Strike.” Using the DotNetToJScript technique triggers another detection looking for RWX memory allocation from .NET on behalf of a Windows Script Host (WSH) script engine. The researchers created a rule in Elastic’s Event Query Language (EQL) to detect execution via the .NET loader. GrimResource Detection Rules Provided Those detections can be bypassed with stealthier methods, the researchers noted: Using apds.dll to execute Jscript via XSS, which can create detectable artifacts in the mmc.exe Procmon output as a CreateFile operation (apds.dll is not loaded as a library), and the creation of a temporary HTML file in the INetCache folder, named redirect[*] as a result of the APDS XSS redirection. In addition to EQL rules, the researchers also provided a YARA detection rule: [caption id="attachment_78894" align="alignnone" width="500"] GrimResource YARA detection rule (source: Elastic Security Labs)[/caption] “Defenders should leverage our detection guidance to protect themselves and their customers from this technique before it proliferates into commodity threat groups,” the researchers warned.

EU Issues New Sanctions Against Russia-Linked Threat Actors

cyberexpress Jun 25, 2024 Cybersecurity News

The European Union has extended its sanctions against threat actors after adding six Russian and Ukrainian nationals to its restrictive measures list. These latest sanctions come as part of the EU's ongoing efforts to combat malicious campaigns that threaten its member states and global security. The Council of show more ...

the European Union adopted the decision to expand sanctions on June 24, 2024, citing the increasing frequency and sophistication of cyberattacks against critical infrastructure and essential services. These attacks, including ransomware, supply chain targeting, and cyberespionage, pose a systemic threat to the EU's security, economy, and society. The sanctions are aimed at preventing, deterring, and discouraging such activities, and are considered a vital instrument in the EU's framework for a joint diplomatic response to malicious cyber activities. Russian Military Intelligence and FSB Operative Sanctions The sanctions will take effect following publication in the Official Journal of the European Union. The council document justified the new sanctions as measures in response to the ongoing war between Russia and Ukraine and its resulting cyber activities: The use of cyber operations that have enabled and accompanied Russia’s unprovoked and unjustified war of aggression against Ukraine affects global stability and security, represents an important risk of escalation, and adds to the already significant increase of malicious cyber activities outside the context of armed conflict over recent years. The growing cybersecurity risks and an overall complex cyber threat landscape, with a clear risk of rapid spill-over of cyber incidents from one Member State to others, and from third countries to the Union, further call for restrictive measures under Decision (CFSP) 2019/797. Among those sanctioned are Ruslan Aleksandrovich Peretyatko and Andrey Stanislavovich Korinets, both identified as members of the "Callisto group" linked to Russian military intelligence. The group, also known as "Seaborgium" or "Star Blizzard," is accused of conducting multi-year phishing campaigns to steal credentials and data, targeting individuals and critical state functions in defense and foreign relations. Two Ukrainian nationals, Oleksandr Sklianko and Mykola Chernykh, were sanctioned for their involvement in the "Armageddon" hacker group, allegedly supported by Russia's Federal Security Service (FSB). The group was found carrying out cyberattacks against the Ukrainian government and EU member states using phishing emails and malware campaigns. Wizard Spider Threat Group Members Sanctioned The EU also targeted two key players in the Russia-based threat group Wizard Spider: Mikhail Mikhailovich Tsarev and Maksim Sergeevich Galochkin. Both are implicated in deploying the "Conti" and "Trickbot" malware programs, which have caused substantial economic damage in the EU through ransomware campaigns targeting essential services such as healthcare, banking and defense. The EU Council has emphasized the need to protect these vital sectors from cyber threats, which can have devastating consequences for individuals, businesses, and societies as a whole. The Council said the sanctions imposed on these six individuals are a clear message that the EU will not tolerate malicious cyber activities that threaten its security, economy, and democracy. The Council document stated: "As part of the sustained, tailored and coordinated Union action against persistent cyber threat actors, six natural persons should be included in the list of natural and legal persons, entities and bodies subject to restrictive measures set out in the Annex to Decision (CFSP) 2019/797. Those persons are responsible for, or were involved in, cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States." The sanctions demonstrate that the EU will continue to work closely with its Member States, international partners, and other stakeholders to address the growing cybersecurity threat landscape escalated by geopolitical tensions. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Doxxing on BreachForums Allegedly Exposes Moderator’s Personal Information

cyberexpress Jun 25, 2024 Cybersecurity News

The infamous cybercrime marketplace BreachForums faced an awkward scenario on June 25, 2024, when a threat actor leaked unverified information about "Aegis”, one of the forum moderators. The doxxing incident of BreachForums moderator was first reported by a LinkedIn user on a cybersecurity forum named show more ...

“CISO2CISO”. BreachForums Moderator Doxxing Details On Tuesday, Bhavesh Mohinani, an SOC analyst and a member of "CISO2CISO," shared screenshots of a BreachForums post by an anonymous threat actor that allegedly contained sensitive Personally Identifiable Information (PII) of BreachForums moderator "Aegis". [caption id="attachment_78802" align="alignnone" width="1069"] Source: LinkedIn[/caption] The threat actor claimed that he obtained “bits and pieces” information about Aegis through his friend. “One thing I was given was a first name and an IP. Looking into it, you find out his information is very much out there! So much OPSEC, am I right,” the TA wrote in his post. OPSEC or Operational Security, is a process that identifies seemingly innocuous actions that could inadvertently reveal critical or sensitive data to a cybercriminal. Elaborating the details of Aegis, the threat actor claimed, “Aegis is a 17-year-old Egyptian resident living with his mother. His father seems not to have been found. Aegis started off being a skid, stealing code, claiming to be harmful and so on...he is a loser. “Aegis will most likely deny this being his information but if this post gets taken down, you will know the truth/ love everyone! Expect this loser,” the TA wrote. The user also shared details claiming to be the moderator’s phone number, IP address, residential address and telegram account. [caption id="attachment_78803" align="alignnone" width="1091"] Source: LinkedIn[/caption] While there is no confirmation or credibility to the claims shared by the anonymous actor, the post was deleted as soon as it was shared. However, the post has raised concerns about the security and trustworthiness of online communities. What is Doxxing? Doxxing, or doxing for short, is when someone puts your personal information out there on the internet. This can include information like where you work, your home address, your credit card numbers, and other private details. Usually, the intention of the threat actor is to harass the victims. The word "doxxing" first came about in the 1990s, starting from the word "documents," which got shortened to "docs," and then finally became "dox." When people talk about "dropping dox," they mean cybercriminals revealing the true identities of their rivals, taking away their anonymity, and making them vulnerable to the authorities. A doxxing attack begins with the threat actor gathering extensive information about their target, searching online and checking social media for clues. Social media can reveal workplace details, which can be exploited for attacks. Skilled threat actors might also trace a target’s IP address to determine their location. The more data a threat actor collects, the more harm they can inflict. While some doxxing incidents are minor, like sending unwanted pizza deliveries, others can lead to severe consequences such as online harassment, swatting, identity theft, reputational damage, physical assault, job loss, or stalking. The alleged doxxing of the BreachForums moderator has raised questions about whether it would lead to the arrest of another threat actor and if it signals the decline of the forums. For example, in California, doxing is considered a serious offense, and individuals engaging in this activity could face legal consequences. Individuals arrested and charged with cyber harassment (doxing) under Penal Code §653.2 face up to one year in jail and a fine of up to $1,000. In April 2023, Hong Kong’s privacy watchdog, Office of the Privacy Commissioner for Personal Data, arrested a 27-year-old woman on suspicion of doxxing after she allegedly posted the personal details of her friend’s ex-boyfriend on social media. Prevention Against Doxxing To protect users against doxxing, one must use strong, unique passwords for each account and enable Multi-Factor Authentication (MFA). Cleaning the digital footprint by removing personal information from online sites, deactivating old accounts, and adjusting privacy settings is regarded as a healthy practice. Using a VPN is recommended to hide the user’s IP address and prevent location tracking. Users must also be vigilant against phishing scams by recognizing poor spelling, mismatched email addresses, and unsolicited links. Finally, avoiding oversharing personal information online and keeping social media profiles private is a healthy digital practice to enhance security. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Work From Home Security Checklist: Top Cybersecurity Tips for Remote Workers

cyberexpress Jun 25, 2024 Features

When transitioning to remote work, the dynamics drastically change from working within a dedicated office environment tailored to the tasks at hand. Adjusting to this new setting can pose challenges in ensuring responsible handling of sensitive company data. In this article, The Cyber Express (TCE) Team delves into show more ...

essential cybersecurity measures your company should implement or may already have in place. TCE also emphasizes actions one can take personally, whether they're accessing networks from home or public locations. Both employers and employees share the responsibility of adhering to strong security protocols, especially with the rise of cyber threats. As organizations increasingly prioritize data protection and server security, it's crucial to stay informed about the latest cybersecurity tips for remote work environments. Keep reading to discover key steps to strengthen your cybersecurity posture while working remotely. Cybersecurity Tips for Remote Workers Know Your Organization's Cyberwork Policies Understanding your organization's cyberwork policies ensures remote workers adhere to established protocols, safeguarding sensitive data. These policies typically include guidelines on using secure connections through VPNs, handling confidential information, and using approved applications. By following these protocols, the risk of phishing or malware attacks is reduced as vulnerabilities from unprotected networks and devices are minimized. Awareness of these policies empowers employees to identify and report suspicious activities promptly, facilitating swift responses to potential threats. Use Only Approved Devices Using devices approved by your organization is critical for cybersecurity as it ensures compliance with company security standards. Approved devices are equipped with essential security measures such as firewalls, antivirus software, and encryption protocols, effectively reducing vulnerabilities. Regular monitoring and updates ensure these devices remain secure with the latest patches, enhancing protection against unauthorized access and cyber threats. Moreover, using approved devices ensures compatibility with secure networks and systems, maintaining overall cybersecurity integrity. Implement the Principle of Least Privilege Implementing access controls based on the principle of least privilege limits access to sensitive information and systems to only those necessary for an employee's role. Strong authentication methods like two-factor authentication (2FA) further verify user identities, enhancing security. Regular review and updates of access permissions are essential, especially in remote work scenarios, to mitigate the risk of unauthorized access and ensure data security. Secure Home Wi-Fi Networks Securing your home Wi-Fi network is crucial when working remotely. Use strong, unique passwords and enable WPA3 encryption to protect against unauthorized access. Changing default router login credentials and regularly updating router firmware further enhances security by safeguarding against vulnerabilities and potential breaches. Consider segregating work and personal network usage to further bolster security measures. Enable Two-Factor Authentication (2FA) Activating two-factor authentication adds an extra layer of security by requiring a second form of verification alongside passwords. This significantly reduces the risk of unauthorized access, even if passwords are compromised. 2FA methods like SMS codes, authenticator apps, or biometric scans provide robust protection, particularly for handling sensitive work-related data remotely. Use Strong, Unique Passwords Protect work-related accounts and devices with strong, unique passwords that include a mix of characters, numbers, and symbols. Avoid using the same password across multiple accounts to mitigate the impact of a potential breach. Consider using a password manager to generate and securely store complex passwords, ensuring optimal security without the risk of forgetting passwords or compromising data integrity. Use Antivirus and Antimalware Software Deploy reliable antivirus and antimalware software to detect, block, and remove malicious software threats such as viruses and ransomware. Regular software updates ensure protection against evolving cyber threats, enhancing device and data security. Conducting regular scans helps identify and mitigate potential security risks, preserving the integrity of work devices and sensitive data. Use a Virtual Private Network (VPN) Utilize a VPN to encrypt internet connections and enhance security when accessing work-related data remotely. VPNs mask IP addresses and encrypt online activities, safeguarding against unauthorized access and data interception on unsecured Wi-Fi networks. Whether working from home or public locations, VPNs provide a secure channel for transmitting sensitive information, ensuring confidentiality and data integrity. Keep Software Updated and Data Backed Up Regularly update operating systems, applications, and security software to protect against vulnerabilities exploited by cybercriminals. Enable automatic updates to ensure devices have the latest security patches and firmware. Back up work data regularly using cloud-based solutions or external hard drives to safeguard against data loss due to hardware failures or cyberattacks. Automating backups ensures data integrity and availability, minimizing disruption and downtime. Have a Plan of Action for Cyberattacks Prepare and maintain a comprehensive plan of action for responding to cyberattacks to mitigate damage and facilitate swift recovery. The plan should outline steps for identifying, isolating, and mitigating threats, as well as notifying IT teams for immediate remediation. Regular drills and simulations help familiarize employees with incident response procedures, ensuring a prompt and effective response to cybersecurity incidents when working remotely. By implementing these cybersecurity tips for remote workers, one can enhance data protection, mitigate risks, and contribute to maintaining a secure work environment from any location.

