Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Critical Veeam Vulne ...

 Vulnerabilities

Veeam has published a critical advisory regarding severe vulnerabilities affecting its Veeam Service Provider Console (VSPC), particularly impacting version 8.1.0.21377 and earlier builds from version 7.   These Veeam vulnerabilities, identified as CVE-2024-42448 and CVE-2024-42449, expose service providers to online   show more ...  

security risks. These vulnerabilities in Veeam are especially concerning due to their potential to compromise system integrity, data confidentiality, and network security.  Overview of the Veeam Vulnerabilities  The Veeam vulnerabilities, disclosed as part of Veeam’s December 2024 updates, have been classified with high severity levels, with CVE-2024-42448 rated as critical, and CVE-2024-42449 deemed high in severity.   Both vulnerabilities exist due to flaws within the Veeam Service Provider Console 8.1 and affect all builds of version 8.1 and prior, including earlier builds from version 7.   These vulnerabilities impact the management agent machines authorized on the VSPC server, which means that an attacker with control over a management agent could exploit these vulnerabilities to access or manipulate the server.  CVE-2024-42448: Remote Code Execution (RCE)  The first Veeam vulnerability, CVE-2024-42448, allows for Remote Code Execution (RCE). This occurs when an attacker gains access to a VSPC management agent machine that is authorized on the server. Once this condition is met, an attacker can execute arbitrary code remotely on the VSPC server machine.   This critical flaw has been assigned a CVSS v3.1 score of 9.9—the highest possible severity rating—due to its potential to completely compromise a system. Internal testing discovered this flaw, highlighting the risk that it poses to organizations relying on the Veeam Service Provider Console for backup management.  CVE-2024-42449: NTLM Hash Leak and File Deletion  CVE-2024-42449 presents another serious security risk, allowing attackers to exploit the management agent machine to leak an NTLM hash of the VSPC server’s service account. Additionally, this vulnerability allows attackers to delete files on the VSPC server machine.  Although not as severe as RCE, this flaw still represents a high risk, with a CVSS v3.1 score of 7.1. By gaining access to NTLM hashes, attackers could potentially escalate their privileges within the system, leading to further data breaches or malicious actions.  Updates and Patches  Veeam responded to the vulnerabilities by releasing a critical patch to mitigate these issues. Service providers using Veeam Service Provider Console version 8.1 are encouraged to update to the latest available build, 8.1.0.21999, which addresses both CVE-2024-42448 and CVE-2024-42449. It is important to note that no mitigations are available for these vulnerabilities besides upgrading to the patched version. Thus, users of affected versions are strongly urged to install the cumulative update as soon as possible.  The critical update was published on December 3, 2024, with the patch applied in Veeam Service Provider Console 8.1.0.21999. Service providers using earlier versions (including builds from version 7) are advised to upgrade to the latest version to safeguard their systems.  The Veeam Service Provider Console vulnerabilities impact version 8.1.0.21377 and all prior versions in the 8.x and 7.x series. However, Veeam notes that if private fixes were applied to any of these versions, the build number may exceed the general availability (GA) version. In such cases, any deployed build lower than the solution build number (8.1.0.21999) should be considered vulnerable.  For Veeam users who have not yet updated their systems, this is a critical reminder to ensure they are operating on the most recent, secure version of the VSPC. Those who fail to act could leave their systems vulnerable to potential attacks that could lead to data loss or security breaches.  Conclusion Organizations using Veeam Service Provider Console are strongly advised to upgrade to the latest available build, 8.1.0.21999, to protect themselves from the vulnerabilities CVE-2024-42448 and CVE-2024-42449. These vulnerabilities present serious risks, including the possibility of Remote Code Execution and NTLM hash leaks, which could lead to further data loss, system compromises, and escalating attacks.  As with any security vulnerability, timely patching is the best defense against potential exploits. Service providers and users of the affected Veeam versions should not delay the update process.  

image for How the NCA Cracked ...

 Cyber News

The UK’s National Crime Agency (NCA) has disrupted two extensive Russian money laundering networks that operated across continents, aiding criminals worldwide, including notorious ransomware gangs. Dubbed Operation Destabilise, this multi-agency investigation exposed the workings of the “Smart” and “TGR”   show more ...  

networks—criminal enterprises that laundered billions of pounds while facilitating a range of illicit activities, including cybercrime, drug trafficking, and sanctions evasion. A Coordinated Global Crackdown The operation, unveiled today, is the culmination of a years-long international investigation led by the NCA and supported by partners such as the US Department of the Treasury’s Office of Foreign Assets Control (OFAC), the FBI, and authorities in the UAE, France, and Ireland. To date, it has resulted in 84 arrests, the seizure of over £20 million in cash and cryptocurrency, and the dismantling of a highly advanced criminal infrastructure spanning more than 30 countries. “Operation Destabilise has exposed billion-dollar money laundering networks operating in ways previously unknown to law enforcement,” said an NCA spokesperson. “For the first time, we’ve been able to link Russian elites, crypto-rich cybercriminals, and UK drug gangs under one sprawling criminal web.” Meet the Criminal Networks: Smart and TGR The investigation centered on two key networks, Smart and TGR, which worked in tandem to provide a seamless money laundering service. Smart, led by Ukrainian George Rossi, specialized in routing illicit funds through complex channels, often converting cash to cryptocurrency to obscure the origin of the money. TGR, controlled by Russian Ekaterina Zhdanova, focused on managing courier networks and facilitating large-scale cash handovers. Zhdanova worked closely with her deputies Khadzi-Murat Magomedov and Nikita Krasnov, who coordinated couriers in the UK and beyond. These networks offered a mutually beneficial service: they helped UK-based drug gangs launder cash, reinvesting it in illegal activities like drug and firearm trafficking, while simultaneously enabling Russian elites and cybercriminals to bypass international sanctions and invest in Western economies. How the Scheme Worked At the heart of Smart and TGR’s operations was a complex yet effective scheme: Cash Collection: Criminal gangs in one country would hand over large sums of illicit cash to couriers. Crypto Conversion: The equivalent value in cryptocurrency was transferred to the gangs, enabling them to reinvest in their illegal businesses without moving physical money across borders. Global Laundering: The cryptocurrency was then routed through exchanges, including some linked to sanctioned entities, making it virtually untraceable. Investigators uncovered over 55 cash handover locations across the UK alone. One London-based courier, Fawad Saiedi, laundered £15 million before being sentenced to four years and four months in prison. Other couriers, such as Semen Kuksov and Andrii Dzektsa, facilitated transactions totaling over £12 million in just two months, operating not only in the UK but also across Europe. Impacts on Cybercrime and Sanctions Evasion The reach of Smart and TGR extended beyond physical crime. The networks laundered millions for ransomware gangs, including the Ryuk group, which extorted over £27 million from UK victims such as schools, hospitals, and businesses. Additionally, they helped Russian oligarchs bypass financial restrictions, threatening the integrity of Western economies. In one case, TGR moved £2 million into the UK to purchase property for a Russian client, bypassing anti-money laundering checks. Another operation linked the networks to funds transferred out of Russia to support a sanctioned Russian media organization in the UK. Cracking Down on Dirty Money The combined efforts of the NCA and international partners have not gone unnoticed. The sanctions announced by OFAC today target six key figures in the networks, including George Rossi, Ekaterina Zhdanova, and Elena Chirkinyan, as well as four businesses associated with TGR. These measures aim to dismantle the networks’ financial infrastructure and disrupt their global operations. The operation has also dealt a significant financial blow to the networks, which typically charged low commissions of around 3% for laundering services. With £20 million seized, they would need to process over £700 million in funds just to recover their losses. A Message to Criminals The success of Operation Destabilise sends a strong message: the UK is not a safe haven for money laundering. Increased law enforcement activity has already made it more difficult for Russian-speaking laundering networks to operate in London, with many now charging higher commission rates due to heightened risks. Security Minister Dan Jarvis applauded the operation, stating: “Illicit finance inflicts immense harm around the world, and this major global operation marks a significant step against economic crime. The UK and its allies will continue to work together to crack down on illicit finance and the criminality it enables.” A Call for Community Vigilance The NCA emphasized the role of community intelligence and neighborhood policing in identifying and tackling criminal activities. “Money laundering deprives society of funds that pay for schools, hospitals, and social services,” an official noted. “Together, we can ensure crime doesn’t pay.” By disrupting these networks, the NCA and its partners have struck a blow against not just money laundering but the broader ecosystem of violence, cybercrime, and corruption that it fuels.

image for CISA Adds Three Crit ...

 Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) Catalog, adding three critical vulnerabilities that are being actively exploited by cybercriminals. The flaws in these products could lead to unauthorized access, data breaches, and service   show more ...  

disruptions if left unaddressed.  The newly added vulnerabilities include CVE-2023-45727, which affects North Grid Proself and is related to an improper restriction of XML External Entity (XXE) reference. Another critical flaw, CVE-2024-11680, impacts ProjectSend and is caused by an improper authentication vulnerability. Finally, CVE-2024-11667 affects Zyxel firewalls, where a path traversal vulnerability can be exploited.  CVE-2023-45727: North Grid Proself XXE Vulnerability  The first vulnerability, CVE-2023-45727, affects multiple versions of North Grid’s Proself product suite. These include the Proself Enterprise/Standard Edition (versions 5.62 and earlier), Proself Gateway Edition (versions 1.65 and earlier), and Proself Mail Sanitize Edition (versions 1.08 and earlier). This flaw stems from an improper restriction in the XML External Entity (XXE) processing feature.  An attacker can exploit this vulnerability by sending specially crafted XML data to the affected systems. If successful, this could allow remote unauthenticated attackers to access arbitrary files on the server, including those containing sensitive account information. The risk is high as the vulnerability could lead to data manipulation or theft, exposing critical organizational data.  The flaw was published on October 18, 2023, and it was added to the KEV catalog shortly after due to its potential impact. Organizations using the affected Proself products are strongly urged to apply patches that address this vulnerability and mitigate the risk of exploitation.  CVE-2024-11680: ProjectSend Authentication Bypass  The second vulnerability in CISA’s updated KEV catalog is CVE-2024-11680, which affects the ProjectSend file management application. Specifically, versions prior to r1720 are vulnerable to an improper authentication flaw. This vulnerability allows remote attackers to send specially crafted HTTP requests to the options.php file, which enables them to bypass authentication mechanisms.  Once authenticated, attackers can make unauthorized changes to the system configuration, including creating new user accounts, uploading malicious content (such as webshells), or embedding harmful JavaScript. With a critical CVSS score of 9.8, this flaw poses online risks for organizations using vulnerable versions of ProjectSend. This vulnerability was published on November 26, 2024, and organizations are advised to immediately update to the latest version to prevent exploitation.  CVE-2024-11667: Zyxel Firewalls Path Traversal  The third vulnerability, CVE-2024-11667, impacts several Zyxel firewall models, including the ATP series, USG FLEX series, and USG20(W)-VPN series. The vulnerability lies in the web management interface of firmware versions V5.00 through V5.38 for these devices, enabling attackers to perform a path traversal attack.  A path traversal vulnerability allows attackers to manipulate file paths in the system, potentially gaining access to sensitive files or uploading malicious files. In the case of these Zyxel firewalls, attackers could exploit this vulnerability to compromise the device’s security.   With a CVSS score of 7.5, this flaw is considered high risk but not as critical as the ProjectSend vulnerability. The flaw was published on November 27, 2024, with an update the following day. Organizations using affected Zyxel products should promptly apply security updates to protect against this attack vector.  Mitigations for Known Exploited Vulnerabilities  The inclusion of CVE-2023-45727, CVE-2024-11680, and CVE-2024-11667 in the CISA Known Exploited Vulnerabilities (KEV) Catalog emphasizes the ongoing cybersecurity challenges faced by industries relying on these vulnerable products. These flaws, which span various attack vectors like XML External Entity (XXE) attacks, improper authentication, and path traversal, pose online risks to organizations using these systems for critical operations.   To mitigate these vulnerabilities, organizations must prioritize patch management, strengthen authentication practices, conduct regular security audits, and have incident response plans in place. Proactively addressing these vulnerabilities is essential to protect systems from potential exploits, ensuring the continued security and reliability of operations. 

image for The Dumbest Thing in ...

 Cyber News

Pro tip for hackers: Don’t threaten people whose specialty is uncovering the identity of cybercriminals. That mistake apparently led to the October arrest of Alexander “Connor” Moucka, 25, the alleged mastermind behind the massive Snowflake data breach earlier this year. The Kitchener, Ontario resident is   show more ...  

currently in Maplehurst Correctional Complex awaiting extradition proceedings that will determine whether he stands trial in the U.S. Here’s the story behind Moucka’s arrest, or as much of it as investigators are willing to reveal. Hacker Threats 'The Stupidest Thing Ever' Moucka had allegedly been boasting about his exploits on Telegram under the alias ‘Waifu” when he threatened Unit221B Chief Research Officer Allison Nixon – who then assigned one of her researchers to find out his real identity, according to the Waterloo Region Record. “Why would he target a company that is not working on his case and specializes in identifying cybercriminals?” Nixon told the Toronto-based paper. “It is just the stupidest thing ever.” [caption id="attachment_99378" align="alignright" width="240"] Allison Nixon[/caption] It took several months – and one critical operational mistake by Waifu – before Moucka’s name was handed over to law enforcement. Nixon isn’t saying much about Waifu’s mistakes in order to keep cybercriminals from learning from them. Nor is she saying much about the threats he made, telling The Cyber Express that they included “every kind of bad language that kids on the internet say basically.” A threat actor who goes by the alias “kiberphant0m” has taken up Moucka’s cause since the arrest, in addition to selling data from Snowflake and other breaches – including what may be older call logs from President-elect Donald Trump and Vice President Kamala Harris. Asked if she had any idea who kiberphant0m is, Nixon replied, “no comment.” Waifu’s History Allegedly Includes 'The Com' Nixon first crossed paths with “Waifu” in 2019 when the New York Police Department was seeking information about the hacker, who identified as a member of “The Com,” a loose cybercrime collective she had been tracking that also includes the group known as “Scattered Spider.” The Com has also been linked to extortion, violence, swatting and other disturbing acts, so a threat from a member wasn’t something to be taken lightly. Nixon reveals something of her own exploits on her X feed, and some of her posts have a bit of a taunting tone, such as saying “this guy spent too much time posting and not enough getting a lawyer” while linking to an article on an arrest. And while she doesn’t directly say which cases she was involved in, there are hints, such as posting “Who wants to be next?” when linking to an arrest. She did that with news of Moucka’s arrest, and again recently when linking to the case of Remington Ogletree, a 19-year-old alleged Scattered Spider member charged with telecom and financial breaches. This is probably wasted advice given the culture of some threat groups, but be careful who you pick fights with online. You might be dealing with a formidable opponent like Nixon.

image for Voice Cloning, Fake ...

 Cyber Essentials

The FBI has issued a new warning about the increasing use of artificial intelligence (AI) in online fraud schemes, which are becoming more advanced and difficult to detect. "The FBI is warning the public that criminals exploit generative artificial intelligence (AI) to commit fraud on a larger scale which   show more ...  

increases the believability of their schemes," reads the statement released by FBI. Criminals are leveraging generative AI tools to create highly convincing social media profiles, fraudulent websites, and even audio and video content to deceive victims on a larger scale. These AI technologies make scams more believable and harder to identify, heightening the risks for individuals and businesses alike. Generative AI refers to tools that can create new content—such as text, images, audio, and videos—based on examples input by users. While the creation of synthetic content itself is not illegal, it can be exploited to facilitate crimes like fraud, extortion, and identity theft. Since generative AI can produce highly realistic content that may seem genuine at first glance, recognizing when a piece of content is AI-generated can be challenging. How Scammers Use Generated AI in Fraud Schemes AI-generated text, images, audio, and videos are being used by criminals to manipulate their victims in various ways. Here’s how these technologies are making scams more effective: AI-Generated Text: Criminals are using AI to create convincing written content that seems legitimate, such as emails, text messages, and social media posts. This helps them reach a larger audience more efficiently while overcoming typical signs of fraud. For example, AI can generate fake social media profiles to engage victims in romance scams, investment fraud, or job hiring schemes. AI-powered tools can also help translate messages into different languages, ensuring that international fraudsters can target victims without grammatical errors that would usually raise suspicion. Scammers are also using generative AI to craft fraudulent investment websites, often for schemes involving cryptocurrency, or to embed chatbots that trick users into clicking malicious links. AI-Generated Images: Criminals are using AI to create realistic images that support their fraudulent activities. These images can be used for fake social media profiles or to create phony identification documents. AI tools allow fraudsters to generate photos that appear to be of real people, which they then use to support romance scams, confidence fraud, or fake investment schemes. Some scammers have used AI to produce images of celebrities or social media influencers promoting counterfeit products or fake fundraising campaigns. AI-generated images are also used in extortion schemes, such as creating fake pornographic photos of a victim to blackmail them into paying money. AI-Generated Audio (Vocal Cloning): Another alarming trend is the use of AI to clone voices, which allows scammers to impersonate well-known figures or even close family members. By mimicking someone’s voice, criminals can trick victims into transferring money or sharing sensitive information. Scammers may create short audio clips of a loved one’s voice to make it seem as though the victim is being contacted in a crisis, prompting immediate financial assistance or a ransom demand. AI-generated audio can also be used to impersonate bank officials or other trusted sources in order to gain access to sensitive accounts or convince victims to provide personal information. AI-Generated Videos: Criminals are also using AI to create fake videos that enhance the believability of their scams. These videos might feature public figures or fictitious personas to make the fraud seem more credible. Fraudsters have used AI to create videos that appear to be from company executives, law enforcement officials, or other authority figures. These videos are often used in schemes involving fake job offers or investment fraud. Private communications may include AI-generated videos of someone the victim believes to be real, further bolstering the illusion that they are communicating with a legitimate person. Tips to Protect Yourself from AI-Driven Scams As AI-generated content becomes more advanced, it’s crucial to remain vigilant and aware of the warning signs. The FBI offers several tips to help people protect themselves from falling victim to AI-driven fraud: Create a Secret Word or Phrase: Establish a secret code with family members to verify identities in case of a crisis. This simple step can help prevent scams that involve impersonating loved ones. Look for Imperfections: AI-generated images and videos, although realistic, often contain subtle flaws. Watch for distorted faces, unrealistic eyes or teeth, strange hand or foot shapes, and irregular shadows. Similarly, listen for any odd pauses or mismatched tones in audio clips. Limit Your Online Presence: Consider minimizing the amount of personal content you post online. Make your social media accounts private and only accept friend requests from people you know. Limiting access to your images and voice can make it harder for criminals to use AI tools to create fraudulent identities. Verify Unsolicited Calls or Messages: If you receive a call or message asking for money or personal information, do not engage immediately. Instead, hang up and research the contact through official channels. Always call back using a trusted phone number from a website or official documentation. Don’t Share Sensitive Information: Never share sensitive information with people you have only met online or over the phone. This includes personal details, passwords, or financial information. Never Send Money to Strangers: Be cautious when asked to send money, gift cards, or cryptocurrency to people you don’t know, especially if you’ve only met them online or over the phone. What to Do if You Fall Victim to a Fraud Scheme If you suspect that you have been scammed, it’s important to act quickly. The FBI advises victims to file a report with the Internet Crime Complaint Center (IC3) at www.ic3.gov. When submitting a report, include as much information as possible, such as: Identifying details about the scammer, such as name, phone number, email, and physical address. Financial transaction information, including dates, payment methods, amounts, and account numbers. A description of your interaction with the scammer, including how contact was made, the type of request, and any other relevant details. By staying informed and cautious, you can reduce your risk of falling victim to these increasingly advanced AI-powered fraud schemes.

image for How to guard against ...

 Privacy

Just a decade ago, people who taped over their webcam were seen as a little eccentric, shall we say. Fast forward to today, and many laptop models feature a built-in privacy shutter that lets you cover the webcam with a single swipe. Useful, yes but if the mic is still on, the overall benefit is less clear. Is it   show more ...  

still worth covering your webcam in 2024, or is such practice a relic of the past? Spies in the woodwork Ever heard of spyware? Thats what we call Trojans designed for spying and stalking. And just like they did ten years ago, many members of this family are still spying on victims through their webcam and mic. Back then, however, malware was limited mostly to taking webcam screenshots, while today, besides this, it can steal passwords from the clipboard, intercept keystrokes, remotely control your device, and play cat-and-mouse with security solutions (but not with ours). One example is the SambaSpy Trojan, which was recently discovered by our experts. As for peeping, attackers motives can vary: some are just voyeurs; others might organize commercial surveillance against a CEO; still others might add such functionality to their malware on the off-chance that something interesting crops up. Tracking can take many forms, and weve covered them all many times. But how to defend yourself? There are many protection methods, but they can all be divided into two groups: physical and software. Meanwhile, for those without reliable protection, covering the webcam, turning off the mic, and checking the permissions granted to newly installed programs is a no-brainer. How to physically guard against webcam and mic surveillance Physical protection methods are both useful and inconvenient at the same time, and compromises have to be made to ensure your privacy. What to do? Buy a device without a webcam or mic Just think: intruders wont be able to spy and eavesdrop even if they somehow get malware onto your device. But its hard to find such devices these days, and in most cases theyll be either outdated or very low-performance. That said, some companies are modifying smartphones on the market by removing cameras: how do you like, for example, the non-camera iPhone? Such devices are in high demand at government and military agencies and restricted-access facilities, and even by highly religious people. Disable the webcam and mic Owners of desktop computers, nettops, or the above-mentioned laptop models without built-in webcam and mic can use external wired accessories. The most reliable option would be to disconnect them with a physical switch or pull them out of the socket when not in use. But theres a danger of laziness creeping in: some users wont bother doing it more than a couple of times, which is when RATs and nasties can appear. In addition, there are tons of online guides on how to physically disable the laptop webcam or mic yourself. But not all devices make the procedure painless: for example, modern MacBooks use the camera as a sensor, and go into Safe Mode if its disabled. And once it is disabled – theres no way back. Opt for a super-private device Some companies – such as Purism – make laptops with hardware switches that let you physically turn off the camera, microphone, Wi-Fi, or Bluetooth. However, theyre expensive, and demanding users are often left dissatisfied with the features available. Cover the webcam A good and common option – but not foolproof. Sure, it will thwart video surveillance, but the sound from the mic can still be potentially eavesdropped and used against you. Cover the microphone too? Modern laptops often have several mics to enhance sound quality, and taping over them all will be difficult. In some models, however, built-in microphones are disabled when you connect an external one. A life hack for them is to plug a dummy into the microphone jack (or the universal jack for mics and headphones). Your laptop will think that an external mic is connected and turn off all its built-in ones. Software protection against tracking In most cases, software protection is more convenient than physical – but not always as reliable. Disable the built-in webcam and mic in the BIOS/UEFI On many PC-compatible laptops – especially business models – you can go into the BIOS/UEFI settings at startup (if this sounds Greek to you, just scroll to the next method), find there the lines Integrated camera, Camera, Webcam, CMOS camera, Microphone or similar, and select Disabled mode. This is a good way to restrict laptop-based spying, but theres a catch: youll have to reboot and undo everything should you ever need to video-call someone. Disable devices in the OS settings On a Windows PC, you need to do this in Device Manager. In the Start menu, go to Device Manager, find there Cameras or Audio inputs and outputs, right-click the device you need and select Disable device. You can just as easily turn it back on later, if necessary. This is much faster than rebooting the computer every time and poking around in the BIOS – but wheres the guarantee that a Trojan cant do the same thing and turn the camera back on? Disabling a built-in webcam and microphone in Windows Device Manager Control permissions Android device owners can view information about dangerous and special permissions in the Permissions section in Kaspersky for Android: All functions -> My apps -> Permissions. This way, only apps authorized by you will have access to the camera and microphone. Viewing permissions in Kaspersky for Android iOS devices offer similar functionality. To check permissions, open the Settings and go to Privacy & Security. In the menu that opens, like in Android, you can view app permissions. Viewing permissions on iPhones Users of the Windows versions of our Kaspersky Standard, Kaspersky Plus and Kaspersky Premium can protect their devices against webcam and microphone tracking with Webcam and Mic Control, which lets you configure your own access settings: Gear icon at the bottom of the Home window -> Privacy Settings -> Webcam and Mic Control Settings. There you can ask Kaspersky to: Notify you when an app uses the camera or microphone. Deny access for all apps without exception. Allow only trusted apps to connect to the webcam and microphone. Webcam and Mic Control Settings on a Windows device Mac owners too have the option to completely block the webcam with Kaspersky Standard, Kaspersky Plus, and Kaspersky Premium: Home -> Block Webcam. Our application completely blocks access to system libraries used by the webcam, so no programs can access it. Block Webcam on a Mac device Protect yourself Physical or software protection — the choice is yours, but we recommend a combination of the two. For example, buy a webcam shutter and configure Kaspersky to disable the mic. The main thing is that your device – whether a smartphone, laptop or desktop – must be properly protected.

 Feed

The U.K. National Crime Agency (NCA) on Wednesday announced that it led an international investigation to disrupt Russian money laundering networks that were found to facilitate serious and organized crime across the U.K., the Middle East, Russia, and South America. The effort, codenamed Operation Destabilise, has resulted in the arrest of 84 suspects linked to two Russian-speaking networks

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added multiple security flaws affecting products from Zyxel, North Grid Proself, ProjectSend, and CyberPanel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows - CVE-2024-51378 (CVSS score: 10.0) - An incorrect default permissions

 Feed

The China-linked threat actor known as MirrorFace has been attributed to a new spear-phishing campaign mainly targeting individuals and organizations in Japan since June 2024. The aim of the campaign is to deliver backdoors known as NOOPDOOR (aka HiddenFace) and ANEL (aka UPPERCUT), Trend Micro said in a technical analysis. "An interesting aspect of this campaign is the comeback of a backdoor

 Feed

A previously undocumented threat activity cluster dubbed Earth Minotaur is leveraging the MOONSHINE exploit kit and an unreported Android-cum-Windows backdoor called DarkNimbus to facilitate long-term surveillance operations targeting Tibetans and Uyghurs. "Earth Minotaur uses MOONSHINE to deliver the DarkNimbus backdoor to Android and Windows devices, targeting WeChat, and possibly making it a

 Feed

Vulnerability Management (VM) has long been a cornerstone of organizational cybersecurity. Nearly as old as the discipline of cybersecurity itself, it aims to help organizations identify and address potential security issues before they become serious problems. Yet, in recent years, the limitations of this approach have become increasingly evident.  At its core, Vulnerability Management

 Feed

A suspected Chinese threat actor targeted a large U.S. organization earlier this year as part of a four-month-long intrusion. According to Broadcom-owned Symantec, the first evidence of the malicious activity was detected on April 11, 2024 and continued until August. However, the company doesn't rule out the possibility that the intrusion may have occurred earlier. "The attackers moved laterally

 Feed

As many as 77 banking institutions, cryptocurrency exchanges, and national organizations have become the target of a newly discovered Android remote access trojan (RAT) called DroidBot. "DroidBot is a modern RAT that combines hidden VNC and overlay attack techniques with spyware-like capabilities, such as keylogging and user interface monitoring," Cleafy researchers Simone Mattia, Alessandro

 Feed

Cybersecurity researchers have released a proof-of-concept (PoC) exploit that strings together a now-patched critical security flaw impacting Mitel MiCollab with an arbitrary file read zero-day, granting an attacker the ability to access files from susceptible instances. The critical vulnerability in question is CVE-2024-41713 (CVSS score: 9.8), which relates to a case of insufficient input

 Feed

Europol on Thursday announced the shutdown of a clearnet marketplace called Manson Market that facilitated online fraud on a large scale. The operation, led by German authorities, has resulted in the seizure of more than 50 servers associated with the service and the arrest of two suspects. More than 200 terabytes of digital evidence have been collected. Manson Market ("manson-market[.]pw") is

 Denial of Service

A CEO is arrested for turning satellite receivers into DDoS attack weapons! Then, we'll journey into the world of bossware and "affective computing" and explore how AI is learning to read our emotions – is this the future of work, or a recipe for dystopia? All this and more is discussed in the latest   show more ...  

edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

 'Cyber

Source: cyble.com – Author: Cyble. Overview  The recent Weekly Industrial Control System Vulnerability Intelligence Report from Cyble Research & Intelligence Labs (CRIL) covers the vulnerabilities disclosed by the Cybersecurity and Infrastructure Security Agency (CISA) from November 26, 2024, to December   show more ...  

02, 2024.   The report sheds light on online threats, especially vulnerabilities affecting critical systems such […] La entrada Vulnerabilities in ICS: A Detailed Analysis of Recent Security Advisories and Threats  – Source:cyble.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: cyble.com – Author: Cyble. Overview  A coalition of cybersecurity agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), Australia’s Australian Signals Directorate (ASD), the Australian Cyber   show more ...  

Security Centre (ACSC), as well as counterparts from Canada and New Zealand, has issued a hardening guidance […] La entrada Australia’s ACSC and ASD Team Up with CISA, NSA, FBI, and International Allies to Protect Communications Infrastructure – Source:cyble.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.troyhunt.com – Author: Troy Hunt 04 December 2024 Today, we’re happy to welcome the 37th government to have full and free access to domain searches of their gov domains in Have I Been Pwned, