Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Beyond Swords and Sp ...

 Firewall Daily

Most video games today are typically RPGs, or role-playing games, where players immerse themselves in shooting or story-driven adventures. However, there's a fascinating niche of games that center around hacking and cybersecurity. In this article, we'll explore games that delve into the world of hacking,   show more ...  

offering a unique twist on the traditional RPG experience. These video games simulate hacking and coding, allowing players to step into the shoes of a hacker. Players will engage in a variety of hacking activities, from infiltrating secure networks to writing complex scripts, all while navigating different scenarios and motives. Whether it's for personal gain, justice, or survival, these games provide a captivating glimpse into the hacker's world. If you're intrigued by the intersection of gaming and cybersecurity, read on to discover some of the top titles in this genre. Top Video Games with Hacking & Cybersecurity Elements 7. Hackmud The theme of the video game: Hackmud is set in a fictional digital universe where players assume the role of hackers known as "scripts." The game is a text-based interface that is navigated by players to manipulate systems, uncover secrets, and engage in virtual espionage. The game's narrative revolves around uncovering the truth behind various in-game factions and mysteries.  The cybersecurity and hacking themes: Hackmud focuses on social engineering, cryptography, and system exploitation. It challenges players to think creatively in order to bypass security measures and infiltrate networks. The game mirrors real-world cybersecurity processes through the complexity of digital systems and their vulnerabilities. 6. NiteTeam 4 The theme of the video game: NiteTeam 4 is a game where players get to be elite cybersecurity operatives tasked with defending against global cyber threats. The game's narrative unfolds through missions involving espionage, data theft, and digital warfare in a politically charged environment. The cybersecurity and hacking themes: It provides a realistic simulation of cybersecurity operations, focusing on offensive and defensive tactics. Players learn to use tools like penetration testing, network analysis, and cryptography to investigate and mitigate cyber threats. The complexities of modern cyber warfare and the ethical dilemmas faced by cybersecurity professionals are portrayed in the game. 5. Cyberpunk 2077 The theme of the video game: Cyberpunk 2077 isn’t necessarily a hacking game like every other one on this list, but it does have a hacking minigame in the midst of it. The game is set in a dystopian future where V, a mercenary navigates through a society dominated by corporations and social inequality, unchecked advanced technology, and cybernetic enhancements. The cybersecurity and hacking themes: The game explores the implications of corporate control over data, surveillance, and privacy. Hacking occurs when players of the game have to work to manipulate systems, steal information, and influence events. Cyberpunk 2077 reflects real-world concerns about digital security, surveillance capitalism, and the ethical boundaries of hacking as a tool for both the resistance and the exploiters. 4. Greyhack The theme of the game: Greyhack is a multiplayer hacking simulator where players engage in competitive and cooperative hacking activities. The game's world features simulated networks, servers, and security systems that players can manipulate and exploit for personal gain or strategic advantage.  The cybersecurity and hacking themes: Greyhack portrays realistic hacking scenarios, including network penetration, data exfiltration, and cyber warfare tactics. Skills surrounding information gathering, social engineering, and vulnerability exploitation are developed as the game serves as a virtual training ground for understanding cybersecurity threats and defenses in a controlled environment. 3. Hacknet The theme of the video game: In Hacknet, players step into the shoes of a recently deceased hacker whose digital ghost continues to operate in the underground world of cybercrime. The narrative unfolds through missions that involve hacking into systems, uncovering conspiracies, and dealing with the consequences of digital infiltration.  The cybersecurity and hacking themes: The game educates players on real-world hacking techniques such as network scanning, password cracking, and system manipulation. It explores ethical dilemmas surrounding hacking activities and the legal repercussions of cybercrime. Hacknet aims to explore the importance of cybersecurity awareness and the impacts of digital vulnerabilities. 2. Midnight Protocol The theme of the game: Midnight Protocol is set in a cyberpunk future where players control an AI agent tasked with infiltrating networks to gather intelligence and manipulate information. The narrative explores themes of artificial intelligence, digital espionage, and the consequences of technological dependency.  The cybersecurity and hacking themes: The game poses players with complex hacking puzzles and strategic decision-making. Midnight Protocol emphasizes social engineering, data manipulation, and network infiltration techniques. The game illustrates the evolving landscape of cybersecurity threats and AI, along with how it protects and exploits digital assets. 1. UpLink The theme of the game: In UpLink players are freelance hackers hired by a secretive corporation to perform cyber espionage and sabotage missions. The game's narrative unfolds through missions that involve hacking into secure networks, stealing data, and covering tracks to avoid detection.  The cybersecurity and hacking themes: This game has multiple hacking activities like network penetration, virus deployment, and digital espionage. UpLink challenges players to balance risk, reward, and the ethical implications of hacking and being a cybercriminal in a hyper-connected world.  We hope at least one of these aligns with an area you would like to explore, and with an area of hacking you would like to practice. These games explore the different ethics surrounding hacking and how it can be helpful or harmful.

image for Transparent Tribe’ ...

 Firewall Daily

A Pakistan-linked hacking group has unleashed an updated version of its Android spyware, expanding its reach to target mobile gamers, weapons enthusiasts and TikTok users, according to cybersecurity researchers. The researchers identified four new malicious Android apps associated with Transparent Tribe, a group   show more ...  

suspected of ties to Pakistani state interests. The apps continue the hackers' strategy of embedding spyware into seemingly innocuous video browsing applications. Evolving Tactics of Transparent Tribe Transparent Tribe, also known as APT 36, has targeted Indian government and military personnel since at least 2016. The group is known to rely heavily on social engineering to deliver Windows and Android spyware through phishing emails and compromised websites. Researchers from SentinelLabs identified the newly discovered apps masquerading as YouTube or TikTok video players, an app for lewd videos, a mobile gaming portal, and a weapons enthusiast app. When installed, they request extensive permissions to access the device's location, contacts, SMS messages, call logs, camera and microphone. [caption id="attachment_80043" align="alignnone" width="559"] Source: sentinelone.com[/caption] [caption id="attachment_80044" align="alignnone" width="974"] Source: sentinelone.com[/caption] While the permissions requested are similar to those in the previous campaign, the reduction in permissions suggests the app developers are focused on making CapraRAT a surveillance tool more than a fully featured backdoor. Researchers noted that the new CapraRAT APK files contained references to Android’s Oreo version (Android 8.0), released in 2017. Previous versions relied on the device running Lollipop (Android 5.1), which was released in 2015 and less likely to be compatible with modern Android devices. The new CapraRAT packages also contain a minimal new class called WebView, responsible for maintaining compatibility with older versions of Android via the Android Support Library. This update allows the app to run smoothly on modern versions of Android, such as Android 13 and 14. All four newly discovered apps communicate with the same command-and-control server, using either the domain shareboxs[.]net or a hardcoded IP address. This infrastructure has been linked to Transparent Tribe operations since at least 2022. Researcher Recommendations Cybersecurity experts recommend users exercise caution when installing apps, especially those from unofficial sources. Users should critically evaluate requested permissions and be wary of apps that ask for access unrelated to their stated purpose. Organizations dealing with sensitive information should implement mobile device management solutions and educate employees about the risks of installing unauthorized apps. For example, an app that only displays TikTok videos does not need the ability to send SMS messages, make calls, or record the screen. The researchers have advised professionals to treat the use of port 18582 as suspect, along with other indicators of compromise in their report, such as SHA1 checksums for files used in the campaign along with domain/IP network indicators.

image for Windows Recall Remai ...

 Cybersecurity News

Microsoft’s planned Windows Recall feature remains vulnerable to cyberattacks in its latest version, according to a security researcher – even as Google is prepping similar technology for its upcoming Pixel 9 devices. Windows Recall was delayed over concerns that it would create privacy and security   show more ...  

vulnerabilities by recording users’ screen activity and saving it in an easily hackable database. Those issues apparently still remain a few weeks later in preview versions of Recall. Windows Recall Still Insecure: Researcher Kevin Beaumont, the security researcher who started the Recall backlash, posted on Mastodon this week that the latest preview version remains vulnerable to the “TotalRecall” exploit developed by researcher Alex Hagenah. Beaumont wrote that he “got ahold of what I think is the latest Microsoft Recall (Copilot+ Recall? Nobody knows the branding) build and.. well.. Total Recall still works with the smallest of tweaks to export the database, it's still accessible as a plaintext database with marketing as the security layer." Beaumont also said that the Recall bug bounty set by Microsoft appears to be only $1,000 for discovering and reporting a high-severity or critical vulnerability, a number he said is too low given the value of the data. “That probably needs clarifying as nobody is going to sell photographic memory access to Windows devices to MS for that value - it's way more valuable elsewhere,” he said. He also noted that “the Recall backlog must be very large as it's just becoming a truck load of features being dumped on.” Recall may be starting to show up in previews of upcoming releases, according to some reports, including in the Windows 11 24H2 preview on x64_x86 hardware that will be officially released in the fall (screenshot from X below). [caption id="attachment_80158" align="aligncenter" width="500"] Windows Recall preview (source: X)[/caption] The Cyber Express has reached out to Microsoft for comment and will update this article with any response. Google Preps ‘Pixel Screenshots’ Google is reportedly prepping a feature similar to Recall for its upcoming Pixel 9 devices. However, Google’s implementation may be more privacy-friendly and less likely to cause an uproar. According to Android Authority, Pixel Screenshots “will only work on screenshots you take yourself. When you do that, the app will add a bit of extra metadata to it, like app names, web links, etc. After that, it will be processed by a local AI, presumably the new multimodal version of Gemini Nano, which will let you search for specific screenshots just by their contents, as well as ask a bot questions about them.” [caption id="attachment_80153" align="alignleft" width="350"] Google's "Pixel Screenshots" (source: Android Authority)[/caption] [caption id="attachment_80155" align="alignright" width="350"] Pixel Screenshots privacy details[/caption]

image for The Tactics of ‘Su ...

 Firewall Daily

A recent cybersecurity investigation has uncovered a sophisticated operation known as "Supposed Grasshopper," targeting both Israeli government entities and private companies through the deployment of open-source malware. The Supposed Grasshopper campaign, characterized by its strategic use of infrastructure   show more ...  

and toolsets, demonstrates a blend of publicly available tools and customized developments to achieve its objectives. Central to the Supposed Grasshopper operation is a domain identified as a command and control (C2) server, purportedly associated with an Israeli government entity. Analysts have observed a pattern of attacks extending to various private sector organizations throughout late 2023. These attacks, while diverse and spanning unrelated industries, consistently utilize well-known open-source malware as part of their infection chain. Decoding the Supposed Grasshopper Campaign [caption id="attachment_80091" align="alignnone" width="1040"] Infection Chain (Source: HarfangLab)[/caption] According to HarfangLab, the initial phase of the campaign involves the distribution of malicious payloads via specially crafted WordPress websites. These sites host seemingly innocuous files, such as Virtual Hard Disk (VHD) images, which, when accessed, trigger the installation of a first-stage Nim downloader. This downloader, designed by the threat actors, facilitates the retrieval and execution of subsequent malware components from remote servers under their control. The final payload of the attack campaign comprises a hybrid of two prominent open-source projects: Donut, a framework for generating position-independent shellcode, and Sliver, a Golang-based trojan designed as a cost-effective alternative to more traditional malware like CobaltStrike. These tools empower the attackers with full control over compromised systems, allowing them to execute a wide range of malicious activities remotely. Further investigation into the campaign's infrastructure reveals a network of domains registered under various aliases, including impersonations of legitimate entities such as SintecMedia and Carlsberg. These domains serve as staging points and C2 servers for the malware, indicating a deliberate effort by the attackers to blend in with recognizable brands while conducting their operations. Legitimacy and Geopolitical Concerns in Cybersecurity Despite the campaign's sophistication, questions remain about its true intent. Analysts speculate that the activities could potentially be attributed to legitimate penetration testing exercises due to their focused and methodical approach. However, the absence of identifiable links to known testing companies raises concerns about the campaign's legitimacy and its potential geopolitical implications. The discovery highlights broader challenges in cybersecurity, particularly the ease with which threat actors can leverage freely available tools and realistic tactics like WordPress websites for both legitimate and malicious purposes. This highlights the ongoing need for increased transparency and accountability in penetration testing engagements, especially when government entities and critical infrastructure are involved. Looking ahead, cybersecurity experts anticipate similar campaigns will continue to exploit accessible attack frameworks, complicating efforts to attribute and mitigate such threats effectively. This trend further highlights the nature of cyber warfare and highlights the critical role of proactive defense measures in safeguarding against increasingly sophisticated attacks.

image for SEC Cracks Down on C ...

 Compliance

The Securities and Exchange Commission (SEC) has charged Silvergate Capital Corporation, along with its former executives Alan Lane, Kathleen Fraher, and Antonio Martino, with misleading investors regarding the strength of its compliance programs and financial stability. From November 2022 to January 2023, Silvergate,   show more ...  

along with its then-CEO Alan Lane and former Chief Risk Officer Kathleen Fraher, falsely assured investors of the robustness of its Bank Secrecy Act/Anti-Money Laundering (BSA/AML) compliance program. Silvergate Misleading Investors About Compliance Programs This was an attempt to allay concerns following the collapse of one of its largest clients, FTX. The reality, as the SEC alleges, was far bleaker. Silvergate’s automated transaction monitoring system failed to oversee more than $1 trillion worth of transactions on its payments platform, the Silvergate Exchange Network. This failure allegedly allowed nearly $9 billion in suspicious transfers among FTX and related entities to go undetected. “At all times, but especially during moments of crises, public companies and their officers must speak truthfully to the investing public. Here, we allege that Silvergate, Lane, and Fraher fell not only woefully, but also fraudulently, short in that regard,” stated Gurbir S. Grewal, Director of the SEC’s Division of Enforcement. Adding further, Grewal said, “Rather than coming clean to investors about serious deficiencies in its compliance programs in the wake of the collapse of FTX, one of Silvergate’s largest banking customers, they doubled down in a way that misled investors about the soundness of the programs. In fact, because of those deficiencies, Silvergate allegedly failed to detect nearly $9 billion in suspicious transfers among FTX and its related entities. Silvergate’s stock eventually cratered, wiping out billions in market value for investors.” The repercussions of this deception were severe. Silvergate’s stock plummeted, erasing billions in market value and leaving investors in the lurch. SEC’s Legal Action and Settlements Adding to the gravity of the situation, Silvergate and its former CFO Antonio Martino were accused of misrepresenting the company’s financial condition during the liquidity crisis and bank run that followed FTX’s collapse. They reportedly understated losses from expected securities sales and falsely claimed that Silvergate remained well-capitalized as of December 31, 2022. By March 2023, Silvergate announced it would wind down its banking operations, leading to a further nosedive in its stock value, which plummeted to near zero. The SEC’s complaint, filed in the U.S. District Court for the Southern District of New York, charges Silvergate, Lane, and Fraher with negligence-based fraud and violations of reporting, internal accounting controls, and books-and-records provisions. In a bid to settle the charges, Silvergate has agreed to a $50 million civil penalty and a permanent injunction. Lane and Fraher have also agreed to settlements, including permanent injunctions, five-year officer-and-director bars, and civil penalties of $1 million and $250,000, respectively. These settlements, however, are still subject to court approval, and Silvergate's payment might be offset by penalties from other regulatory bodies. Martino faces charges for violating certain antifraud and books-and-records provisions and for aiding and abetting some of Silvergate’s violations. The SEC’s litigation against Martino is ongoing, reflecting the seriousness of the allegations and the need for thorough judicial scrutiny. The broader implications of this case are significant. It highlights a troubling trend where financial institutions involved with high-risk clients, such as those in the cryptocurrency sector, may prioritize short-term gains over regulatory compliance and transparency. The SEC’s stringent actions serve as a reminder that such behavior will not go unchecked. In parallel actions, the Board of Governors of the Federal Reserve System (FRB) and the California Department of Financial Protection and Innovation (DFPI) have also announced settled charges against Silvergate. The SEC’s investigation was thorough and collaborative, involving numerous staff members and assistance from the FRB and DFPI. To Wrap Up This case exemplifies the critical role of regulatory bodies in safeguarding investor interests and maintaining the integrity of financial markets. The Silvergate saga should serve as a wake-up call for all financial institutions. In an era where the boundaries of traditional banking are increasingly blurred by emerging technologies and high-risk sectors like cryptocurrency, the importance of enhanced compliance programs and transparency cannot be overstated. Investors and regulators alike must remain vigilant to ensure that the pursuit of innovation does not come at the expense of ethical standards and financial stability.

image for HealthEquity Blames ...

 Cybersecurity News

HealthEquity Inc., the largest health savings account administrators in the U.S., has encountered a cybersecurity setback, as detailed in its recent U.S. Securities and Exchange Commission (SEC) filing. In its report to the SEC, the company said that even though Personally Identifiable Information (PII) was   show more ...  

compromised, the breach did not affect the company's operations or finances. Details of HealthEquity SEC Filing According to the health management firm, an unnamed business partner’s account was compromised by bad actors to access and exfiltrate PII and protected health information. “Earlier this year, HealthEquity, Inc. became aware, through routine monitoring, of anomalous behavior by a personal use device belonging to a business partner. The Company promptly took steps to isolate and triage the issue and began an investigation into the nature and scope of the issue,” the company said in a Form 8-K report filed on July 2, 2024. [caption id="attachment_80168" align="alignnone" width="1895"] Source: SEC.gov[/caption] “The investigation concluded that the Partner’s user account had been compromised by an unauthorized third party, who used that account to access information. The accessed information included some personally identifiable information, which in some cases is considered protected health information, pertaining to certain of our members. The investigation further concluded that some information was subsequently transferred off the Partner’s systems,” the report said. Though the SEC filing did not disclose further details like the month of the cyberattack or provide a description of the threat actor, HealthEquity may be referring to a cybersecurity incident involving the company that occurred on May 14. In a media release shared by the Kentucky Personnel Cabinet on June 21, Governor Andy Beshear said, “On May 14, the Kentucky Personnel Cabinet was informed of unauthorized updates to members’ HealthEquity accounts. HealthEquity is a third-party vendor that administers Flexible Spending Accounts (FSA) and Health Reimbursement Arrangements (HRA) on behalf of the Kentucky Employees’ Health Plan (KEHP). “After investigating this incident, HealthEquity determined that this potential fraud event impacted 449 KEHP member accounts. It is presumed that the bad actors who accessed the accounts were aiming to receive money from claim reimbursements. “Immediately upon becoming aware of this potential fraud event, HealthEquity locked all affected member accounts, removed any unauthorized profile changes and suspended the ability to edit account login information. HealthEquity also implemented additional measures to ensure further security for members. Communications regarding the security incident were distributed to all affected members. HealthEquity is currently investigating whether any claim reimbursements were fraudulently submitted or redirected. HealthEquity has committed to restoring any member accounts to the prior balance if they conclude that any HRA or FSA member funds were impacted,” reported the Governor’s release. Data Breach Caused No Interruption to Company’s Systems: HealthEquity In the SEC Filing, HealthEquity said the data breach incident did not impact the company. “The investigation did not find placement of malicious code on any company systems. There has been no interruption to the Company’s systems, services, or business operations,” said the report. HealthEquity said it is in the process of notifying its partners and clients as well as identifying and notifying individual members whose information may have been involved. “The Company expects to offer complimentary credit monitoring and identity restoration services. The Company does not currently believe the incident will have a material adverse effect on its business, operations, or financial results. The Company is continuing to evaluate the impact of this incident, including remediation expenses and other potential liabilities. The Company believes it holds adequate cybersecurity insurance for this incident and will also be seeking recourse from the Partner,” HealthEquity concluded in its SEC filing.

image for UAE Cyber Security C ...

 Firewall Daily

In response to recent security vulnerabilities discovered in flagship Samsung models, the UAE Cyber Security Council has issued a critical alert advising users to promptly update their Android devices. These Samsung vulnerabilities, identified in major flagship models, pose significant risks including unauthorized   show more ...  

access and potential data theft. The South Korean smartphone manufacturers responded to these concerns by releasing comprehensive updates, incorporating patches from Google's Android Security Bulletin for July 2024 alongside additional fixes developed by Samsung. The updates are designed to fortify device security and safeguard user data against emerging threats. UAE Cyber Security Council Responds to Samsung Vulnerabilities [caption id="attachment_80144" align="alignnone" width="746"] Source: UAE Cyber Security Council[/caption] In a statement shared via social media, the Cyber Security Council emphasized the importance of these updates, highlighting their role in mitigating risks associated with the identified Samsung vulnerabilities. Users are strongly encouraged to ensure their devices are updated to the latest available version. Samsung has acknowledged the complexity involved in delivering timely security updates, citing potential delays due to regular OS upgrades. However, users can rest assured that all OS upgrades will include up-to-date security patches upon delivery. While striving to expedite security patch delivery to all applicable models, Samsung acknowledges that the timing may vary based on regions and specific device models. Furthermore, Samsung clarifies that certain patches from chipset vendors may not be immediately integrated into the current security update package. These patches will be included in upcoming security update packages as soon as they are finalized. Samsung Responds to Vulnerabilities in Flagship Devices Samsung has also provided detailed information regarding the vulnerabilities addressed in the updates, including a comprehensive list of Samsung Vulnerabilities and Exposures (SVE) items. These enhancements aim to bolster customer confidence in the security of Samsung mobile devices. The Security Maintenance Release (SMR) process includes patches sourced from Google's Android Security Bulletin up to July 2024, complemented by Samsung Semiconductor patches. Google's contributions to the update include critical and high-severity patches, such as CVE-2024-31320 and CVE-2024-23698, designed to address vulnerabilities ranging from memory corruption to sensitive information exposure.  Samsung's proprietary patches, known as Samsung Vulnerabilities and Exposures (SVE), cover a range of vulnerabilities across multiple versions of Android, including critical, high, and moderate severity issues. These patches address specific vulnerabilities like improper access controls and input validation flaws in Samsung's services and applications. Acknowledging the complexities of the update process, Samsung has highlighted potential delays caused by regular OS upgrades but assures users that security patches are integral to these updates. The company continues to prioritize user security by collaborating with cybersecurity experts and researchers to swiftly identify and mitigate vulnerabilities.

image for IT Security Expert P ...

 Appointments

Axis Finance Limited, a prominent non-banking financial company, has announced a strategic leadership appointment that is set to strengthen its information security and compliance framework. Praveen Mishra, a seasoned expert in IT risk management and security, has been named Chief Information Security Officer (CISO)   show more ...  

and Senior Vice President (SVP). This appointment marks a significant step for Axis Finance Limited in its ongoing commitment to enhancing its cybersecurity measures and regulatory compliance. [caption id="attachment_80105" align="aligncenter" width="840"] Source: Praveen Mishra's LinkedIn Post[/caption] Praveen Mishra's Extensive Background in IT Security and Compliance Praveen Mishra joins Axis Finance Limited with a distinguished career at Axis Bank, where he held various pivotal roles that honed his expertise in IT risk management, compliance, and security. His journey at Axis Bank began as an operations trainee, but his dedication and strategic acumen quickly propelled him through the ranks to become Vice President. In this capacity, he oversaw numerous regulatory compliance projects and provided critical advice on technological regulations. During his tenure at Axis Bank, Mishra spearheaded several key initiatives, including the development and implementation of IT risk frameworks and conducting thorough IT audits. His leadership in ensuring adherence to ISO standards was instrumental in maintaining high levels of security and compliance within the organization. Praveen's strategic approach to IT security involved not only the formulation of comprehensive security strategies but also the meticulous allocation of budgets to support these initiatives. His focus on risk mitigation measures was always balanced with a keen understanding of the importance of user experience, ensuring that security protocols did not hinder the efficiency and effectiveness of technological operations. New Role and Responsibilities at Axis Finance Limited In his new role as CISO and SVP at Axis Finance Limited, Praveen Mishra will leverage his experience to enhance the company’s information security posture. He will be responsible for ensuring regulatory compliance across all technological operations and driving initiatives that safeguard the company’s digital assets. His appointment is expected to bring a renewed focus on cybersecurity, aligning with the company's strategic goals of maintaining high standards of security and compliance. The appointment of Praveen Mishra as CISO and SVP represents a strategic move for Axis Finance Limited, reflecting the company’s dedication to strengthening its cybersecurity and compliance frameworks. Praveen's extensive background in IT risk management, his leadership in regulatory compliance, and his strategic vision for information security make him an ideal choice for this critical role. As Axis Finance Limited continues to grow and expand its operations, Praveen's expertise will be instrumental in navigating the challenges of the digital landscape. His proactive approach to security and compliance will help ensure that the company remains at the forefront of the financial industry, delivering secure and efficient services to its clients.

image for EU Flexes Muscles: M ...

 Compliance

The European Commission has found that Meta's "pay or consent" advertising model breaches the Digital Markets Act (DMA). The preliminary findings highlight concerns about user choice and data control within the social media landscape. The comprehensive investigation will take a year's time, after which   show more ...  

a formal decision will be made, the Commission said. DMA Compliance: A New Benchmark for User Privacy The Digital Markets Act (DMA) was signed into law by the European Parliament and the Council presidency in September 2022. It became legally effective two months later and most of its regulations took effect on May 2, 2023. The DMA is a European law that aims to prevent large online platforms from abusing their market power and to ensure fair competition in the digital economy. The law primarily targets "gatekeepers," which are large digital platforms that provide core services like search engines, messaging services, app stores and dominant online platforms like Meta. Meta's Model Under Fire: Limited Options, Privacy Concerns Online platforms collect a lot of personal data to power online advertising. Their dominant position allows them to set user agreements that enable vast data collection, giving them a big advantage over competitors. New EU regulations - DMA Article 5(2) - aim to empower users by requiring platforms to get explicit consent before combining their data across different services. Even if users refuse consent, they must still have access to a basic version of the service, even if it's less personalized. This stops platforms from forcing users to give up their data to use the service entirely. Meta's "pay or consent" model, launched in response to the DMA, presents EU users with a binary choice, the commission argued. Subscribe for an ad-free version or accept personalized ads in the free version. The Commission said this approach fails to comply with the DMA on two key points: Lack of a "Less Personalized" Option: Users are not offered a service with reduced data collection and ad personalization, violating their right to control their data footprint. Consent Coercion: The model allegedly coerces consent by making access to certain functionalities conditional on agreeing to data combination. The Commission asserted that users who choose not to consent should still have access to an equivalent service with less data collection for advertising purposes. Next Steps: Dialog and Potential Penalties Meta now has the opportunity to respond to the preliminary findings and defend its practices. The Commission will conclude its investigation within a year, potentially leading to a formal decision against Meta if the concerns are confirmed. Potential consequences for non-compliance include hefty fines – up to 20% of global turnover for repeated offenses. More drastic measures like forced business divestments are also on the table. The Commission remains open to discussions with Meta to find a solution that complies with the DMA. This case sets a crucial precedent for how dominant platforms handle user data and privacy in the age of stricter regulations.

image for Australian Mining So ...

 Cybersecurity News

Opaxe Pty Ltd, an Australian software and information services company for mining and minerals industry, has allegedly suffered a cyberattack. A Threat Actor (TA) has claimed to have breached sensitive data of the firm which includes Personal Identifiable Information (PII) of 16,000 users. The Opaxe data breach was   show more ...  

reportedly orchestrated by a threat actor, operating under the alias, “Tanaka”. Unconfirmed: Opaxe Data Breach Opaxe is an intelligent software platform that restructures and redistributes information and generates business insights to help mining professionals and investors make better decisions. "We collect, collate and republish listed mining company announcements so that you can access them quickly and easily, all in one place. We have more than 40,000 mining company announcements and 3 million data points extracted from these announcements," the company mentioned in its profile. [caption id="attachment_80137" align="alignnone" width="1602"] Source: Opaxe Website[/caption] According to the company’s website, “Opaxe was founded in May 2019 and is headquartered in West Perth, Australia with an operational office in Dunedin, New Zealand. Our development team is based in Kathmandu, Nepal.” Threat actor Tanaka made the claim to have accessed Opaxe’s data on the dark web marketplace BreachForums. In his post, the TA mentioned that the database was exfiltrated on June 26, 2024, and was in the SQL format. [caption id="attachment_80136" align="alignnone" width="1807"] Source: X[/caption] The TA stated that the breached information had over 5.5 million rows in the SQL database, which includes 16k,00 user records. The user records comprise the data fields like ID, first name, last name, e-mail, hashed passwords, industry, company, and job title [sic]. No Official Conformation of Data Breach Yet Despite these claims by the threat actor, a closer inspection reveals that the firm’s website is currently functioning normally, showing no signs of a security breach. The Cyber Express has reached out to Opaxe to verify the alleged cyberattack. As of now, no official statements or responses have been received, leaving the claims unverified. The implications of such a breach, if proven, are potentially devastating, given the sensitive nature of the data held by Opaxe. The organization is responsible for holding personal data of its users. A data leak of this magnitude could expose sensitive personal information of users as well as its business secrets. Mining professionals and investors who rely on information shared by Opaxe for critical business insights could be vulnerable of having their confidential information accessed and misused by threat actors. The breach, if confirmed, could poses several risks, including unlawful access to proprietary business insights and personal user information. This could lead to identity theft, data manipulation, and a loss of trust among Opaxe’s user base. Mining Industry Exposed to Higher Cybersecurity Risks: Report According to AustralianMining.com, which reports on the latest news and current trends in the industry, a data breach in the mining sector could be devastating due to the highly sensitive nature of the information involved, such as geological surveys and operational plans. The article suggests that mining organizations should considering establishing “Private AI”. It refers to artificial intelligence systems that are deployed within an organization's own infrastructure, rather than relying on external, cloud-based solutions. This ensures that sensitive data, such as organizational financial information, merger and acquisition targets, site surveys and employee details, remains on-premises, enhancing security and compliance with local regulations. While the authenticity of the data breach on Opaxe Pty Ltd remains unconfirmed, the potential consequences are significant. The Cyber Express will continue to monitor this ongoing situation and provide updates as more information becomes available. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for RCE, DoS Exploits Fo ...

 Cybersecurity News

Microsoft has discovered and disclosed two significant vulnerabilities in Rockwell Automation's PanelView Plus devices. These vulnerabilities could be remotely exploited by unauthenticated attackers, enabling them to execute remote code and initiate denial-of-service (DoS) attacks. The Microsoft findings   show more ...  

highlight severe security gaps in the industrial space, where these human-machine interface (HMI) graphic terminals are widely used. This discovery by Microsoft highlights the critical need for robust security measures in industrial automation systems to protect against potential disruptions. Technical Details of the RA PanelView Plus Devices Vulnerabilities The Remote Code Execution (RCE) vulnerability, identified as CVE-2023-2071 with a CVSS score of 9.8, involves the exploitation of two custom classes within the device. Attackers can abuse these classes to upload and execute a malicious DLL, effectively gaining remote control of the device. The DoS vulnerability, labeled CVE-2023-29464 with a CVSS score of 8.2, exploits the same custom class to send a crafted buffer that the device cannot handle, leading to a system crash. "The RCE vulnerability in PanelView Plus involves two custom classes that can be abused to upload and load a malicious DLL into the device. The DoS vulnerability takes advantage of the same custom class to send a crafted buffer that the device is unable to handle properly, thus leading to a DoS," reads Microsoft Blog. Microsoft Discovery and Disclosure Process Microsoft's Security Vulnerability Research (MSVR) team detected these vulnerabilities through diligent analysis and shared their findings with Rockwell Automation via Coordinated Vulnerability Disclosure (CVD) in May and July 2023. Rockwell Automation promptly responded, publishing advisories and releasing security patches in September and October 2023. "We shared these findings with Rockwell Automation through Coordinated Vulnerability Disclosure (CVD) via Microsoft Security Vulnerability Research (MSVR) in May and July 2023. Rockwell published two advisories and released security patches in September and October 2023," reads Blog. PanelView Plus devices play a crucial role in industrial automation, making the discovered vulnerabilities particularly concerning. Exploiting these vulnerabilities could allow attackers to remotely execute code, potentially leading to operational disruptions and significant financial losses for affected organizations. Microsoft emphasizes the importance of applying the released security patches to mitigate these risks. Microsoft Defender for IoT Research Team's Role One of the key responsibilities of the Microsoft Defender for IoT research team is to ensure comprehensive analysis of operational technology (OT) and Internet of Things (IoT) protocols. During their investigation, the team observed a legitimate packet capture between two devices communicating via the Common Industrial Protocol (CIP). A suspicious remote registry query involving a path to a registry value named “ProductCode” raised concerns about potential vulnerabilities. In-Depth Analysis of the Protocol CIP is an object-oriented protocol designed for industrial automation applications. Messages are directed towards specific objects identified by their Class ID and Object Instance ID. The protocol includes a Service Code, which denotes the action to be performed on the object. Microsoft's analysis revealed that the communication observed involved vendor-specific Service ID and Class ID values, prompting further investigation into the HMI firmware. Firmware Analysis and Exploitation Approach PanelView Plus HMIs operate on the Windows 10 IoT (or older versions on Windows CE) operating system. Microsoft's team extracted relevant DLLs and executables from the firmware to understand how the device processes CIP requests. They discovered that certain DLLs manage custom CIP classes responsible for reading and writing registry keys. This discovery led to the identification of two custom classes that could be exploited for remote code execution. Custom Classes and Exploitation The first custom class accepts a DLL path, function name, and parameter, loading the DLL and executing the specified function. Despite a verification function limiting the function names to predefined values, Microsoft found a way to exploit this class. The second custom class allows reading and writing files on the device, with less stringent verification, providing an avenue for uploading a malicious DLL. Microsoft demonstrated an exploitation approach by compiling a malicious DLL compatible with Windows 10 IoT. They used the second custom class to upload the DLL and placed it in a specific folder. The DLL, named remotehelper.dll, was then executed using the first custom class, granting attackers remote control of the device. This proof-of-concept confirmed the severity of the vulnerability and the potential for exploitation. Mitigation and Protection Measures To mitigate the risks associated with these vulnerabilities, Microsoft recommends the following measures: Apply Patches: Ensure that affected devices are updated with the latest security patches. Specifically, install patches PN1645 and PN1652 to address the identified vulnerabilities. Network Segmentation: Disconnect critical devices such as PLCs, routers, and PCs from the internet and ensure proper network segmentation. Access Control: Limit access to CIP devices to authorized components only. Utilize Tools: Use Microsoft's tool for scanning and forensic investigation of Rockwell Rslogix devices, available on GitHub, to identify impacted devices and secure them accordingly. Microsoft's findings and disclosure of these vulnerabilities highlight the importance of collaborative efforts in the cybersecurity community. By sharing detailed technical insights and mitigation strategies, Microsoft aims to strengthen the security posture of industrial automation systems.

image for Pro-Bangladeshi Hack ...

 Firewall Daily

The Russian hacktivist alliance "Matryoshka 424" has announced the inclusion of Team ARXU, a prominent pro-Bangladeshi hacktivist group. This alliance, already comprising 20 established Russian hacktivist groups including Digital Revolt, DOZOR 207, and Server Killers, aims to expand its influence and   show more ...  

capabilities in the cyber domain. Team ARXU gained attention earlier this year for its operations, notably targeting Romania in response to its support for Israel. The group has a history of participating in operations like OpIndia and launching cyber attacks against Israel and its allies. Their recent activities highlight a strategic shift towards broader international engagements beyond their usual focus on Israel and India. Team ARXU Joins Russian Hacktivist Alliance Matryoshka 424 [caption id="attachment_80062" align="alignnone" width="832"] Source: Dark Web[/caption] Matryoshka 424's announcement, made on July 1, 2024, signifies a big step in their expansion efforts. The alliance, which unites various cyber entities under a common cause, aims to expand its presence not only in Eastern Europe but also in regions like Asia & Pacific and Europe & UK. This move highlights their strategic intent to harness global talent and resources for collective cyber operations. According to the actor's post, translated from Russian, "Matryoshka expands its borders. Team ARXU, Bangladeshi cyber warriors, have joined our alliance, strengthening our shared influence in cyberspace." This statement highlights the alliance's goal of consolidating diverse cyber capabilities to advance shared ideological and strategic objectives. The Rise of Hacktivist Group Matryoshka 424 Matryoshka 424, founded on principles of collective defense and proactive cyber operations, is actively recruiting members across various disciplines. Their recruitment drive targets not only hacker groups but also individuals in fields such as blogging, artistry, video production, and content creation. The alliance promises career growth, promotional opportunities, and collaborative support for activities aligned with its mission. For more updates and insights into Matryoshka 424 and its activities, interested parties can follow their official channels on Telegram: Team ARXU and Matryoshka 424. This initiative aims to foster a better network that responds to cyber threats and strategic interests in the digital age. The inclusion of Team ARXU marks an important moment for Matryoshka 424, reflecting its evolution into a formidable force within the global hacktivist group. As cyber warfare evolves, alliances like Matryoshka 424 are likely to play an important role in shaping geopolitical dynamics and security worldwide. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Researchers Uncover ...

 Firewall Daily

Security researchers have identified a novel side-channel attack that can compromise the security of modern Intel CPUs variants, including Raptor Lake and Alder Lake. The attack, dubbed Indirector, leverages weaknesses in the Indirect Branch Predictor (IBP) and the Branch Target Buffer (BTB) to bypass existing   show more ...  

defenses and steal sensitive information from processors. The IBP is a critical hardware component in modern CPUs that predicts the target addresses of indirect branches. Indirect branches are control flow instructions whose target address is computed only at runtime, making them challenging to predict accurately. Attacks using Branch Target Injection (BTI) in their operations have been the focus of extensive research by security experts since the discovery of the Spectre and Meltdown attacks in 2018. Indirector CPU Vulnerability The Indirector attack developed by University of California San Diego researchers exploits weaknesses in Intel CPUs to launch precise Branch Target Injection (BTI) attacks. Attackers can use a custom tool called the iBranch Locator to locate any indirect branch and then perform precision-targeted IBP and BTB injections to execute speculative code. This allows attackers to steal sensitive information from the processor using a side-channel attack. [caption id="attachment_80025" align="alignnone" width="1208"] Source: indirector.cpusec.org[/caption] This tool enables two high-precision attacks: IBP Injection Attack: Locates and injects arbitrary target addresses into victim IBP entries. BTB Injection Attack: Injects malicious targets into the victim's BTB entry, misleading it through BTB prediction. These attacks can potentially bypass existing defenses and compromise system security across various scenarios, including cross-process and cross-privilege situations. The paper has stated that while Intel has already offered several mitigations to protect the BTB and IBP from different types of target injection attacks, such as Indirect Branch Restricted Speculation (IBRS), Single Thread Indirect Branch Predictors (STIBP), and Indirect Branch Predictor Barrier, these defenses were found inadequate and did not always correspond to advertised goals. The researchers stated their surprise on the discovery of potential attack surfaces despite the implementation of these measures. The research paper behind the study has three main important contributions: The paper presents the first major analysis of the Indirect Branch Predictor and its interaction with the Branch Target Buffer in the recent Intel processor families. The paper details the size, structure, and precise indexing and tagging hash functions.  The paper analyzes mitigation mechanisms (IBRS, STIBP, and IBPB) on Intel CPUs designed to protect against BTB and IBP target injection attacks. The paper demonstrated the use of the iBranch Locator as an efficient  tool with the capability of locating any indirect branches within the IBP without requiring prior data on the the branch. The paper highlights that by using this tool, attackers can successfully break address space layout randomization. Intel Indirector Mitigations For Intel processors, researchers recommend more aggressive use of the Indirect Branch Predictor Barrier (IBPB) and suggest the incorporation of more fine-grained BPU isolation across security domains in future CPU designs. Possible further mitigations include a more aggressive use of the Indirect Branch Predictor Barrier (IBPB) and hardening the Branch Prediction Unit (BPU) design through the incorporation of more complex tags, encryption, and randomization. The researchers disclosed their findings to Intel in February 2024, with the researchers stating that Intel had informed other affected hardware and software vendors about the vulnerability. The researchers' discoveries underscore the importance of ongoing scrutiny and analysis of hardware components and the need for chip manufacturers to continually improve their designs to stay ahead of potential threats. The authors thanked anonymous reviewers for helpful suggestions on the research paper.

image for MEDUSA Claims Access ...

 Cybersecurity News

The Harry Perkins Institute of Medical Research, one of Australia’s leading medical research institutes, has reportedly suffered a cyberattack carried out by the notorious MEDUSA ransomware group. The hackers allegedly exfiltrated 4.6 TB of internal building camera recordings of the institute and demanded a ransom   show more ...  

of $500,000. Harry Perkins Institute Ransomware Attack Explained The Harry Perkins Institute was established in 1998. It functions out of two hospital campuses in Perth, one at the QEII Medical Centre in Nedlands and the second at the Fiona Stanley Hospital Campus in Murdoch. According to the institute’s website, the centre’s aim is “to unify Western Australian scientists in a collaborative research powerhouse. In the years since, we have grown to become one of the nation’s leading medical research centres, where a close-knit team of more than 250 research and trial staff work together to defeat the major diseases that impact our community – diseases like cancer, heart disease, diabetes and rare genetic diseases.” The MEDUSA ransomware group has set an ominous countdown of 9 days, 18 hours, 6 minutes and 35 seconds for the institute to comply with its demands, which ends on July 12. Additionally, for every day that passes without payment, the ransom amount increases by USD $10,000. MEDUSA is also willing to sell the data to anyone or delete it for a ransom of $500,000. [caption id="attachment_80094" align="alignnone" width="1080"] Source: X[/caption] Harry Perkins Institute is yet to react to the ransomware group’s claims. Without an official statement from the medical firm, it would be premature to conclude whether the ransomware attack genuinely took place. The Cyber Express has reached out to the firm seeking confirmation of the cyberattack. The article would be updated once there is an official response to the incident. If the ransomware attack on Harry Perkins is indeed confirmed, the implications for the firm could be extensive and severe. Cybersecurity has become increasingly important in every sector, and the video surveillance system is no exception. A compromised Video Surveillance System can result in unauthorized access to sensitive data along with concerns over the privacy of individuals. MEDUSA Ransomware: Rising Number of Attacks Last month, MEDUSA ransomware escalated their activities. They first targeted AJE Group, a prominent company in the manufacture, distribution, and sale of alcoholic and nonalcoholic beverages in Peru, exfiltrating 646.4 GB of the company’s data. The notorious group then allegedly carried out data breaches of two institutions in the USA. The first was the Tri-Cities Preparatory High School, a public charter middle and high school located in Prescott, Arizona. The second target is Fitzgerald, DePietro & Wojnas CPAs, P.C., an accounting firm based in Utica, New York. MEDUSA first emerged in June 2021 and has since launched attacks on organizations across various countries and industries, including healthcare, education, manufacturing, and retail. Despite its global reach, most victims have been based in the United States. MEDUSA operates as a Ransomware-as-a-Service (RaaS) platform, offering malicious software and infrastructure to would-be attackers. This model enables less technically skilled criminals to launch sophisticated ransomware attacks. MEDUSA’s threat actors often utilize a public Telegram channel to post stolen data, leveraging public exposure as an extortion tactic to pressure organizations into paying the ransom. While the authenticity of the ransomware attack on The Harry Perkins Institute remains unconfirmed, the potential consequences are significant. The Cyber Express will continue to monitor this ongoing situation and provide updates as more information becomes available. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Understanding the Fa ...

 Firewall Daily

In the first half of 2024, the FakeBat loader, also known as EugenLoader or PaykLoader, emerged as a prominent threat leveraging the drive-by download technique. This method has increasingly been adopted by cybercriminals to spread malware through unsuspecting users' web browsing activities. Drive-by downloads   show more ...  

involve techniques like SEO poisoning, malvertising, and injecting malicious code into compromised websites. These methods deceive users into downloading fake software or updates, inadvertently installing malware like loaders (e.g., FakeBat, BatLoader), botnets (e.g., IcedID, PikaBot), and more. The FakeBat Loader Campaigns FakeBat specializes in downloading and executing subsequent payloads such as IcedID, Lumma, Redline, and others. It operates as a Malware-as-a-Service (MaaS), offering an administration panel to manage payload distribution, installation monitoring, and evasion of detection mechanisms like Google's Unwanted Software Policy and Windows Defender alerts. Throughout 2024, Sekoia Threat Detection & Research (TDR) identified multiple FakeBat distribution campaigns. These FakeBat loader campaigns utilize diverse tactics, including fake websites that mimic popular software download pages to lure users into downloading FakeBat disguised as legitimate software. "The FakeBat administration panel contains information related to the infected host, including the IP address, country, OS, web browser, mimicked software, and installation status. Customers can also write comments for each bot", says Sekoia.io. The threat actor behind this campaign also uses fake web browser updates to compromise websites to inject code that prompts users to update their browsers with malicious installers. Social engineering is another concerning threat as hackers can target communities like web3 with fake applications and use social media platforms to distribute FakeBat. Sekoia analysts meticulously tracked FakeBat's Command-and-Control (C2) infrastructure. Over the period from August 2023 to June 2024, they identified several C2 servers hosting FakeBat payloads and observed changes in their operational tactics. These servers often employ tactics to evade detection, such as filtering traffic based on User-Agent values and IP addresses. Features and Capabilities of FakeBat Loader FakeBat, a prominent leader in 2024, employs various distribution methods such as mimicking legitimate software sites and compromising websites with injected malicious code. Sekoia identified domains associated with FakeBat's command-and-control (C2) servers, including 0212top[.]online, 3010cars[.]top, and 756-ads-info[.]site, often registered under obscured or misleading ownership details. These domains facilitate the malware's distribution, highlighting its adaptability and the evolving nature of cyber threats. FakeBat spreads through tactics like fake software updates, with Sekoia uncovering instances targeting applications like AnyDesk and Google Chrome. Users are redirected to download malware disguised as legitimate updates, demonstrating the loader's deceptive tactics to infiltrate systems. As a significant player in drive-by download attacks, FakeBat's diverse distribution strategies highlight its ability to evade detection and exploit vulnerabilities.

image for Australia Gives Onli ...

 Regulations

Australia’s eSafety Commissioner has given key online industry players six months to develop "enforceable codes" to shield children from exposure to pornography and other harmful content. The codes will aim to prevent young children from encountering explicit material that is deemed unsuitable for their age.   show more ...  

They will also seek to empower Australian internet users with options to manage their exposure to various online materials. While the primary focus is on pornography, the codes will also cover other high-impact content, including themes of suicide, self-harm, and disordered eating. The regulations will apply to app stores, apps, websites (including porn sites), search engines, social media, hosting services, ISPs, messaging platforms, multiplayer games, online dating services, and device providers. The European Union calls these large digital platforms “gatekeepers.” Why 'Enforceable Codes' are Important eSafety Commissioner Julie Inman Grant noted the pervasive and invasive nature of online pornography. She said children often encounter explicit material accidentally and at younger ages than before. “Our own research shows that while the average age when Australian children first encounter pornography is around 13, a third of these children are actually seeing this content younger and often by accident,”  - eSafety Commissioner Julie Inman Grant She clarified that these measures focus on preventing young children’s unintentional exposure to explicit content that revolves around such a sensitive topic. Social media plays a significant role in unintentional exposure, with 60% of young people encountering pornography on platforms like TikTok, Instagram, and Snapchat, according to Inman Grant. “The last thing anyone wants is children seeing violent or extreme pornography without guidance, context or the appropriate maturity levels because they may think that a video showing a man aggressively choking a woman during sex on a porn site is what consent, sex and healthy relationships should look like,” she added. Parents and caregivers are crucial in protecting children, but the industry must also implement effective barriers, Inman Grant stressed. These could include age verification, default safety settings, parental controls, and tools to filter or blur unwanted sexual content. Such measures should apply across all technology layers, from connected devices to app stores, messaging services, social media platforms, and search engines, providing multi-layered protection, the eSafety Commissioner said. Draft Due Oct. 3, Final Versions by Dec. 19 Industry bodies are required to submit a preliminary draft of the codes by October 3, with final versions due at the end of the year on December 19. Public consultations in the process of defining "enforceable codes" is also a requirement from the eSafety commissioner. eSafety has released a Position Paper to help industry develop these codes and clarify expectations. “We want industry to succeed here and we will work with them to help them come up with codes that provide meaningful protections for children.” - eSafety Commissioner Julie Inman Grant eSafety Commissioner Can Set Rules if Efforts Fail But if any code falls short, then the eSafety commissioner can set the rules for them, under the Online Safety Act provisions. eSafety has also published an Age Assurance Tech Trends Paper examining recent developments in age verification technology to provide additional context. These new codes will complement existing protections under the Online Safety Act, including the Restricted Access System Declaration, Basic Online Safety Expectations Determination, and initial industry codes addressing illegal content like online child sexual abuse material. Additionally, the codes align with broader initiatives such as the Government’s Age Assurance Trial, Privacy Act reforms, the statutory review of the Online Safety Act, and efforts under the National Plan to End Violence Against Women and Children 2022-2032. Last year, the eSafety commissioner had also issued notices to online platforms like Twitter, Meta, and others concerning their approaches to combatting online child abuse. This was followed by a similar action from Inman Grant against online hate over social media platforms.

image for Law Enforcement and ...

 Firewall Daily

In a coordinated takedown, law enforcement and cybersecurity firms joined forces to cripple cybercriminals' misuse of a legitimate security tool – Cobalt Strike. The week-long operation, codenamed MORPHEUS and spearheaded by UK's National Crime Agency, targeted unlicensed versions of Cobalt Strike used to   show more ...  

infiltrate victim networks. Europol, which helped coordinate the operation involving authorities from six other countries, said a total of 690 IP addresses linked to criminal activity were flagged. By the end of the week, over 85% (593) of these addresses associated with unlicensed Cobalt Strike instances were disabled by internet service providers (ISPs) in 27 countries. Cobalt Strike: Double-Edged Sword Cobalt Strike, a commercially available tool by Fortra, is used by ethical hackers for penetration testing – simulating cyberattacks to identify vulnerabilities in a network's defenses. However, in the hands of malicious actors, unlicensed versions of Cobalt Strike transform into a powerful weapon. "Since the mid 2010’s, pirated and unlicensed versions of the software downloaded by criminals from illegal marketplaces and the dark web have gained a reputation as the ‘go-to’ network intrusion tool for those seeking to build a cyberattack, allowing them to deploy ransomware at speed and at scale." - UK's NCA Cybercriminals typically deploy Cobalt Strike through spear phishing emails, tricking victims into clicking malicious links or opening infected attachments. Once a victim clicks, a "Beacon" is installed, granting the attacker remote access to the compromised system. This access allows them to steal data, through infostealers, or launch further attacks. Criminals also exploit these cracked copies to establish backdoors on compromised systems, and deploy malware. Notably, investigations into ransomware strains like Ryuk, Trickbot, and Conti have linked them to the use of unlicensed Cobalt Strike, Europol said. Paul Foster, director of threat leadership at the National Crime Agency, said, “Although Cobalt Strike is a legitimate piece of software, sadly cybercriminals have exploited its use for nefarious purposes. Illegal versions of it have helped lower the barrier of entry into cybercrime, making it easier for online criminals to unleash damaging ransomware and malware attacks with little or no technical expertise." Foster warned  that such attacks could cost companies millions in terms of losses and recovery. Public-Private Partnership: A Winning Formula The success of Operation MORPHEUS hinges on the unprecedented cooperation between law enforcement and the private sector. Key industry partners like BAE Systems Digital Intelligence, Trellix, Spamhaus, and The Shadowserver Foundation provided crucial support. Their expertise in threat intelligence, network scanning, and data analysis proved instrumental in identifying malicious activities and pinpointing cybercriminal infrastructure. This collaboration is a direct consequence of Europol's recent regulatory amendments, empowering the agency to work more effectively with private entities. This novel approach grants Europol access to real-time threat intelligence and a broader understanding of cybercriminal tactics. This translates to a more coordinated and comprehensive response, ultimately strengthening the overall cybersecurity posture across Europe. Europol's European Cybercrime Centre (EC3) played a pivotal role throughout the investigation, offering analytical and forensic support while facilitating seamless information exchange between all partners, while the FBI, Australian Federal Police, and other national agencies provided critical support. Over the past two and a half years, law enforcement utilized the Malware Information Sharing Platform (MISP) to facilitate real-time threat intelligence sharing with the private sector. Nearly 730 intelligence reports containing almost 1.2 million indicators of compromise (IOCs) were exchanged during the investigation. Additionally, EC3 organized over 40 coordination meetings to ensure smooth collaboration between law enforcement and private partners. Europol even established a virtual command post during the takedown week to coordinate global law enforcement activities. The Fight Continues While Operation MORPHEUS represents a significant victory, the war against cybercrime is far from over. Law enforcement agencies remain vigilant, prepared to conduct similar disruptive actions as long as criminals continue to exploit vulnerabilities in legitimate security tools. Fortra, the developer of Cobalt Strike, has also released a new version with enhanced security measures and is committed to working with law enforcement to remove older, vulnerable versions from circulation.

image for FBI, DHS Warn of Ins ...

 Cybersecurity News

In a collaborative effort to safeguard the integrity of the 2024 US election cycle, the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and other key partners have released new guidance for election officials. This comprehensive overview addresses the risks posed by   show more ...  

insider threats to election infrastructure, potential scenarios, and actionable steps to mitigate these threats. Strengthening 2024 US Election Security The FBI, in coordination with the Department of Homeland Security’s (DHS) Office of Intelligence and Analysis (I&A), CISA, and the U.S. Election Assistance Commission (EAC), has prepared this guidance to assist election officials at all levels in defending against insider threat concerns. For years, federal, state, local, and private sector partners have worked closely to support state and local officials in safeguarding election infrastructure from cyber, physical, and insider threats. Due to these concerted efforts, there is no evidence that malicious actors have altered or deleted votes or impacted the outcome of elections. "While there is no evidence that malicious actors impacted election outcomes, it is important that election stakeholders at all levels are aware of the risks posed by insider threats and the steps that they can take to identify and mitigate these threats," reads the report. Understanding Insider Threats An insider threat is defined as an individual or group with authorized access or special knowledge who uses that access to cause harm to an organization or entity. This harm can include malicious acts that compromise the security and integrity of election systems and information. Insiders can be current or former employees, temporary workers, volunteers, contractors, or any individuals with privileged access to election systems. Recent Examples of Insider Threats Unauthorized Data Extraction: A temporary election worker inserted a personal flash drive into an electronic poll book containing voter registration data, including confidential information. This worker extracted the data to compare it against documents they intended to acquire post-election via the Freedom of Information Act. The breached equipment was decommissioned following the incident. Unauthorized Access and Data Exposure: A state-identified digital images of a voting system and confidential passwords published online without authorization. Further investigation revealed that a county clerk and a subordinate had granted unauthorized access to the county’s voting machines, disabled security cameras, and provided false credentials to an unauthorized individual. Network Access Breach: During a state’s spring primary election, a county official reported an attempt to gain unauthorized access to the county’s election network. An unauthorized laptop was connected to the government network, and data from the election network was later presented at a public gathering discussing perceived election fraud. Compromised Election Systems: Two county officials allowed unauthorized users access to their election systems during an audit, leading to the state’s chief election official decertifying the machines and prohibiting their use in future elections. While recent insider threats have been domestic, there is a growing concern about foreign adversaries exploiting insider access to interfere with the 2024 US elections. Foreign actors might attempt to manipulate individuals with privileged access through ideological, financial, or coercive means. Such attempts could potentially disrupt processes, spread false information, and undermine confidence in U.S. democratic institutions. Indicators of Insider Threat Activity Election officials should be vigilant for signs of insider threat activity, including: Unauthorized access to systems or facilities. Attempting to alter or destroy ballots or election materials. Turning off security cameras or access control systems. Removing sensitive material without authorization. Accessing networks at odd times. Ignoring cybersecurity policies. Building an Insider Threat Mitigation Program Effective insider threat mitigation involves several key components: Standard Operating Procedures (SOPs): Detailed steps for tasks, including access control measures and the buddy system for handling sensitive tasks. Physical and Digital Access Control: Restricting access to necessary systems and facilities, maintaining logs, and using surveillance. Chain of Custody Procedures: Documenting the movement and control of assets to prevent unauthorized access. Zero Trust Security: Verifying each access request, regardless of origin. Continuous Monitoring: Using human and digital tools to detect anomalies. Routine Audits: Validating the effectiveness of security measures. Cybersecurity Best Practices: Implementing multi-factor authentication, regular updates, and network segmentation. As the 2024 US election cycle approaches, it is imperative for election stakeholders to be aware of the risks posed by insider threats and to implement comprehensive mitigation strategies. The guidance provided by the FBI, CISA, and partners serves as a crucial resource in these efforts. By establishing strong security measures, election officials can help ensure the integrity, reliability, and security of the election process, thereby reinforcing public confidence in the democratic system.

image for Inside the workings ...

 Threats

A scammer these days doesnt need to know how to write malware or think up sophisticated digital fraud schemes. Todays scams come prepackaged in the form of fraud-as-a-service (FaaS). The average scammer only needs to search for victims and then drain their wallets — the operator takes care of the rest. Today, we   show more ...  

look at a group that specializes in classifieds-website scams to explain what turnkey phishing is, and how best to defend against it. Who provides the service? A gangs key person is the founder, or topic starter. This guy manages everyone else: Coders, who are responsible for Telegram channels, chats and bots Refunders, or fake support agents Carders, who withdraw money from the victims bank account Workers, who find ads, respond, and persuade victims to open a phishing link Thats what the core lineup of almost any gang looks like. Especially sophisticated outfits also include marketers, motivators and mentors. These run promotional campaigns for the project, and provide moral support to, and training for, workers The members of a scam gang chiefly communicate via private groups and chats in Telegram. The channel we investigated had around 15,000 members, with just five of them being mentors. Virtually everyone else was a worker — a pawn in this scheme. Read the investigative story on Securelist to find out more about other roles the members of a scam gang have. The Telegram bot as the workers main weapon Bots help gangs automate most of the scamming process. For example, scammers can use these to create unique, personalized phishing ads. A Telegram bot we discovered churns out as many as 48 ads at a time, in four languages, for six classifieds websites and in two versions: seller scam (2.0) and buyer scam (1.0). A bot creates links for two types of scam at a time: seller scam (2.0) and buyer scam (1.0) Next, a worker uses the Telegram bot to automatically send the links to the victims email, instant messaging account or SMS inbox. As soon as a phishing link is opened, the bot displays a message that says Mammoth online. This tells the worker that the scam has all but succeeded: the victim has no protection, so the gang is about to pocket their money. The bot tells the worker everything the victim does — in detail Instant notifications about anything that happens is one of Telegram bots killer features. Thus, if the victim takes the bait, paying for the goods or delivery, the worker learns immediately. The bot computes the workers share of the booty and shares the name of the carder wholl withdraw the funds. Another one duped! — the new workers anthem This is the extent of what the worker needs to do, as the money will be credited to their account automatically — unless theyre scammed by their own gangmates, which isnt unheard of. How much scam gangs make The workers are the gangs cash cows: they pay commissions to the mastermind, mentor, carder and refunder. This project is no doubt a moneymaker: the gang earned more than two million US dollars between August 2023 and June 2024. Thats what the scammers say anyway, but they can declare whatever figures they want, no matter how inflated, in their internal chat to motivate the workers. A bad day for the scammers — but a happy one for the whole humanity The scam factorys profits are restricted by banks transaction limits. The gang were looking at operates out of Switzerland, and local banking rules prevent it from stealing more than 15,000 Swiss francs (approximately 16,700 US dollars) at a time. The workers have a minimum withdrawal amount: they wont bother with cards if there are less than 300 Swiss francs (333 US dollars) in the associated account; otherwise the costs would exceed the earnings. Avoiding the trap Being attacked by turnkey phishing (as opposed to regular phishing) makes no difference to the target: the scammers are still scammers, trying all kinds of ways to swindle victims out of their money. But, since FaaS makes the scammers work so much easier, this kind of scam is on the rise. Accordingly, the protection tips remain the same as for other types of phishing: Use reliable security to keep you from following phishing links. Take a look at our safe online selling rules. Restrict your chats with sellers and buyers to the classifieds sites; to prevent workers from seeing your personal details, dont switch to instant messaging apps. Pay for your online purchases only with virtual cards that have transaction limits, and dont store significant amounts in the accounts linked to those. Read about how other scams work to stay on top of trends.

image for Transatlantic Cable ...

 News

Episode 353 of the Transatlantic Cable podcast kicks off with an interesting story involving Microsoft, real-time software recording and sex-toy retailers. To go into more details would just be a spoiler.  From there, the team talk about how Facebook are the next business to face EUs DMA (Digital Markets Act)   show more ...  

legislation. To wrap up conversation moves to how residents in local town meetings across America were being terrorised by people zoom bombing calls and town meetings. The final story revolves around Googles Threat Analysis Group (TAG) thwarts over 10,000 attempts by Chinese influence operators. If you like what you heard, please consider subscribing. Lawsuit Claims Microsoft Tracked Sex Toy Shoppers With Recording in Real Time Software Facebook and Instagrams pay or consent ad model violates the DMA, says the EU Local Residents Terrorizing City Council Meetings Were Actually Overseas, Feds Allege Google Thwarts Over 10,000 Attempts by Chinese Influence Operator

image for The Not-So-Secret Ne ...

 Breadcrumbs

Most accomplished cybercriminals go out of their way to separate their real names from their hacker handles. But among certain old-school Russian hackers it is not uncommon to find major players who have done little to prevent people from figuring out who they are in real life. A case study in this phenomenon is   show more ...  

“x999xx,” the nickname chosen by a venerated Russian hacker who specializes in providing the initial network access to various ransomware groups. x999xx is a well-known “access broker” who frequently sells access to hacked corporate networks — usually in the form of remote access credentials — as well as compromised databases containing large amounts of personal and financial data. In an analysis published in February 2019, cyber intelligence firm Flashpoint called x999xx one of the most senior and prolific members of the top-tier Russian-language cybercrime forum Exploit, where x999xx could be seen frequently advertising the sale of stolen databases and network credentials. In August 2023, x999xx sold access to a company that develops software for the real estate industry. In July 2023, x999xx advertised the sale of Social Security numbers, names, and birthdays for the citizenry of an entire U.S. state (unnamed in the auction). A month earlier, x999xx posted a sales thread for 80 databases taken from Australia’s largest retail company. “You may use this data to demand a ransom or do something different with it,” x999xx wrote on Exploit. “Unfortunately, the flaw was patched fast. [+] no one has used the data yet [+] the data hasn’t been used to send spam [+] the data is waiting for its time.” In October 2022, x999xx sold administrative access to a U.S. healthcare provider. ALIAS: MAXNM The oldest account by the name x999xx appeared in 2009 on the Russian language cybercrime forum Verified, under the email address maxnm@ozersk.com. Ozersk is a city in the Chelyabinsk region of west-central Russia. According to the breach tracking service Constella Intelligence, the address maxnm@ozersk.com was used more than a decade ago to create an account at Vktontakte (the Russian answer to Facebook) under the name Maxim Kirtsov from Ozersk. Mr. Kirtsov’s profile — “maxnm” — says his birthday is September 5, 1991. Personal photos Maxnm shared on Vktontakte in 2016. The caption has been machine translated from Russian. The user x999xx registered on the Russian language cybercrime community Zloy in 2014 using the email address maxnmalias-1@yahoo.com. Constella says this email address was used in 2022 at the Russian shipping service cdek.ru by a Maksim Georgievich Kirtsov from Ozersk. Additional searches on these contact details reveal that prior to 2009, x999xx favored the handle Maxnm on Russian cybercrime forums. Cyber intelligence company Intel 471 finds the user Maxnm registered on Zloy in 2006 from an Internet address in Chelyabinsk, using the email address kirtsov@telecom.ozersk.ru. That same email address was used to create Maxnm accounts on several other crime forums, including Spamdot and Exploit in 2005 (also from Chelyabinsk), and Damagelab in 2006. A search in Constella for the Russian version of Kirtsov’s full name — Кирцов Максим Георгиевич — brings up multiple accounts registered to maksya@icloud.com. A review of the digital footprint for maksya@icloud.com at osint.industries reveals this address was used a decade ago to register a still-active account at imageshack.com under the name x999xx. That account features numerous screenshots of financial statements from various banks, chat logs with other hackers, and even hacked websites. x999xx’s Imageshack account includes screenshots of bank account balances from dozens of financial institutions, as well as chat logs with other hackers and pictures of homegrown weed. Some of the photos in that Imageshack account also appear on Kirtsov’s Vkontakte page, including images of vehicles he owns, as well as pictures of potted marijuana plants. Kirtsov’s Vkontakte profile says that in 2012 he was a faculty member of the Ozersk Technological Institute National Research Nuclear University. The Vkontakte page lists Kirtsov’s occupation as a website called ozersk[.]today, which on the surface appears to be a blog about life in Ozersk. However, in 2019 the security firm Recorded Future published a blog post which found this domain was being used to host a malicious Cobalt Strike server. Cobalt Strike is a commercial network penetration testing and reconnaissance tool that is sold only to vetted partners. But stolen or ill-gotten Cobalt Strike licenses are frequently abused by cybercriminal gangs to help lay the groundwork for the installation of ransomware on a victim network. In August 2023, x999xx posted a message on Exploit saying he was interested in buying a licensed version of Cobalt Strike. A month earlier, x999xx filed a complaint on Exploit against another forum member named Cobaltforce, an apparent onetime partner whose sudden and prolonged disappearance from the community left x999xx and others in the lurch. Cobaltforce recruited people experienced in using Cobalt Strike for ransomware operations, and offered to monetize access to hacked networks for a share of the profits. DomainTools.com finds ozersk[.]today was registered to the email address dashin2008@yahoo.com, which also was used to register roughly two dozen other domains, including x999xx[.]biz. Virtually all of those domains were registered to Maxim Kirtsov from Ozersk. Below is a mind map used to track the identities mentioned in this story. A visual depiction of the data points connecting x999xx to Max Kirtsov. x999xx is a prolific member of the Russian webmaster forum “Gofuckbiz,” with more than 2,000 posts over nearly a decade, according to Intel 471. In one post from 2016, x999xx asked whether anyone knew where he could buy a heat lamp that simulates sunlight, explaining that one his pet rabbits had recently perished for lack of adequate light and heat. Mr. Kirtsov’s Vkontakte page includes several pictures of caged rabbits from 2015 and earlier. CONFIRMATION Reached via email, Mr. Kirtsov acknowledged that he is x999xx. Kirtsov said he and his team are also regular readers of KrebsOnSecurity. “We’re glad to hear and read you,” Kirtsov replied. Asked whether he was concerned about the legal and moral implications of his work, Kirtsov downplayed his role in ransomware intrusions, saying he was more focused on harvesting data. “I consider myself as committed to ethical practices as you are,” Kirtsov wrote. “I have also embarked on research and am currently mentoring students. You may have noticed my activities on a forum, which I assume you know of through information gathered from public sources, possibly using the new tool you reviewed.” “Regarding my posts about selling access, I must honestly admit, upon reviewing my own actions, I recall such mentions but believe they were never actualized,” he continued. “Many use the forum for self-serving purposes, which explains why listings of targets for sale have dwindled — they simply ceased being viable.” Kirtsov asserted that he is not interested in harming healthcare institutions, just in stealing their data. “As for health-related matters, I was once acquainted with affluent webmasters who would pay up to $50 for every 1000 health-themed emails,” Kirtsov said. “Therefore, I had no interest in the more sensitive data from medical institutions like X-rays, insurance numbers, or even names; I focused solely on emails. I am proficient in SQL, hence my ease with handling data like IDs and emails. And i never doing spam or something like this.” On the Russian crime forums, x999xx said he never targets anything or anyone in Russia, and that he has little to fear from domestic law enforcement agencies provided he remains focused on foreign adversaries. x999xx’s lackadaisical approach to personal security mirrors that of Wazawaka, another top Russian access broker who sold access to countless organizations and even operated his own ransomware affiliate programs. “Don’t shit where you live, travel local, and don’t go abroad,” Wazawaka said of his own personal mantra. “Mother Russia will help you. Love your country, and you will always get away with everything.” In January 2022, KrebsOnSecurity followed clues left behind by Wazawaka to identify him as 32-year-old Mikhail Matveev from Khakassia, Russia. In May 2023, the U.S. Department of Justice indicted Matveev as a key figure in several ransomware groups that collectively extorted hundreds of millions of dollars from victim organizations. The U.S. State Department is offering a $10 million reward for information leading to the capture and/or prosecution of Matveev. Perhaps in recognition that many top ransomware criminals are largely untouchable so long as they remain in Russia, western law enforcement agencies have begun focusing more on getting inside the heads of those individuals. These so-called “psyops” are aimed at infiltrating ransomware-as-a-service operations, disrupting major cybercrime services, and decreasing trust within cybercriminal communities. When authorities in the U.S. and U.K. announced in February 2024 that they’d infiltrated and seized the infrastructure used by the infamous LockBit ransomware gang, they borrowed the existing design of LockBit’s victim shaming website to link instead to press releases about the takedown, and included a countdown timer that was eventually replaced with the personal details of LockBit’s alleged leader. In May 2024, law enforcement agencies in the United States and Europe announced Operation Endgame, a coordinated action against some of the most popular cybercrime platforms for delivering ransomware and data-stealing malware. The Operation Endgame website also included a countdown timer, which served to tease the release of several animated videos that mimic the same sort of flashy, short advertisements that established cybercriminals often produce to promote their services online.

image for 3 Ways to Chill Atta ...

 Feed

Multifactor authentication is a good first step, but businesses should look to collect and analyze data to hunt for threats, manage identities more closely, and limit the impact of attacks.

 Incident Response, Learnings

The criminal gang targeted elderly Spanish citizens by posing as bank employees through voice phishing and then showing up unannounced at their homes to collect cards, bank details, and PINs.

 Trends, Reports, Analysis

Nearly two-thirds of payments professionals in the UK believe that fraud is the most urgent financial crime threat, with authorized push payment (APP) scams being the top concern, according to a survey by The Payments Association.

 Expert Blogs and Opinion

The nature of defense is inherently stacked against defenders, as cybercriminals aim to disrupt systems while defenders manage complex tech stacks. Additionally, the rapid evolution of technology means defenders are always playing catch-up.

 Malware and Vulnerabilities

Recent discoveries have unveiled severe vulnerabilities within CocoaPods, a dependency manager essential for iOS and macOS application development. These security flaws could lead to significant supply chain attacks, jeopardizing numerous applications. The exploit allows attackers to alter the software update process,   show more ...  

inserting harmful payloads into applications. Developers must remain vigilant and adopt robust security practices to safeguard their applications and users.

 Incident Response, Learnings

The US Department of Health and Human Services has levied a fine of $950,000 from the Heritage Valley Health System in Pennsylvania. It must address potential HIPAA violations after a ransomware attack in 2017.

 Security Products & Services

Secator is an open-source task and workflow runner designed for security assessments to streamline the use of various security tools for pen testers and security researchers.

 Feed

Deep Sea Electronics DSE855 is vulnerable to configuration disclosure when direct object reference is made to the Backup.bin file using an HTTP GET request. This will enable an attacker to disclose sensitive information and help her in authentication bypass, privilege escalation, and full system access.

 Feed

GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols, as well as APIs to parse and write X.509, PKCS #12, OpenPGP, and other required structures. It is intended to be portable and efficient with a focus on security and interoperability.

 Feed

Ubuntu Security Notice 6862-1 - Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. Lukas Bernhard   show more ...  

discovered that Firefox did not properly manage memory during garbage collection. An attacker could potentially exploit this issue to cause a denial of service, or execute arbitrary code.

 Feed

Ubuntu Security Notice 6860-1 - Reynir Bjoernsson discovered that OpenVPN incorrectly handled terminating client connections. A remote authenticated client could possibly use this issue to keep the connection active, bypassing certain security policies. This issue only affected Ubuntu 23.10, and Ubuntu 24.04 LTS.   show more ...  

Reynir Bjoernsson discovered that OpenVPN incorrectly handled certain control channel messages with nonprintable characters. A remote attacker could possibly use this issue to cause OpenVPN to consume resources, or fill up log files with garbage, leading to a denial of service.

 Feed

Cybersecurity researchers have discovered an attack campaign that targets various Israeli entities with publicly-available frameworks like Donut and Sliver. The campaign, believed to be highly targeted in nature, "leverage target-specific infrastructure and custom WordPress websites as a payload delivery mechanism, but affect a variety of entities across unrelated verticals, and rely on

 Feed

An unnamed South Korean enterprise resource planning (ERP) vendor's product update server has been found to be compromised to deliver a Go-based backdoor dubbed Xctdoor. The AhnLab Security Intelligence Center (ASEC), which identified the attack in May 2024, did not attribute it to a known threat actor or group, but noted that the tactics overlap with that of Andariel, a sub-cluster within the

 Feed

Unknown threat actors have been observed exploiting a now-patched security flaw in Microsoft MSHTML to deliver a surveillance tool called MerkSpy as part of a campaign primarily targeting users in Canada, India, Poland, and the U.S. "MerkSpy is designed to clandestinely monitor user activities, capture sensitive information, and establish persistence on compromised systems," Fortinet FortiGuard

 Feed

The loader-as-a-service (LaaS) known as FakeBat has become one of the most widespread loader malware families distributed using the drive-by download technique this year, findings from Sekoia reveal. "FakeBat primarily aims to download and execute the next-stage payload, such as IcedID, Lumma, RedLine, SmokeLoader, SectopRAT, and Ursnif," the company said in a Tuesday analysis. Drive-by attacks

 Feed

Recently the Office of the Director of National Intelligence (ODNI) unveiled a new strategy for open-source intelligence (OSINT) and referred to OSINT as the “INT of first resort”. Public and private sector organizations are realizing the value that the discipline can provide but are also finding that the exponential growth of digital data in recent years has overwhelmed many traditional OSINT

 Cisco

Source: www.databreachtoday.com – Author: 1 Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime , Network Firewalls, Network Access Control China-Nexus Hackers Velvet Ant Exploited the Bug in April, Cisco and Sygnia Say Rashmi Ramesh (rashmiramesh_) • July 2, 2024     Image:   show more ...  

Shutterstock Cisco on Monday patched a zero-day vulnerability discovered months ago that […] La entrada Cisco Patches an Exploited Zero-Day Vulnerability – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Artificial Intelligence & Machine Learning , Next-Generation Technologies & Secure Development Meta Changes AI Content Labeling; YouTube Updates Privacy Guidelines Rashmi Ramesh (rashmiramesh_) • July 2, 2024     Image: Shutterstock Meta and YouTube   show more ...  

updated their artificial intelligence policies to address the altered content appearing on their platforms. See Also: […] La entrada Meta and YouTube Update Their AI Content Policies – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Finance & Banking , Incident & Breach Response , Industry Specific Startups and Evolve Client Are Monitoring the Situation for Potential Fallout David Perera (@daveperera) • July 2, 2024     A ransomware attack didn’t stop Affirm customers from   show more ...  

buying now and paying later. (Image: Shutterstock) A ransomware attack against […] La entrada Evolve Ransomware Hack Affects Affirm and Fintech Companies – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Attack Surface Management , Governance & Risk Management , Security Operations Deal Aims to Enhance Internal and External Attack Visibility, Security Efficiency Michael Novinson (MichaelNovinson) • July 2, 2024     Rapid7 plans to purchase a   show more ...  

SentinelOne-backed cyber asset attack surface management startup to get better visibility into internal and […] La entrada Rapid7 Purchases Noetic for Better Attack Surface Management – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Rick Bryant Healthcare Chief Technology Officer, Rubrik Rick Bryant is the Healthcare Chief Technical Officer for Rubrik. In this role, he leads initiatives within Rubrik to serve the healthcare information technology industry through technology excellence and process   show more ...  

solutions. Rick has a passion for patient security, privacy, and data driven outcomes. […] La entrada Securing Healthcare: Minimizing Risk in an Ever-Changing Threat Landscape – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Rick Bryant Healthcare Chief Technology Officer, Rubrik Rick Bryant is the Healthcare Chief Technical Officer for Rubrik. In this role, he leads initiatives within Rubrik to serve the healthcare information technology industry through technology excellence and process   show more ...  

solutions. Rick has a passion for patient security, privacy, and data driven outcomes. […] La entrada Securing Healthcare: Minimizing Risk in an Ever-Changing Threat Landscape – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Sam Curry Global VP, CISO – Zscaler Sam Curry has over three decades as an entrepreneur, infosec expert and executive at companies like RSA, Arbor Networks, CA, McAfee, Cybereason, and more. He is dedicated to empowering defenders in cyber conflict and   show more ...  

fulfilling the promise of security, enabling a safe, reliable, […] La entrada How Top Cybersecurity Leaders Predict Threats and Navigate Risk​ – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Sam Curry Global VP, CISO – Zscaler Sam Curry has over three decades as an entrepreneur, infosec expert and executive at companies like RSA, Arbor Networks, CA, McAfee, Cybereason, and more. He is dedicated to empowering defenders in cyber conflict and   show more ...  

fulfilling the promise of security, enabling a safe, reliable, […] La entrada How Top Cybersecurity Leaders Predict Threats and Navigate Risk​ – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-07
Aggregator history
Wednesday, July 03
MON
TUE
WED
THU
FRI
SAT
SUN
JulyAugustSeptember