Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Europol Dismantles M ...

 Cyber News

On December 3rd, 2024, Europol announced that a joint investigation between French and Dutch law enforcement authorities had successfully dismantled an encrypted messaging service used by criminals. The platform, known as MATRIX, had been facilitating various serious crimes, including international drug trafficking,   show more ...  

arms trafficking, and money laundering. The operation, which was coordinated by law enforcement across several European countries, resulted in the seizure of over 40 servers, the arrest of multiple suspects, and the interception of millions of criminal messages. The investigation was a major step forward in combating the use of encrypted platforms for illegal activities. MATRIX: A Sophisticated Criminal Platform MATRIX, a messaging platform made by criminals for criminals, was first discovered on the phone of a convicted criminal involved in the 2021 murder of Dutch investigative journalist Peter R. de Vries. The journalist had gained fame for his work covering unsolved crimes. This discovery led Dutch authorities to initiate an extensive investigation into the platform, which was found to be more complex and sophisticated than other similar platforms such as Sky ECC and EncroChat. Unlike many encrypted communication services, MATRIX requires users to be invited in order to join the platform. It offered a range of encrypted features, including secure messaging, voice and video calls, and even anonymous web browsing. MATRIX also had its own currency system for users to pay for subscriptions, and its platform was primarily used on Google Pixel phones. This level of sophistication and exclusivity made it a popular choice among criminals. The Role of International Cooperation The dismantling of MATRIX highlights the importance of international cooperation in the fight against organized crime. Authorities from France, the Netherlands, Germany, Italy, Lithuania, and Spain worked together as part of a joint investigation team (JIT) coordinated through Eurojust. This cross-border collaboration allowed law enforcement agencies to exchange vital information and swiftly take coordinated action. For three months, investigators monitored activity on the platform, deciphering over 2.3 million messages in 33 different languages. The intercepted communications provided valuable intelligence, linking MATRIX users to various criminal activities. These included international drug smuggling, arms deals, and large-scale money laundering schemes. On December 3rd, the operation led to the takedown of the platform’s servers located across France and Germany. Additionally, authorities conducted raids in multiple countries, arresting three individuals. One suspect, identified as the suspected owner and operator of MATRIX, a 52-year-old Lithuanian national, was apprehended in Spain. He had been working closely with a 30-year-old man from the Netherlands to run the platform. Significant Seizures and Evidence During the raids, police seized €145,000 ($152,000) in cash and approximately €500,000 ($527,000) in cryptocurrencies. Authorities also confiscated four vehicles, more than 970 mobile phones, and other equipment. The evidence collected during the operation will be crucial in ongoing investigations into the criminals who used MATRIX to facilitate illegal activities. In addition to the physical evidence, the seizure of the platform’s servers provided law enforcement with a significant opportunity to collect data related to the communications and transactions conducted via MATRIX. A splash page now appears on the platform’s website, alerting users that their messages were intercepted by authorities. The page includes a warning: “It’s not the first time and will not be the last time we are able to read the messages in real time." Law Enforcement Involved The dismantling of MATRIX involved the coordinated efforts of several European law enforcement agencies, including: France: JUNALCO National Jurisdiction against Organised Crime; OFAC National Police Cybercrime Division Netherlands: Team High Tech Crime of the National Investigations; Special Operations (NIS) of the Netherlands Police; Netherlands Public Prosecution Service Germany: Frankfurt am Main Public Prosecutor General's Office – ZIT; German Federal Criminal Police, Serious and Organised Crime Division Italy: National Antimafia Directorate (D.N.A.); Central Directorate for Anti-Drug Services (D.C.S.A.) Lithuania: Prosecutor General’s Office; Lithuanian Criminal Police Bureau Spain: Central Investigative Court 1 and 5 of Audiencia Nacional; Spanish National Police The operation was also supported by Europol’s Operational Task Force, which was established to monitor criminal activity on encrypted platforms like MATRIX. The task force played a crucial role in providing technical and operational support during the investigation. An Evolving Cybersecurity Landscape The takedown of MATRIX adds to a growing list of encrypted criminal communication platforms that have been disrupted in recent years. Prior to MATRIX, law enforcement successfully dismantled Sky ECC and EncroChat, two other popular platforms used by cybercriminals. These operations have demonstrated the ability of law enforcement agencies to infiltrate and shut down encrypted communication services that criminals rely on to carry out illegal activities. However, as criminals adapt to the disruption of their communication tools, law enforcement faces an increasingly fragmented landscape. Criminals have turned to less-established or custom-built encrypted platforms, which offer varying levels of security and anonymity. Despite this challenge, the successful takedown of MATRIX sends a strong message that authorities are constantly evolving their tactics to stay ahead of cybercriminals.

image for Telecoms on High Ale ...