10 Common Cyber Hygiene Mistakes That Could Compromise Your Security

cyberexpress Jun 25, 2024 Firewall Daily

Cyber hygiene encompasses all practices and steps taken to prevent your accounts and devices from becoming vulnerable to cyber threats. It's about maintaining the cleanliness of your digital identity and understanding the real-life consequences that neglecting it can bring. In this article, The Cyber Express (TCE) show more ...

team will highlight common cyber hygiene mistakes that jeopardize hygiene. These mistakes can range from overlooked steps like using password managers, firewalls, and VPNs, to ignoring seemingly basic practices such as regular software updates and strong password creation. Keep reading to discover how these actions can significantly impact your cybersecurity: Common Cyber Hygiene Mistakes Ignoring Software Updates Software updates include new patches for security vulnerabilities discovered since the last update. Ignoring these updates exposes systems to potential attacks that exploit known weaknesses. Hackers target outdated software because vulnerabilities are public knowledge. Regularly updating all software, including operating systems and applications, is crucial for maintaining security. Automated updates are effective in ensuring software remains up-to-date without relying on manual checks. Lack of Good Email and Phishing Practices Email remains a common target for cyberattacks like phishing and malware distribution. Clicking on links or downloading attachments from unfamiliar or suspicious sources can compromise data security. Phishing emails often appear legitimate but aim to steal sensitive information. Practice caution by verifying senders' identities, checking for suspicious domain names or altered spellings, and using spam filtering tools. Avoid sharing personal information via email to prevent identity theft and fraud. Using Weak, Guessable Passwords Weak passwords like "password123" are easily guessed or cracked using automated tools, posing a significant security risk. Reusing passwords across multiple accounts amplifies this risk—if one account is compromised, others sharing the password become vulnerable. Create strong passwords with a mix of uppercase and lowercase letters, numbers, and special characters unrelated to personal information. Consider using password managers for generating and securely storing complex passwords. Neglecting Antivirus and Antimalware Programs Antivirus and antimalware programs are essential for detecting and removing malicious software that can compromise data security. Failure to install or update these programs leaves devices vulnerable to viruses, ransomware, and spyware. Regular scans and real-time protection features mitigate potential infections, safeguarding against cyber threats. Not Implementing Two-Factor Authentication (2FA) Two-factor authentication adds an extra layer of security by requiring a second verification method, such as a code sent to a phone or facial recognition, in addition to a password. Ignoring 2FA leaves accounts reliant solely on passwords, vulnerable if passwords are compromised. Enable 2FA where available, especially for accounts containing sensitive information, to enhance security. Failing to Back Up Data Regular data backups are crucial for protecting against data loss due to hardware failures, malware, or accidental deletion. Backups stored in multiple locations, including external drives or cloud services, ensure data can be restored if the primary source is compromised. Automated backup solutions simplify this process, minimizing the risk of significant data loss. Using Unsecured Wi-Fi Networks Public or unsecured Wi-Fi networks expose transmitted data to interception by cybercriminals. Hackers can easily capture login credentials, personal information, and financial data transmitted over these networks. Avoid accessing sensitive accounts or financial transactions over public Wi-Fi. Use a virtual private network (VPN) to encrypt internet connections and secure data transmission. Ensure home Wi-Fi networks are secured with strong passwords and encryption protocols. Failing to Utilize Firewalls Firewalls prevent unauthorized access between devices and the internet, essential for blocking external threats like hackers attempting to breach systems. Both hardware and software firewalls monitor and control network traffic based on predefined security rules. Enable firewalls on all connected devices, including computers and routers, to fortify network security against external threats. Neglecting Device Encryption Device encryption converts data into unreadable code, protecting it from unauthorized access if devices are lost or stolen. Ignoring encryption leaves sensitive information vulnerable to exploitation by anyone gaining physical access to devices. Enable built-in encryption tools offered by modern operating systems to ensure data remains secure against unauthorized access. Sharing Excessive Information on Social Media Oversharing personal details on social media increases vulnerability to social engineering attacks and identity theft. Information like birthdates, addresses, and family member names can be exploited to guess weak passwords or craft personalized phishing attacks. Protect yourself by limiting personal information shared online, adjusting privacy settings, and exercising caution with friend requests from unknown individuals. Acknowledging the increasing risks in today's digital world, amplified by technology and social media, is crucial. It's vital to stay updated with evolving defenses against potential threats. Avoid overlooking or neglecting security measures, as they play a critical role in safeguarding your digital presence and personal information. Moreover, avoiding these cyber hygiene mistakes is essential for maintaining strong hygiene and safeguarding against evolving cyber threats.

CISA: Hackers Breached Chemical Facilities’ Data in January

cyberexpress Jun 25, 2024 Data Breach News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Monday that a cyberattack in January may have compromised sensitive information related to the nation's chemical facilities. Initially reported in March, the attack exploited a vulnerability in Ivanti products, leading to the temporary show more ...

shutdown of two systems. In an advisory this week, CISA detailed that the Chemical Security Assessment Tool (CSAT) was specifically targeted by the cyber intrusion, which occurred between January 23 and 26. CSAT contains highly sensitive industrial data, and while all information was encrypted, CISA warned affected participants of the potential for unauthorized access. Potential Data Compromised in Chemical Facilities' Targeting CISA's investigation found no direct evidence of data exfiltration but indicated that the hackers might have accessed critical information such as site security plans, security vulnerability assessments (SVAs), and user accounts within CSAT. Additionally, "Top-Screen surveys," which detail the types and quantities of chemicals, their properties, and storage methods at facilities, might have been exposed. High-risk chemical facilities are mandated to submit SVAs outlining their critical assets, cyber and physical security policies, and an analysis of potential vulnerabilities. Other compromised documents could include details on cybersecurity measures, alarms and physical barriers in place at these facilities. CISA's Response and Recommendations CISA has informed participants in the Chemical Facility Anti-Terrorism Standards (CFATS) program about the potential data exposure. Although no credentials were confirmed to be stolen, CISA advises those with CSAT accounts reset any identical business or personal passwords. They also recommend organizations using Ivanti products review a February advisory about recent vulnerabilities. The agency cannot directly notify individuals submitted for terrorist vetting under the CFATS Personnel Surety Program because it did not collect their contact information. However, identity protection services will be offered to those affected, specifically those vetted between December 2015 and July 2023. Investigation Findings The breach was detected on January 26, when CISA discovered hackers installing tools on an Ivanti device. Further investigation revealed multiple accesses to the system over two days. Various departments within CISA and the Department of Homeland Security (DHS) were involved in the investigation, which confirmed no hacker access beyond the initial Ivanti device. Despite the absence of evidence for data exfiltration, the potential risk to numerous individuals and organizations categorized this intrusion as a "major incident" under the Federal Information Security Modernization Act (FISMA). CISA is setting up a call center to assist impacted individuals, although it is not yet operational. The agency did not comment on the perpetrators of the attack, but since 2020, CISA has cautioned organizations about state-sponsored hackers, including those linked to China, exploiting vulnerabilities in Ivanti products. Experts Say More Transparency Required Roger Grimes, a data-driven defense evangelist at KnowBe4, lauded CISA's intent and the fact that it publicly accepted the hack but said a bit more transparency would have done no harm. "I'm a big fan of CISA. I think they do wonderful work. Still, it would be useful to have better, full transparency," Grimes told The Cyber Express. "Was their Ivanti device exploited by an unpatched, but known vulnerability, or exploited by a 0-day? If they were exploited by a known vulnerability where a patch was available, which is more likely, why wasn't the patch installed? Was it simply due to the fact that the exploit happened faster than the patch could be applied? Was the patch missed? If the patch was missed, why? Or was it a 0-day, misconfiguration, or credential compromise?" "This is not to embarrass CISA, but to learn why one of the best, most aggressive patch-pushing, cyber-defending organizations in the world got compromised," Grimes added. "Sharing what happened and why can help other organizations facing similar problems and challenges learn lessons. "CISA is always pushing for other industries and vendors to be more transparent about their compromises so that we can all learn from the lessons and mistakes. I expect CISA to do the same and even lead by example when it's their infrastructure involved."

CDK Global Cyberattack Ripple Effect: Several Car Dealers Report Disruptions

cyberexpress Jun 25, 2024 Ransomware News

Last week's ransomware attack on software as a service (SaaS) provider CDK Global has had a ripple effect on its customers, as multiple car dealerships serving thousands of locations report disruptions in their filings with the U.S. Securities and Exchange Commission. The CDK ransomware attack has paralyzed show more ...

thousands of car dealerships across North America, disrupting operations for some of the largest automotive retailers. The attack that began last Tuesday has impacted operations of major players such as Asbury Automotive Group, AutoNation, Group 1 Automotive, Lithia Motors, Penske, Sonic Automotive, and the number is expected to swell even more in coming days. Systems Shut Down After Attack CDK Global, a crucial provider of SaaS platforms for dealerships, was forced last week to shut down its systems in response to the cyberattack. With the work done so far, our core DMS and Digital Retailing solutions have been restored," a spokesperson for CDK Global told The Cyber Express at the time. "We are currently investigating a cyber incident. Erring on the side of caution, we proactively shut all systems down and executed extensive testing." This shutdown has hindered dealerships' abilities to manage customer relationships, sales, financing, service, inventory, and back-office operations. CDK Global's systems are vital to over 15,000 car dealerships in North America. It facilitates various operations, including car sales, repairs and registrations. There are only a handful of DMS companies for dealers to choose from. Thus, thousands of dealerships are hugely reliant on CDK’s services to line up financing and insurance, manage inventory of vehicles and parts, and complete sales and repairs. How CDK Global Cyberattack Impacts Customers Asbury, AutoNation, Lithia Motors, Sonic Automotive, and Group 1 Automotive have activated their incident response plans and disconnected from CDK systems as a precaution, although no evidence of compromise within their own networks was found. Sonic Automotive mentioned that as of Friday, the extent to which the attackers accessed customer data remains unknown. Lithia Motors highlighted the ongoing negative impact on its operations, indicating uncertainty over whether the incident will materially affect its financial condition. Group 1 Automotive noted that CDK aims to restore the dealer management system within "several days and not weeks," but the financial impact depends on the system's downtime duration. Group 1 owns and operates 202 automotive dealerships, 264 franchises, and 42 collision centers in the United States and the United Kingdom that offer 35 brands of automobiles. CDK Customers Move to Manual Methods Penske Automotive reported that the ransomware attack primarily affected its Premier Truck Group, which sells heavy- and medium-duty trucks across 48 locations in the U.S. and Canada. The company has implemented business continuity plans and continues operations using manual and alternate processes designed for such incidents. Penske noted that the truck dealership business that serves business customers has lower unit volumes compared to automotive dealerships. Asbury said business operations are functioning but "slower than normal." It added that the dealerships at Koons Automotive locations in Maryland and Virginia do not use CDK’s Dealer Management System or CDK’s Customer Relationship Management system and therefore continue to operate with minimal interruption, as does Clicklane, their online vehicle purchasing platform. Asbury operates 157 new vehicle dealerships, which includes 206 franchises representing 31 domestic and foreign vehicle brands. CDK May Pay Ransom Late on Friday, Bloomberg reported that CDK Global is negotiating with the a ransomware gang, which Bleeping later confirmed to be BlackSuit, a rebrand of the Royal ransomware group known for last year's attack on the city government of Dallas. Although the ransom amount remains undisclosed, CDK Global reportedly plans to pay, Bloomberg said. CDK Global has issued prerecorded messages to warn customers about hackers posing as CDK staff to gain unauthorized access. Despite making recovery progress last week, CDK faced a second cyber incident that led to a complete shutdown of its systems. The company is working with third-party experts to assess the impact and update its customers regularly. This attack exposes the critical vulnerabilities in the supply chain of the automotive industry and its reliance on centralized digital platforms.

BlackBasta Ransomware Gang Claims Cyberattack on Key Benefit Administrators, Scrubs & Beyond

cyberexpress Jun 25, 2024 Cybersecurity News

The notorious BlackBasta ransomware group is claiming credit for carrying out cyberattacks on major multinationals in the U.S. The ransomware gang claims it has access to sensitive data of financial services firm Key Benefit Administrators and healthcare apparel retailer Scrubs & Beyond. BlackBasta was recently show more ...

suspected to have exploited a Microsoft zero-day prior to Microsoft’s release of a patch for the vulnerability back in March. Decoding BlackBasta Ransomware's Alleged Attack The first organization targeted by BlackBasta is Key Benefit Administrators, Inc., which offers financial services. The company provides employment benefit services that manages pension, retirement, health, and welfare funds. BlackBasta claims to have access to 2.5TB of sensitive data of the firm, including client, executive, and employee info. [caption id="attachment_78852" align="alignnone" width="1247"] Source: Ransomware.live[/caption] The other organization targeted by the ransomware group is Scrubs & Beyond, which is the largest retailer of healthcare apparel and accessories in the U.S. The ransomware crew claims to have accessed 600GB of the organization’s sensitive data, including HR, employee, and departmental files. [caption id="attachment_78853" align="alignnone" width="1238"] Source: Ransomware.live[/caption] Until an official statement is released by the two firms, the facts behind the BlackBasta ransomware attack claim will likely remain elusive. If BlackBasta's claims are proven true, the implications could be significant. The compromise of sensitive legal information and client data could have broad consequences, not only for the firms concerned but also for its clients and partners. How Does BlackBasta Group Operate? BlackBasta is a highly active ransomware group that has quickly gained a reputation for targeting high-value organizations across various industries. BlackBasta typically uses sophisticated phishing campaigns, and exploits known vulnerabilities in software to obtain access to their targets' systems. After gaining access, the group encrypts critical data and demands hefty ransoms for its release. Previous Attacks By BlackBasta A recent joint security advisory from the U.S. Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC) stated that Black Basta has, through its affiliates, compromised more than 500 organizations all over the world. The victims include organizations that span 12 of 16 critical infrastructure sectors, including the Healthcare and Public Health (HPH) sector. A few of BlackBasta’s victims include Microsoft, Hyundai Europe, Capita, The American Dental Association, Yellow Pages Canada, and Dish, among others. How to Protect Against Ransomware The ever-present threat of ransomware requires vigilant cybersecurity practices by consumers and organizations alike. Keeping software and operating systems up-to-date: Many ransomware attacks exploit vulnerabilities in outdated software and operating systems. By keeping software and operating systems up-to-date, you can minimize the possibility of a ransomware attack. Backing up important data: If your files are encrypted by ransomware, you may be able to restore them from a backup. By regularly backing up important data, you can increase the chances that you can recover your files if they are encrypted by ransomware. However, those backups should be immutable and ransomware-resistant - a good backup service provider may be your surest bet. Using antivirus software: Antivirus software can detect and remove various types of malware, including ransomware. By using antivirus or endpoint security software, you can reduce the risk of a ransomware attack. Being cautious of suspicious emails: Many ransomware attacks are spread via phishing emails. You can lower the risk of a ransomware attack by being wary of suspicious emails and refraining from clicking on links or opening attachments from unknown sources. Educating employees about cybersecurity: Employees play a critical role in defending against cyberattacks. It is of utmost importance that they understand the best practices and know how to identify and report suspicious activities. Isolating critical workloads and data: Isolating your most important data and applications with technologies such as microsegmentation, VLANs, firewalls and strict access and permission controls will create an extra layer of security that will make it that much harder for ransomware to infect your most critical systems. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Apple Fixes ‘Bug’ in Vision Pro That Allowed Hackers To Fill Room with Bugs And Spiders

cyberexpress Jun 25, 2024 Firewall Daily

A recently discovered vulnerability (CVE-2024-27812) in the Apple Vision Pro headset allowed hackers to bypass device security mechanisms and flood user's environments with animated 3D objects – such as spiders and bugs – through a Safari exploit. These objects persisted even after exiting Safari, making for a show more ...

uniquely unsettling environment. Apple addressed the vulnerability this month after security researcher Ryan Pickren had disclosed the flaw in February, awarding the researcher a bounty. The bug highlights the challenges in securing 'spatial computing' devices. Spatial Hack in Apple Vision Pro Devices Apple designed the Vision Pro with strict privacy controls. This includes limiting device apps to a default 'Shared Space' and mandating explicit user consent for more engaging and immersive content. Websites must also obtain explicit user permission to generate 3D content within a user's physical environment. [caption id="attachment_78754" align="alignnone" width="720"] Source: ryanpickren.com[/caption] However, Pickren discovered that the AR Quick Look feature that had been introduced in 2018 for iOS remained active in the visionOS without the implementation of proper safeguards. This oversight allowed websites to manipulate HTML anchor tags to spawn unlimited 3D objects coupled with animations and spatial audio. By adding specific anchor tags to webpages, malicious websites can instruct Safari to render a 3D model, surprisingly without any form of user interaction. "If the victim just views our website in Vision Pro, we can instantly fill their room with hundreds of crawling spiders and screeching bats," Pickren explained. "Freaky stuff," he exclaimed. [caption id="attachment_78758" align="alignnone" width="1168"] Source: ryanpickren.com[/caption] [caption id="attachment_78756" align="alignnone" width="1186"] Source: ryanpickren.com[/caption] The researcher stated that the exploit code is straightforward and that closing Safari doesn't get rid of the 3D objects, as they are handled by a separate application. "To make things even freakier – since these animated files are being handled by a separate application (Quick Look), closing Safari does not get rid of them," Pickren noted. He added, "There is no obvious way to get rid of them besides manually running around the room to physically tap each one." Bug Reporting and Gaps in Vulnerability Assessment After trying to disclose the flaw to Apple, the researcher felt the tech giant had downplayed its relation to spatial computing and the generation of 3D objects, instead focusing on the potential for system crashes and reboots. The CVE description claimed that the issue had been addressed by improving the file handling protocol, which the researcher believed was unrelated to the bug. This highlights the challenges of triaging and classifying bugs in emerging fields such as Spatial Computing. The researcher believes the bug's impact goes beyond simple system crashes or reboots, raising questions about the security and privacy of the technology and the need for reevaluating existing threat models. "Perhaps it's time for Apple to re-evaluate their Vision Pro threat model," Pickren suggested. "This is a deeply personal product and classic vulnerability triaging guidelines may not capture the full impact anymore." Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Why the AI-powered search tool Recall in Windows 11 is dangerous, and how to disable it | Kaspersky official blog

kaspersky Jun 25, 2024 Tips

In May 2024, Microsoft introduced a new feature for Windows 11 called Recall, which remembers everything youve done on your computer over the last few months. Lets say you want to Recall something you did on your computer recently. You enter into the search bar something like photo of red car sent to me, or Korean show more ...

restaurant I was recommended — and receive answers in the form of links to apps, websites, or documents, paired with a thumbnail image of the screen captured the moment you were looking at the requested item! Recall remembers everything you did on your computer in the last few months. Perhaps even things youd rather forget. Source What Recall does is take a screenshot every few seconds, which it saves in a folder on your computer. Then it analyzes all the images using AI in the background, extracts all the information from them, and places it into a database to be used for an AI-powered smart search. Although all operations take place locally on the users machine, Recall sparked alarm among cybersecurity pros as soon as it was unveiled due to the many potential risks. The initial implementation of Recall was pretty much unencrypted, and available to any user of the computer. Under pressure from the infosec community, Microsoft announced improvements to the feature even before the public release, which was postponed from June 18 until around the end of the fall 2024. Yet, even with the promised tweaks, Recall remains controversial. The dangers of Recall All key data can be stolen in one fell swoop. The primary risk of Recall is that all sensitive data — from medical diagnoses and password-protected conversations to bank statements and private photos — ends up stored in one place on the computer. If a threat actor gains access to your computer or infects the machine with malware, all they need do is copy the contents of a single folder, and all your secrets are spilled. While tons of screenshots are a little trickier to steal due to their large size, the text part with recognized information could be snatched in a matter of seconds. Worse still, if an attacker manages to stealthily download the screenshots, theyd be able to reconstruct everything youve done on your computer over the last few months — almost second by second. Recall can save up to three months of history unless it runs out of space (by default — 10% of drive capacity, but no more than 150GB). While in the past infostealers would primarily target login credentials, crypto wallet data, and browser cookies, this list will soon be headed by Recall databases. Concerned infosec experts have wasted no time in creating a demo utility to show just how easy it is to extract data — even remotely. Questionable data encryption. In the initial version of Recall, screenshots and databases with recognized texts were stored in open form. This prompted cybersecurity experts to demonstrate how to bypass OS restrictions and gain access to Recall databases and screenshots of any user on the computer. To address this issue, Microsoft promises additional encryption of the databases themselves with on-the-fly decryption. However, no one has seen the implementation of this feature yet, and theres a good chance that decryption on a local computer will pose no difficulty. As with BitLocker full-disk encryption, this encryption can protect against evil-maid attacks, but it does nothing to help those who might leave their computer unlocked or put it to sleep, or who get infected with an infostealer. Poorly policed confidential data. Microsoft states that the Recall database will store passwords, financial data, and other sensitive data that gets displayed on-screen. Unless the user has paused Recall, only private windows (in Edge, Chrome, Opera or Firefox) and DRM-protected data (for example, Netflix movies) are excluded from the database. Backup recovery codes for online accounts? Disappearing chat messages? An email you thought it best to delete? All this will remain in the Recall database, and you wont be able to surgically remove individual data fragments — youd have to clear all information over a long period. Otherwise, anyone who sits down at your unlocked computer would be able to spy on your confidential data — the kind that banks, clinics, and online services hide behind passwords and two-factor authentication. To mitigate this issue, Microsoft has issued assurances that access to the Recall application on a local computer will require additional user authentication. Backup access recovery codes will also end up in the Recall database, wrecking the entire multi-factor authentication security model Risks at work and at home. Detailed, easily searchable information about computer activity dating back months could cause problems for those whove an overly demanding boss, nosey housemate, or jealous other half. The temptation will be there to use Recall to track work performance, marital fidelity, and much more. Default mode. Initially, Recall was supposed to be enabled by default, but under public pressure Microsoft said this would not be the case. Now, when installing Windows yourself youre prompted to enable Recall, which is now disabled by default. However, those whose computer came with Windows 11 already configured (for example, at work) would have to check the presence and operating mode of Recall themselves. Where to look for Recall Currently, Microsoft claims that Recall will only be available on Copilot+ computers equipped with both a special Neural Processing Unit (NPU) and Windows 11. In practice, experts have successfully run Recall on other computers. Machines with ARM processors are best suited for this, but the feature can also be activated (albeit with some difficulties) on computers with x86 architecture — and even on virtual machines in Azure. Whats clear is that Recall requires no unique hardware to work, which means that in due course the feature will become available for all Windows computers with enough power. Given Microsofts practice in recent years of offering features by automatically activating them on users computers, you might get an unwanted AI assistant without even realizing it. How to check for Recall Recall cant be installed on Windows 10 machines or earlier. On Windows 11, you can check for the feature by typing Recall in the Start menu search bar. If an application with this name appears in the search results, its installed and needs to be configured or disabled. How to mitigate the risks posed by Recall Some categories of users are advised to disable Recall entirely. This includes those who: often store sensitive information on their computer are legally obligated to strictly protect work data share a computer with others experience aggressive monitoring at work or home have no need for AI searches Fortunately, this isnt hard to do. Open Settings, go to Privacy & Security -> Recall & snapshots, and disable Save snapshots. Then click Delete All to wipe previously taken snapshots. Fortunately, Recall is easy to disable or customize. Source If you dont want to disable Recall completely, you need to at least configure it properly. The first step is to specify lists of applications and websites for which this function shouldnt work. We recommend adding the following to Recalls exceptions: all sites where you view important personal information: banks, government services, insurance and medical organizations password manager sites and applications sites and applications with confidential work information sites and applications related to cryptocurrencies, if you use any messenger apps used for confidential conversations — no matter how infrequently If you decide to leave Recall enabled, be sure to configure the exclusion list. Source Make sure your computer has full protection against cyberthreats, because a specialized infostealer that infects a Recall-enabled computer would be able to steal the whole history of your activity going back months prior to the infection. We can also anticipate the emergence of viruses that discreetly enable Recall for users and use it for smart recognition of all texts on your screen. After all, attackers managed to harness the Windows native encryption tool, BitLocker, using it for full-disk encryption of all information on the computer, followed by a ransom demand for decryption. We recommend Kaspersky Premium for maximum protection against malware. In addition: Enable BitLocker full-disk encryption Protect your account with a strong password and biometric access Configure the screen lock and use it when you step away from your computer Create separate accounts for other users of the same computer, if any, or use a guest account Subscribe to our blog and/or Telegram channel to be the first to know about new threats

China-Linked Cyber-Espionage Teams Target Asian Telecoms

darkreading Jun 25, 2024 Feed

In the latest breaches, threat groups compromised telecommunications firms in at least two Asian nations, installing backdoors and possibly eavesdropping or pre-positioning for a future attack.

Threat Actor May Have Accessed Sensitive Info on CISA Chemical App

darkreading Jun 25, 2024 Feed

An unknown adversary compromised a CISA app containing the data via a vulnerability in the Ivanti Connect Secure appliance this January.

Key Takeaways From the British Library Cyberattack

darkreading Jun 25, 2024 Feed

Knowledge institutions with legacy infrastructure, limited resources, and digitized intellectual property must protect themselves from sophisticated and destructive cyberattacks.

Fresh MOVEit Bug Under Attack Mere Hours After Disclosure

darkreading Jun 25, 2024 Feed

The high-severity CVE-2024-5806 allows cyberattackers to authenticate to the file-transfer platform as any valid user, with accompanying privileges.

Indonesia Refuses to Pay $8M Ransom After Cyberattack

darkreading Jun 25, 2024 Feed

More than 200 regional and national government agencies have been impacted by the ransomware attack, and few of them are once again operational.

WordPress Supply Chain Attack Spreads Across Multiple Plug-Ins

darkreading Jun 25, 2024 Feed

Injected malicious JavaScript code gives attackers administrator rights on websites, and fills sites with SEO spam.

'P2PInfect' Worm Grows Teeth With Miner, Ransomware & Rootkit

darkreading Jun 25, 2024 Feed

For a while, the botnet spread but did essentially nothing. All the malicious payloads came well after.

Android RAT SpyMax Targets Telegram Users

cyware Jun 25, 2024 Malware and Vulnerabilities

SpyMax does not require the targeted device to be rooted, making it easier for threat actors to cause damage. Once installed, SpyMax gathers personal information from the infected device without user consent and sends it to a remote threat actor.

P2PInfect Botnet Targets Redis Servers with New Ransomware Module

cyware Jun 25, 2024 Malware and Vulnerabilities

P2PInfect, a previously dormant peer-to-peer malware botnet, has recently become active and is now targeting Redis servers. The botnet has introduced new features like cron-based persistence mechanisms and SSH lockout.

SnailLoad Attack can Exploit Remote Network Latency Measurements to Infer User Activity

cyware Jun 25, 2024 Malware and Vulnerabilities

Unlike previous methods, SnailLoad doesn't require a person-in-the-middle attack or hacking the target's Wi-Fi. Instead, it lets a remote attacker infer websites and content viewed by a user without accessing their network traffic directly.

Hackers Create Rogue Admin Accounts via Backdoored WordPress Plugins

cyware Jun 25, 2024 Malware and Vulnerabilities

Multiple WordPress plugins have been found to contain a backdoor that injects malicious code. This code allows attackers to create unauthorized administrator accounts, enabling them to perform malicious actions.

Boolka Group's Modular Trojan BMANAGER Exposed

cyware Jun 25, 2024 Malware and Vulnerabilities

The Boolka group is responsible for deploying advanced malware and conducting web attacks. They have been exploiting vulnerabilities using SQL injection attacks since 2022, targeting websites in various countries.

New Attack Uses MSC Files and Windows XSS Flaw to Breach Networks

cyware Jun 25, 2024 Malware and Vulnerabilities

A new command execution technique called "GrimResource" has been discovered that leverages a combination of specially crafted Microsoft Saved Console (MSC) files and an unpatched Windows XSS flaw.

Manufacturing Cybersecurity at Heart of New White House Guidance

cyware Jun 25, 2024 Security Tips and Advice

The U.S. Department of Energy has released a new framework of best practices for securing clean energy cyber supply chains, focusing on key technologies used in managing electricity, oil, and natural gas systems.

Is the Cybersecurity Industry Ready for AI?

cyware Jun 25, 2024 Expert Blogs and Opinion

AI is not new to cybersecurity, but generative AI is causing concern as it impacts organizations. A study found that AI-generated threats have already affected 75% of organizations, yet 60% are not prepared to handle AI-based attacks.

European Union Sanctions Russian State Hackers

cyware Jun 25, 2024 Incident Response, Learnings

The European Union has imposed sanctions on four Russian hackers from the country's domestic intelligence agency, including two military officers. These individuals were involved in "hack and leak" operations against Western governments.

StealC and Vidar Malware Campaign Identified

cyware Jun 25, 2024 Malware and Vulnerabilities

During an analysis of a malware sample containing StealC and Vidar, it was discovered that attackers were using Steam to hide their C2 location and disguise malicious activity as regular traffic.

Google Introduces Project Naptime for AI-Powered Vulnerability Research

cyware Jun 25, 2024 Innovation and Research

Google has developed a framework known as Project Naptime, which utilizes a large language model (LLM) for vulnerability research. The framework allows an AI agent to simulate the actions and workflow of a human security researcher.

Report: Cloud Breaches Impact Nearly Half of Organizations

cyware Jun 25, 2024 Trends, Reports, Analysis

According to the Thales 2024 Cloud Security Study, 44% of organizations have experienced a cloud data breach, with 14% reporting incidents in the past year. Human error and misconfigurations were the top root causes, affecting 31% of cases.

FBI Warns of Fake Law Firms Targeting Crypto Scam Victims

cyware Jun 25, 2024 Identity Theft, Fraud, Scams

The FBI has issued a warning about cybercriminals pretending to be law firms and lawyers offering cryptocurrency recovery services. These scammers target victims of investment scams, stealing funds and personal information.

Four FIN9-linked Vietnamese Hackers Indicted in $71M U.S. Cybercrime Spree

cyware Jun 25, 2024 Incident Response, Learnings

Ta Van Tai, Nguyen Viet Quoc, Nguyen Trang Xuyen, and Nguyen Van Truong are accused of conducting phishing campaigns and supply chain compromises to orchestrate cyberattacks and steal millions of dollars.

Deadline Looms For Alleged LockBit Extortion Over Feds Of 33TB Of Data

packetstormsecurity Jun 25, 2024 headline,hacker,government,malware,bank,

Google Framework Helps LLMs Perform Basic Vuln Research

packetstormsecurity Jun 25, 2024 headline,botnet,google

Meta's VR Headset Vulnerable To Ransomware Attacks

packetstormsecurity Jun 25, 2024 headline,malware,facebook

Neiman Marcus Data Breach Exposed As Hacker Offers To Sell Stolen Info

packetstormsecurity Jun 25, 2024 headline,hacker,privacy,data loss,fraud

Julian Assange Pleads Guilty, Goes Home

packetstormsecurity Jun 25, 2024 headline,hacker,government,usa,britain,a

Faronics WINSelect Hardcoded Credentials / Bad Permissions / Unhashed Password

packetstormsecurity Jun 25, 2024 Feed

Faronics WINSelect versions prior to 8.30.xx.903 suffer from having hardcoded credentials, storing unhashed passwords, and configuration file modification vulnerabilities.

Debian Security Advisory 5715-2

packetstormsecurity Jun 25, 2024 Feed

Debian Linux Security Advisory 5715-2 - The update for composer released as DSA 5715 introduced a regression in the handling of git feature branches. Updated composer packages are now available to address this issue.

Ubuntu Security Notice USN-6844-1

packetstormsecurity Jun 25, 2024 Feed

Ubuntu Security Notice 6844-1 - Rory McNamara discovered that when starting the cupsd server with a Listen configuration item, the cupsd process fails to validate if bind call passed. An attacker could possibly trick cupsd to perform an arbitrary chmod of the provided argument, providing world-writable access to the target.

Ubuntu Security Notice USN-6846-1

packetstormsecurity Jun 25, 2024 Feed

Ubuntu Security Notice 6846-1 - It was discovered that Ansible incorrectly handled certain inputs when using tower_callback parameter. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information. This issue show more ...

only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. It was discovered that Ansible incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform a Template Injection.

Ubuntu Security Notice USN-6845-1

packetstormsecurity Jun 25, 2024 Feed

Ubuntu Security Notice 6845-1 - It was discovered that Hibernate incorrectly handled certain inputs with unsanitized literals. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information.

Wikileaks' Julian Assange Released from U.K. Prison, Heads to Australia

thehackernews Jun 25, 2024 Feed

WikiLeaks founder Julian Assange has been freed in the U.K. and has departed the country after serving more than five years in a maximum security prison at Belmarsh for what was described by the U.S. government as the "largest compromises of classified information in the history" of the country. Capping off a 14-year legal saga, Assange, 52, pleaded guilty to one criminal count of conspiring to

4 FIN9-linked Vietnamese Hackers Indicted in $71M U.S. Cybercrime Spree

thehackernews Jun 25, 2024 Feed

Four Vietnamese nationals with ties to the FIN9 cybercrime group have been indicted in the U.S. for their involvement in a series of computer intrusions that caused over $71 million in losses to companies. The defendants, Ta Van Tai (aka Quynh Hoa and Bich Thuy), Nguyen Viet Quoc (aka Tien Nguyen), Nguyen Trang Xuyen, and Nguyen Van Truong (aka Chung Nguyen), have been accused of conducting

Multiple WordPress Plugins Compromised: Hackers Create Rogue Admin Accounts

thehackernews Jun 25, 2024 Feed

Multiple WordPress plugins have been backdoored to inject malicious code that makes it possible to create rogue administrator accounts with the aim of performing arbitrary actions. "The injected malware attempts to create a new administrative user account and then sends those details back to the attacker-controlled server," Wordfence security researcher Chloe Chamberland said in a Monday alert.

New Attack Technique Exploits Microsoft Management Console Files

thehackernews Jun 25, 2024 Feed

Threat actors are exploiting a novel attack technique in the wild that leverages specially crafted management saved console (MSC) files to gain full code execution using Microsoft Management Console (MMC) and evade security defenses. Elastic Security Labs has codenamed the approach GrimResource after identifying an artifact ("sccm-updater.msc") that was uploaded to the VirusTotal malware

How to Cut Costs with a Browser Security Platform

thehackernews Jun 25, 2024 Feed

Browser security is becoming increasingly popular, as organizations understand the need to protect at the point of risk - the browser. Network and endpoint solutions are limited in their ability to protect from web-borne threats like phishing websites or malicious browser extensions. They also do not protect from internal data exfiltration, like employees pasting sensitive data to ChatGPT. As it

New Cyberthreat 'Boolka' Deploying BMANAGER Trojan via SQLi Attacks

thehackernews Jun 25, 2024 Feed

A previously undocumented threat actor dubbed Boolka has been observed compromising websites with malicious scripts to deliver a modular trojan codenamed BMANAGER. "The threat actor behind this campaign has been carrying out opportunistic SQL injection attacks against websites in various countries since at least 2022," Group-IB researchers Rustam Mirkasymov and Martijn van den Berk said in a

The AI Fix #4: Fantastic voyage, and the technological singularity

grahamcluley Jun 25, 2024 Podcast

In episode four of The AI Fix podcast, Graham and Mark learn there’s a 99.9% chance that AI will wipe out humans within 100 years, examine the even more chilling prospect of Barney the dinosaur reading Adolf Hitler’s Mein Kampf to six-year-olds, and resurrect a tried-and-trusted software evaluation method show more ...

to decide if Claude 3.5 Sonnet … Continue reading "The AI Fix #4: Fantastic voyage, and the technological singularity"

Buying a VPN? Here’s what to know and look for

welivesecurity Jun 25, 2024 Feed

VPNs are not all created equal – make sure to choose the right provider that will help keep your data safe from prying eyes

Threat Detection Report 2024

ciso2ciso Jun 25, 2024 0 - CT - SOC - CSIRT Operations - Threat

The content you are trying to access is private only to member users of the site. You must have a free membership at CISO2CISO.COM to access this content. You can register for free. Thank you. The CISO2CISO Advisors Team. La entrada Threat Detection Report 2024 se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Recommended Skills for a Cyber Security Career

ciso2ciso Jun 25, 2024 0 - CT - CISO Strategics - Information S

Year after year, the cyber talent gap is increasing — currently estimated to have 3,5 million open positions worldwide — presenting all sorts of headaches for leaders and the organizations they aim to protect. Moreover, organizations have a short window to identify, foster and hopefully retain a pipeline of show more ...

emerging cybersecurity leaders to ensure the […] La entrada Recommended Skills for a Cyber Security Career se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Ransomware Cartography (2014-2024)

ciso2ciso Jun 25, 2024 0 - CT - SOC - CSIRT Operations - Malwar

Ransomware is a type of malicious software designed to block access to a computer system or data until a ransom is paid. Over the past decade, ransomware attacks have evolved in sophistication, scale, and impact, affecting individuals, businesses, and government entities globally. Key Developments: Technological and show more ...

Tactical Evolutions: Impact and Consequences: Future Outlook: Views: 0 La entrada Ransomware Cartography (2014-2024) se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Pwning the Domain Persistence

ciso2ciso Jun 25, 2024 0 - CT - SOC - CSIRT Operations - Cyber

The content you are trying to access is private only to member users of the site. You must have a free membership at CISO2CISO.COM to access this content. You can register for free. Thank you. The CISO2CISO Advisors Team. La entrada Pwning the Domain Persistence se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Purple Concepts Bridging the Gap

ciso2ciso Jun 25, 2024 0 - CT - SOC - CSIRT Operations - Red -

Whether your focus area is Red Team, Blue Team, Cyber Threat Intelligence, Detection and Response, or any other facet of security, organizations need trained professionals who can work efficiently together as a Purple Team. A Purple Team is a collaboration of various information security skill sets. A Purple Team is show more ...

a process where teams work […] La entrada Purple Concepts Bridging the Gap se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

PROTECTIVE SECURITYPOLICY FRAMEWORKSecuring government business:Protective security guidance for executive

ciso2ciso Jun 25, 2024 0 - CT - CISO Strategics - Cybersecurity

The content you are trying to access is private only to member users of the site. You must have a free membership at CISO2CISO.COM to access this content. You can register for free. Thank you. The CISO2CISO Advisors Team. La entrada PROTECTIVE SECURITYPOLICY FRAMEWORKSecuring government show more ...

business:Protective security guidance for executive se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Política Nacional de Ciberseguridad 2023-2028

ciso2ciso Jun 25, 2024 0 - CT - CISO Strategics - Cybersecurity

The content you are trying to access is private only to member users of the site. You must have a free membership at CISO2CISO.COM to access this content. You can register for free. Thank you. The CISO2CISO Advisors Team. La entrada Política Nacional de Ciberseguridad 2023-2028 se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Phishing Attack Pentesting Guide

ciso2ciso Jun 25, 2024 0 - CT - CISO Strategics - Social Engine

Phishing is probably one of the biggest issues for most organizations today, with network and endpoint defensive technology getting better and better, the bad guys aren’t trying to go after the though route and instead of going for the low hanging fruit. Phishing is one of those issues where training the employees show more ...

is your best […] La entrada Phishing Attack Pentesting Guide se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Cyber security aggregator - feeds history