 Cyber News

The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and their international partners have released a comprehensive set of guidelines aimed at enhancing the security of telecommunications infrastructure. The joint publication,   show more ...  

titled Enhanced Visibility and Hardening Guidance for Communications Infrastructure, offers critical advice to network engineers and defenders tasked with protecting global communications networks from advanced persistent threats (APTs) tied to the People’s Republic of China (PRC). The Cyber Espionage Threat The new guidance comes in the wake of warnings issued by CISA and the FBI about an ongoing, broad cyber espionage campaign conducted by PRC-affiliated threat actors. These cybercriminals have successfully infiltrated the networks of major telecommunications providers worldwide, compromising sensitive data and potentially jeopardizing national security, critical infrastructure, and private businesses. The objective of the campaign, as detailed by officials, is to extract valuable information for intelligence-gathering purposes. Jeff Greene, Executive Assistant Director for Cybersecurity at CISA, emphasized the seriousness of the threat: “The PRC-affiliated cyber activity poses a serious threat to critical infrastructure, government agencies, and businesses. This guide will help telecommunications and other organizations detect and prevent compromises by the PRC and other cyber actors.” A Call to Action for Network Defenders The newly released guide outlines a series of best practices designed to help organizations strengthen their networks against cyber threats. While tailored primarily for the telecommunications sector, these recommendations are applicable to any organization operating critical infrastructure, including businesses with on-premises enterprise equipment. One of the central themes of the guidance is the importance of enhancing visibility within networks. This refers to the ability of network defenders to detect and analyze activity across their systems, including network traffic, user behaviors, and data flows. High visibility ensures that potential threats can be quickly identified and mitigated before they lead to serious breaches. Strengthening Visibility in Communications Infrastructure To improve visibility, CISA and the FBI recommend that network engineers implement strong monitoring systems and processes to detect anomalous behaviors or unauthorized changes in network configurations. These recommendations include: Monitoring Configuration Changes: Network engineers are advised to closely track changes to critical network devices like routers, firewalls, and switches, especially those that occur outside of established change management protocols. Unusual alterations, such as unauthorized route updates or the activation of weak protocols, should trigger alerts for immediate investigation. Centralized Configuration Management: Storing device configurations centrally, instead of relying on the devices themselves, helps ensure a single, trusted source of truth for network settings. Frequent testing and validation of configurations are also encouraged to ensure they remain secure and effective. Monitoring User and Service Accounts: Suspicious logins, particularly those from unknown or unexpected sources, should be closely monitored. It's also important to regularly review and disable inactive accounts to reduce the attack surface. Secure Logging and Data Analysis: Implementing centralized logging, where log data is securely stored and can be easily analyzed, helps identify security incidents faster. Encrypted log transmission is essential to prevent tampering or interception. By improving network visibility, defenders can identify threats early in their lifecycle and respond to them more effectively, reducing the risk of a successful compromise. Hardening Systems and Devices Alongside increasing visibility, the guide stresses the importance of hardening network systems and devices. This means reducing vulnerabilities through secure configuration practices and implementing defense-in-depth strategies that limit potential entry points for cyber actors. Key recommendations for hardening devices include: Out-of-Band Management: Network engineers should manage devices through a physically separate management network, isolated from the operational data flow. This limits the potential for lateral movement by attackers in case of a compromised device. Strict Access Controls: Implementing default-deny access control lists (ACLs) and network segmentation can block unauthorized traffic and isolate critical systems. Devices with sensitive functions, such as DNS servers or email servers, should be placed in a demilitarized zone (DMZ) to further reduce the risk of exposure. Use of Strong Encryption: Strong encryption practices should be employed across all traffic, particularly for VPNs and remote management tools. Vulnerabilities in outdated encryption protocols should be mitigated by using the latest cryptographic standards, such as AES-256 and TLS 1.3. Disabling Unnecessary Services: Services like Telnet, FTP, and older versions of SSH should be disabled, as they are often targeted by attackers looking for weak entry points into the network. Regular Updates and Patching: It is essential to keep all devices and software up-to-date with the latest security patches. Additionally, network defenders should regularly monitor vendor announcements for end-of-life (EOL) notifications and upgrade equipment accordingly. By hardening network devices and systems, organizations can make it significantly more difficult for threat actors to exploit vulnerabilities and gain unauthorized access to critical networks. CISA, NSA, and FBI: A Unified Effort to Safeguard Critical Infrastructure In conclusion, the cybersecurity agencies behind the guide—CISA, NSA, and FBI—are urging all organizations, especially those involved in critical infrastructure, to adopt these best practices. As Jeff Greene highlighted, it is crucial for software manufacturers to integrate Secure by Design principles into their development processes to ensure that future vulnerabilities are minimized. Bryan Vorndran, Assistant Director of the FBI’s Cyber Division, also stressed the importance of collaborative action: “Together with our interagency partners, the FBI issued guidance to enhance the visibility of network defenders and to harden devices against PRC exploitation.” Ultimately, this guidance not only aims to defend against PRC-affiliated actors but also to enhance the overall security posture of telecommunications infrastructure and other critical sectors. By implementing these measures, network defenders can better prepare for and respond to evolving cyber threats, helping to protect sensitive data and maintain the integrity of essential services.

image for Save Big This Season ...

 Features

Black Friday is the best, right? Well, sometimes. Deals everywhere, and chaos too. I’ve had moments feeling so lost in the sea of discounts it almost made me give up shopping altogether. But over the years, I’ve learned a few tricks. Here’s how I handle it, step by step—no fluff, just what works. From figuring   show more ...  

out what I want in advance to using apps that do the heavy lifting, these tips can help make Black Friday more about saving than stressing. 1. Start with Research Before I even think about shopping, I get organized. Not too much work, but enough to save headaches later. I jot down exactly what I want: brands, sizes, model numbers, and all that. Last year, I skipped this and wasted hours online. Learned my lesson. Now, I look at online reviews, compare specs, and even save product links on my phone. Honestly, the key is knowing what to expect price-wise. Retailers are sneaky. “50% off” isn’t a deal if they jacked up prices last month. I bookmark price trackers and keep an eye out for weeks before the sales start. Apps like Honey or CamelCamelCamel are game-changers. 2. Subscribe to Newsletters (Yes, Really) Some people hate spam. Me? I use it. Signing up for store emails means you hear about discounts first. I don’t check them daily, but during the Black Friday season, those emails are pure gold. Some stores send early access links to deals. I got my headphones that way last year—saved $70 before most people even knew they were discounted. A quick tip: turn on app notifications for stores like Target or Amazon. I used to hate push alerts, but now they let me catch limited-time offers I’d otherwise miss. Life’s too short to be refreshing pages all day. 3. The Coupons App Is a Lifesaver Ever heard of The Coupons App? It’s fantastic. I downloaded it when a friend wouldn’t stop talking about it, and wow. It doesn’t just find promo codes—it applies them to you. It’s like magic. I’ve even snagged freebies nearby, like a free coffee once. The app also tracks price drops. That’s how I got a laptop at $150 off without stalking sales all month. No app is perfect, though. Sometimes, codes don’t work, or deals are region-specific. But on the whole, it’s a superb choice. Little savings add up over time. 4. Loyalty Programs Pay Off I used to ignore loyalty cards, thinking they weren’t worth it. Big mistake. Stores like Old Navy or Macy’s give members discounts others don’t get. A lot of them let you earn points too, which can translate to free money later. I’ve scored free shirts and even got a $20 store credit once—just for shopping during Black Friday. 5. Price Comparison: The Secret Weapon Impulse buys are tempting, but not every sale is as good as it looks. I use apps like Google Price Scanner to compare prices. It’s quick and makes me feel like I’m not being ripped off. Did you know some stores price-match too? Best Buy does, but only if you ask. I’ve walked up to customer service and gotten refunds on price differences just because I checked. One more thing: don’t stop comparing prices after Black Friday. Cyber Monday often has better deals on tech. Missed the sale? No worries, because stores tend to extend discounts all weekend. 6. Understand Return Policies Returns can save you big time. Keep every receipt, digital or paper. Why? If a price drops after you buy something, you can sometimes get a refund for the difference. I’ve done this at Target and even Walmart. Some stores give you until January to return items bought during holiday sales. It’s like a safety net. If I find something cheaper later, I’ll just return the pricier version. One little hack: buy the lower-priced item and return the expensive one. A bit tedious but totally worth it for bigger savings. 7. Stick to Online Shopping Shopping in-store is rarely worth it anymore. I’ve skipped the crowds the past few years and don’t regret it. Online, I can compare deals from my couch—no lines, no pushing, no stress. Sites even offer web-exclusive sales that beat in-store prices. Just don’t forget to double-check shipping deadlines. Missed packages are the worst. 8. Timing Is Everything Not every deal drops on Black Friday. Some stores start sales early—like mid-November. If I spot a decent price a week before, I’ll buy it. Why risk waiting for a better deal when I might lose out completely? Also, don’t sleep on Wednesday before Black Friday. Weird, but true: it’s often quieter and less competitive. 9. Doorbusters: Worth It? Let me be real: I’m over doorbusters. Camping out all night for one TV? Not my vibe. But if you do go in person, get there at dawn—or earlier. The crowds aren’t as crazy as they used to be, but the best deals still vanish fast. Once, I tried going mid-morning, and half the stock was gone. Never again. 10. Don’t Forget Gift Cards If you have unused gift cards lying around, now’s the time to use them. I’ve bought discounted cards from websites and used them during sales for extra savings. Think about it: buying $50 worth of stuff but only paying $40 because of a gift card? Feels like winning twice. 11. Have Fun, But Set Limits Black Friday is electrifying, but it’s easy to splurge. I always set a budget now. Not just for big purchases, but for everything. Snacks, small gifts, stocking stuffers—it all adds up. The goal is to save money, not blow it. Black Friday doesn’t have to be stressful. Do a little prep, use the right tools, and focus on what you need, not just what’s cheap. That’s how I make it through without feeling overwhelmed—or broke.

image for From Phishing to Pas ...

 Firewall Daily

Azercell, the leading mobile operator in Azerbaijan, is offering cybersecurity training to its customers, particularly the elderly. As part of its ongoing efforts, Azercell cybersecurity training for residents of a social service institution for the elderly. The training aimed to equip this senior generation with the   show more ...  

knowledge and tools necessary to understand digital life and how to protect themselves.   The Azercell cybersecurity training was conducted by experts from Azercell's Information Security Department. The training sessions focused on educating the participants about the growing threat of cyber fraud, phishing attacks, and the various methods online fraudsters use to deceive and exploit individuals. As part of the program, attendees were taught practical strategies for protecting their personal data, raising awareness about the importance of being cautious while engaging in online activities.  Key Highlights of the Azercell Cybersecurity Training One of the key elements of the "Azercell security training" was its focus on real-world scenarios, helping the elderly participants identify common online scams and cyber threats. The training also covered modern cyber-attack methods, ensuring that the senior citizens could recognize and avoid potential dangers in their digital interactions. The importance of strong passwords, the risks of sharing sensitive information on social media, and how to verify the authenticity of emails and websites were among the critical topics addressed during the session.  An imporant part of the training program was dedicated to an interactive Q&A session, where attendees had the opportunity to ask specific questions and receive personalized advice on their concerns. This segment allowed the elderly participants to clarify doubts, ensuring that they left the session feeling more confident in their ability to protect themselves online.  In addition to the informative training, Azercell volunteers, known as "Azercell Könüllüləri," participated actively in the event. The volunteers engaged with the attendees, offering additional support and distributing thoughtful gifts to the participants. This added a personal touch to the event, making it not only educational but also enjoyable for the elderly citizens.  Azercell’s initiative is part of the company’s broader efforts to promote digital literacy across various demographics, with a special focus on vulnerable groups such as the elderly. By organizing these "Azercell training for cybersecurity" sessions, the company is working towards building a safer and more informed digital community. These initiatives reflect Azercell’s responsibility to protect its customers and contribute to a safer online environment for everyone, regardless of their age or technological experience.   CISA’s Cybersecurity Training for Diverse Groups  In a similar vein, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also launched initiatives aimed at enhancing cybersecurity training for diverse groups. CISA's new learning platform, CISA Learning, provides free online courses to federal employees, contractors, military personnel, and the general public, emphasizing topics such as ethical hacking, cloud security, and malware analysis.   Empowering individuals with the knowledge to defend themselves against cyber-attacks is a vital step in reducing the overall risk of digital exploitation. Likewise, CISA's expanded training programs aim to equip individuals with the skills to recognize and mitigate cyber risks, ensuring they are prepared to tackle a wide array of online threats.   Through programs like these, Azercell is helping ensure that senior citizens are not left behind in the digital age. With more people relying on online services for everything from communication to banking, understanding the potential dangers of the internet is crucial.   The training offered by Azercell is designed to be both accessible and relevant, addressing the unique challenges faced by older adults when interacting with technology. In parallel, CISA’s platform allows learners of all levels, from beginners to advanced, to gain critical skills in various cybersecurity domains, ensuring that everyone, regardless of their background, has access to the tools they need to stay safe online.  

image for U.S. Offered $10M fo ...

 Ne'er-Do-Well News

In January 2022, KrebsOnSecurity identified a Russian man named Mikhail Matveev as “Wazawaka,” a cybercriminal who was deeply involved in the formation and operation of multiple ransomware groups. The U.S. government indicted Matveev as a top ransomware purveyor a year later, offering $10 million for   show more ...  

information leading to his arrest. Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies. An FBI wanted poster for Matveev. Matveev, a.k.a. “Wazawaka” and “Boriselcin” worked with at least three different ransomware gangs that extorted hundreds of millions of dollars from companies, schools, hospitals and government agencies, U.S. prosecutors allege. Russia’s interior ministry last week issued a statement saying a 32-year-old hacker had been charged with violating domestic laws against the creation and use of malicious software. The announcement didn’t name the accused, but the Russian state news agency RIA Novosti cited anonymous sources saying the man detained is Matveev. Matveev did not respond to requests for comment. Daryna Antoniuk at TheRecord reports that a security researcher said on Sunday they had contacted Wazawaka, who confirmed being charged and said he’d paid two fines, had his cryptocurrency confiscated, and is currently out on bail pending trial. Matveev’s hacker identities were remarkably open and talkative on numerous cybercrime forums. Shortly after being identified as Wazawaka by KrebsOnSecurity in 2022, Matveev published multiple selfie videos on Twitter/X where he acknowledged using the Wazawaka moniker and mentioned several security researchers by name (including this author). More recently, Matveev’s X profile (@ransomboris) posted a picture of a t-shirt that features the U.S. government’s “Wanted” poster for him. An image tweeted by Matveev showing the Justice Department’s wanted poster for him on a t-shirt. image: x.com/vxunderground The golden rule of cybercrime in Russia has always been that as long as you never hack, extort or steal from Russian citizens or companies, you have little to fear of arrest. Wazawaka claimed he zealously adhered to this rule as a personal and professional mantra. “Don’t shit where you live, travel local, and don’t go abroad,” Wazawaka wrote in January 2021 on the Russian-language cybercrime forum Exploit. “Mother Russia will help you. Love your country, and you will always get away with everything.” Still, Wazawaka may not have always stuck to that rule. At several points throughout his career, Wazawaka claimed he made good money stealing accounts from drug dealers on darknet narcotics bazaars. Cyber intelligence firm Intel 471 said Matveev’s arrest raises more questions than answers, and that Russia’s motivation here likely goes beyond what’s happening on the surface. “It’s possible this is a shakedown by Kaliningrad authorities of a local internet thug who has tens of millions of dollars in cryptocurrency,” Intel 471 wrote in an analysis published Dec. 2. “The country’s ingrained, institutional corruption dictates that if dues aren’t paid, trouble will come knocking. But it’s usually a problem money can fix. Intel 471 says while Russia’s court system is opaque, Matveev will likely be open about the proceedings, particularly if he pays a toll and is granted passage to continue his destructive actions. “Unfortunately, none of this would mark meaningful progress against ransomware,” they concluded. Although Russia traditionally hasn’t put a lot of effort into going after cybercriminals within its borders, it has brought a series of charges against alleged ransomware actors this year. In January, four men tied to the REvil ransomware group were sentenced to lengthy prison terms. The men were among 14 suspected REvil members rounded up by Russia in the weeks before Russia invaded Ukraine in 2022. Earlier this year, Russian authorities arrested at least two men for allegedly operating the short-lived Sugarlocker ransomware program in 2021. Aleksandr Ermakov and Mikhail Shefel (now legally Mikhail Lenin) ran a security consulting business called Shtazi-IT. Shortly before his arrest, Ermakov became the first ever cybercriminal sanctioned by Australia, which alleged he stole and leaked data on nearly 10 million customers of the Australian health giant Medibank. In December 2023, KrebsOnSecurity identified Lenin as “Rescator,” the nickname used by the cybercriminal responsible for selling more than 100 million payment cards stolen from customers of Target and Home Depot in 2013 and 2014. Last month, Shefel admitted in an interview with KrebsOnSecurity that he was Rescator, and claimed his arrest in the Sugarlocker case was payback for reporting the son of his former boss to the police. Ermakov was sentenced to two years probation. But on the same day my interview with Lenin was published here, a Moscow court declared him insane, and ordered him to undergo compulsory medical treatment, The Record’s Antoniuk notes.

 Feed

A joint advisory issued by Australia, Canada, New Zealand, and the U.S. has warned of a broad cyber espionage campaign undertaken by People's Republic of China (PRC)-affiliated threat actors targeting telecommunications providers. "Identified exploitations or compromises associated with these threat actors' activity align with existing weaknesses associated with victim infrastructure; no novel

 Feed

Veeam has released security updates to address a critical flaw impacting Service Provider Console (VSPC) that could pave the way for remote code execution on susceptible instances. The vulnerability, tracked as CVE-2024-42448, carries a CVSS score of 9.9 out of a maximum of 10.0. The company noted that the bug was identified during internal testing. "From the VSPC management agent machine, under

 Feed

A critical security vulnerability has been disclosed in SailPoint's IdentityIQ identity and access management (IAM) software that allows unauthorized access to content stored within the application directory. The flaw, tracked as CVE-2024-10905, has a CVSS score of 10.0, indicating maximum severity. It affects IdentityIQ versions 8.2. 8.3, 8.4, and other previous versions. IdentityIQ "allows

 Feed

Cybersecurity researchers have called attention to a novel phishing campaign that leverages corrupted Microsoft Office documents and ZIP archives as a way to bypass email defenses. "The ongoing attack evades #antivirus software, prevents uploads to sandboxes, and bypasses Outlook's spam filters, allowing the malicious emails to reach your inbox," ANY.RUN said in a series of posts on X. The

 Feed

Many organizations struggle with password policies that look strong on paper but fail in practice because they're too rigid to follow, too vague to enforce, or disconnected from real security needs. Some are so tedious and complex that employees post passwords on sticky notes under keyboards, monitors, or desk drawers. Others set rules so loose they may as well not exist. And many simply copy

 Feed

Cybersecurity researchers are alerting to a software supply chain attack targeting the popular @solana/web3.js npm library that involved pushing two malicious versions capable of harvesting users' private keys with an aim to drain their cryptocurrency wallets. The attack has been detected in versions 1.95.6 and 1.95.7. Both these versions are no longer available for download from the npm

 Feed

Europol on Tuesday announced the takedown of an invite-only encrypted messaging service called MATRIX that's created by criminals for criminal purposes. The joint operation, conducted by French and Dutch authorities under the moniker Passionflower, comes in the aftermath of an investigation that was launched in 2021 after the messaging service was discovered on the phone of a criminal convicted

 Feed

Are you using the cloud or thinking about transitioning? Undoubtedly, multi-cloud and hybrid environments offer numerous benefits for organizations. However, the cloud's flexibility, scalability, and efficiency come with significant risk — an expanded attack surface. The decentralization that comes with utilizing multi-cloud environments can also lead to limited visibility into user activity and

 Feed

The Russia-linked advanced persistent threat (APT) group known as Turla has been linked to a previously undocumented campaign that involved infiltrating the command-and-control (C2) servers of a Pakistan-based hacking group named Storm-0156 to conduct its own operations since 2022. The activity, first observed in December 2022, is the latest instance of the nation-state adversary "embedding

 Guest blog

Stoli Group USA, the US subsidiary of vodka maker Stoli, has filed for bankruptcy – and a ransomware attack is at least partly to blame. The American branch of Stoli, which imports and distributes Stoli brands in the United States, as well as the Kentucky Owl bourbon brand it purchased in 2017, was hit by a ransomware attack in August 2024. Learn more in my article on the Exponential-e blog.

 Blog

Source: socprime.com – Author: Veronika Telychko The nefarious SmokeLoader malware resurfaces in the cyber threat arena targeting Taiwanese companies in multiple industry sectors, including manufacturing, healthcare, and IT. Typically used as a downloader for deploying other malicious samples, in the latest   show more ...  

attack campaign, SmokeLoader executes the attack directly by retrieving plugins from its C2 server. […] La entrada SmokeLoader Malware Detection: Notorious Loader Reemerges to Target Companies in Taiwan – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blog

Source: socprime.com – Author: Oleh P. WRITTEN BY Oleh P. SOC Engineer [post-views] December 03, 2024 · 2 min read Let’s see how to use a custom script to trigger an action if a service has restarted or if there are other problems in Monit – utility for monitoring services on a Unix system.  1) […]   show more ...  

La entrada Using a Custom Script to Trigger an Action in Monit – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: socprime.com – Author: Oleksandr L [post-views] December 03, 2024 · 3 min read When processing event streams with Logstash, you may encounter a need to calculate the duration of a session — the difference between its start and end times. This is a common scenario when analyzing time-sensitive data.   show more ...  

Logstash provides the flexibility to perform […] La entrada Calculating Session Duration in Logstash Using Ruby – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 aws

Source: socprime.com – Author: Comrade H. WRITTEN BY Comrade H. WAF Engineer [post-views] December 03, 2024 · 1 min read Steps to Override Rule Actions Access the Web ACL: Navigate to the Rules tab of the web ACL page. Select the rule group and click Edit. 2. Manage Rule Actions: All Rules: Open   show more ...  

the Override all rule actions dropdown. Select […] La entrada AWS WAF: Overriding Rule Actions in a Rule Group – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 ArcSight

Source: socprime.com – Author: Oleksandr L [post-views] December 03, 2024 · 2 min read To update the GeoLite2 database in your ArcSight Manager environment, follow these steps: 1. Register on the MaxMind Portal Visit the MaxMind Portal and log into your account. If you don’t have an account, register for   show more ...  

one. 2. Download the GeoLite2 Database Once […] La entrada How to Update GeoLite2 Database in ArcSight Manager – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: news.sophos.com – Author: rajansanhotra PRODUCTS & SERVICES Sophos is the only vendor named a Customers’ Choice across Endpoint Protection Platforms, Network Firewalls, and Managed Detection and Response For most organizations, the complexity and cost of recruiting, training, and retaining a   show more ...  

highly skilled team of security operations analysts is a significant challenge. The reality of […] La entrada Sophos named a Gartner® Peer Insights™ Customers’ Choice for Managed Detection and Response (MDR) Services for the 2nd time – Source: news.sophos.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. After the success of the inaugural Ambassador World Cup (AWC) in 2022, the 2nd edition of the AWC kicks off today, March 13, 2023. The Ambassador World Cup 2023 is an eight-month-long, competition-driven way to build community engagement, collaboration, and   show more ...  

ambassador brand awareness throughout the hacker community. The AWC, led […] La entrada Welcome to the HackerOne Ambassador World Cup 2023! – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. samux creates a place for new hackers to find community in Chile What made you want to become an ambassador? I wanted to become an ambassador mainly because I wished to create a community to exchange information to help others enter the bug bounty space. The   show more ...  

Chilean community is full […] La entrada Ambassador Spotlight: samux – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. HackerOne Live Hacking Events are back! We wrapped a tremendous year of events for 2022 where we saw some amazing success. Some of the most notable: Six customers partnered with us across five live hacking events! $4.9M+ in bounties rewarded 311 hackers   show more ...  

participated We got to reconnect with many old […] La entrada Get Invited: How Live Hacking Event Invites Have Changed – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. Faye Francy is executive director of Auto-ISAC, an industry-operated organization created to enhance cybersecurity awareness and collaboration across the global automotive industry. Their members include light- and heavy-duty vehicle manufacturers and also extend   show more ...  

to suppliers and commercial vehicle manufacturers. ISAC stands for “Information Sharing and Analysis Center,” and the concept […] La entrada Q&A with Faye Francy: How Auto-ISAC Puts Security in the Driver’s Seat – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. Remonsec shares the most recent event put on by Bug Bounty Community Bangladesh. Check out how HackerOne Ambassadors are supporting global events. First, a shout-out to the winners at Bug Hunt! Congratulations are in order for these dedicated hackers: 1st:   show more ...  

n1ghtmar3_24212nd: Osrafi3rd: 0x_saikat What is Bug Hunt? This is a […] La entrada HackerOne was Proud to Sponsor Bug Hunt! – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: Will Kapcio. A well-designed and purposefully run bug bounty program with stakeholder buy-in can have a tremendous impact on an organization’s attack resistance. However, just like any tool within your security stack, bug bounty programs require a level of investment   show more ...  

and mutual buy-in upfront to ensure that your business retains optimal […] La entrada Level Up Your Bug Bounty Effectiveness: 3 Keys to Launch a Successful Program – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. The Belgian government has recently announced a new Belgian law that will allow ethical hackers to hack any Belgian company without any prior permission. Historically, ethical hacking codes of conduct state that a hacker must have prior permission to hack an   show more ...  

organization. Organizations make it easy for hackers to share […] La entrada What Does Belgium’s New Legal Framework On Hacking Mean For Me? – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: ktansley@hackerone.com. Seven years of bug bounty, 21-hour average time to bounty, 130 hackers thanked, and hackers on both sides of the program: Robinhood’s Ian Carroll joins us to discuss his hacker-focused approach to bug bounty, and Robinhood’s top hacker @ashwarya   show more ...  

chimes in with his experience. Our conversation with Ian Carroll (Staff […] La entrada Robinhood Goes Long on Bug Bounty: Q&A with Ian Carroll and @ashwarya – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. I was always intrigued about how things work on the other side of bug bounty. Well, the month of June, 22 made that possible for me when I started my day one as a Product Security Analyst with HackerOne. Now, I am on the flip side triaging your reports. During my   show more ...  

initial […] La entrada The View from the Other Side: A Security Analyst’s Perspective on Bug Bounty Triage – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: Naz Bozdemir. Over the last decade, many organizations have seen their attack surface soar out of control. Digital transformation initiatives, cloud migrations, and increased uptake of user-centric technology architectures have led to huge growth in Internet-accessible assets.   show more ...  

At the same time, the number of CVEs reported annually has risen substantially. As […] La entrada Outsmart Cybercriminals with Proactive Attack Surface Management (ASM) – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jennifer Lawinski Source: Andrey Suslov via Alamy Stock Photo NEWS BRIEF In an effort to convince consumers that it’s safe to answer their phones, root of trust provider SecureG has partnered with CTIA, a trade association that represents the wireless communications   show more ...  

industry, on an initiative intended to deliver a secure branded […] La entrada SecureG, CTIA Project Secures Business Phone Calls – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer Source: ArtemisDiana via Shutterstock Many organizations using Web application firewall (WAF) services from content delivery network (CDN) providers may be inadvertently leaving their back-end servers open to direct attacks over the Internet   show more ...  

because of a common configuration error. The problem is so pervasive that it affects nearly […] La entrada Misconfigured WAFs Heighten DoS, Breach Risks – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 budget

Source: www.csoonline.com – Author: News 04 Dec 20243 mins BudgetData BreachSecurity The rising practice of shaking down customers to pay for security shortfalls could have a silver lining for CISOs, as diluted price competitiveness could convince top brass of the ROI of cybersecurity investments. Consumers may   show more ...  

be more on the hook for paying for the […] La entrada 63% of companies plan to pass data breach costs to customers – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Careers

Source: www.csoonline.com – Author: Neurodiverse professionals’ strengths include creativity, attention to detail, hyper-focus and innovative problem-solving, skills highly sought in cybersecurity. In cybersecurity, diverse perspectives help in addressing complex, emerging threats. Increasingly, there’s a   show more ...  

push to recognize that neurodiversity brings significant value to cybersecurity. However, neurodiverse people frequently face systemic barriers that hinder their success […] La entrada Talent overlooked: embracing neurodiversity in cybersecurity – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: News 04 Dezember 20243 Minuten Cyberkriminalität Nach jahrelangen Ermittlungen haben die Behörden eine der größten deutschsprachigen Cybercrime-Plattformen zerschlagen. “Crimenetwork” war für die Betreiber über Jahre ein einträgliches Geschäft. Die finale   show more ...  

Abrechnung übernehmen nun die Strafverfolgungsbehörden. Zubkov Igor | shutterstock.com Wie das Bundeskriminalamt in einer Pressemitteilung erklärt, haben Ermittler (unter anderem) in […] La entrada “Crimenetwork” ausgehoben – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: www.csoonline.com – Author: Analyse 03 Dezember 20246 Minuten Business OperationsRisikomanagement Wenn CISOs an ihre Vorgesetzten reporten, sollten daraus sinnvolle und umsetzbare Maßnahmen erwachsen können. Cybersicherheit zu messen, ist kein Kinderspiel. Foto: Ultraskrip – shutterstock.com Eine   show more ...  

wichtige Säule jedes ausgereiften Cyberrisk-Programms ist die Fähigkeit, die Performance der IT-Security und registrierte Bedrohungen zu messen, zu analysieren […] La entrada Security-KPIs und -KRIs: So messen Sie Cybersicherheit – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: In 2024, BlackBerry unveiled new proprietary research, underscoring the vulnerability of software supply chains in Malaysia and around the world. According to the study, 79% of Malaysian organizations reported cyberattacks or vulnerabilities in their software supply chains   show more ...  

during the past 12 months, slightly exceeding the global average of 76%. Alarmingly, 81% […] La entrada BlackBerry Highlights Rising Software Supply Chain Risks in Malaysia – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: News 03 Dec 20246 mins SecurityThreat and Vulnerability ManagementVulnerabilities While not production-ready malware, ‘Bootkitty’ provides a proof of concept for exploiting Linux systems at boot-up — widening the UEFI attack path beyond the Windows ecosystem. Bootkitty,   show more ...  

a recently discovered boot-level UEFI rootkit for Linux, was evidently created by students participating in […] La entrada First-ever Linux UEFI bootkit turns out to be student project – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Zunächst hat Medion einen Cyberangriff als Ursache für den IT-Ausfall genannt. Mittlerweile spricht das Unternehmen “nur” noch von einer IT-Störung. OleksandrShnuryk – Shutterstock.com Der Elektronik-Anbieter Medion hat seine Kunden kürzlich auf eine IT-Störungen   show more ...  

hingewiesen, die sowohl interne Systeme als auch den Online-Shop betreffen. „Aufgrund der aktuellen Situation sind wir telefonisch nur […] La entrada Möglicher Cyberangriff: IT-Ausfall bei Medion – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Aleksandr Ermakov

Source: krebsonsecurity.com – Author: BrianKrebs In January 2022, KrebsOnSecurity identified a Russian man named Mikhail Matveev as “Wazawaka,” a cybercriminal who was deeply involved in the formation and operation of multiple ransomware groups. The U.S. government indicted Matveev as a top ransomware   show more ...  

purveyor a year later, offering $10 million for information leading to his arrest. […] La entrada U.S. Offered $10M for Hacker Just Arrested by Russia – Source: krebsonsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. Curious about a lightweight Burp alternative? Check out what H1 hacker Corb3nik is cooking up. So, who is Corb3nik? My name is Ian, also known as Corb3nik on social media. I’m a long time CTF enthusiast and bug bounty hunter. Currently, I’m the co-founder for a   show more ...  

web security toolkit called […] La entrada Corb3nik Introduces His Tool: Caido – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: Chris Evans. When I joined HackerOne last year, the vitality of the hacker community drew me to this organization. And as Chief Hacking Officer, I see the impact this community makes daily. Together, we’ve identified nearly 300,000 vulnerabilities through our programs —   show more ...  

300,000 fewer ways cybercriminals can harm society. That’s why […] La entrada A Thank You to the Hacker Community, From HackerOne – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. TikTok, a social media giant with more than 1 billion active monthly users, understands the importance of a global community, be that community TikTokers or ethical hackers!  In 2020, TikTok launched its public bug bounty program on HackerOne. In the two years   show more ...  

since, they’ve taken many steps to build a […] La entrada TikTok Celebrates Two Years of Bug Bounty – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. October is Cybersecurity Awareness Month, but at HackerOne, we’ve decided it should be Hacker Awareness Month. We want to spend October celebrating the individuals that drive our platform — you. The effort put forth by a global community of hackers is no longer   show more ...  

something left for movies. You all really […] La entrada Let’s Celebrate the Hacker Community – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: elizabeth@hackerone.com. On July 4th, 2022, Chief Digital and Artificial Intelligence Office (CDAO), Directorate for Digital Services (DDS), DoD Cyber Crime Center (DC3), and HackerOne publicly launched the “Hack U.S.” bug bounty challenge, allowing ethical hackers from   show more ...  

around the globe to earn monetary rewards for reporting of critical and high vulnerabilities from […] La entrada Announcing the Results of Hack U.S. – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: Sean Ryan. Large enterprises and advanced digital organizations that need to orchestrate multiple pentests per year to keep pace with dynamic business will find tremendous value in the enhancements to HackerOne’s pentest as a service capabilities. New capabilities improve   show more ...  

pentesting to increase attack resistance The enhanced features drive robust security testing […] La entrada Use Hackerone’s Enhanced Pentest as a Service to Streamline Security Testing – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-12
Aggregator history
Wednesday, December 04
SUN
MON
TUE
WED
THU
FRI
SAT
DecemberJanuaryFebruary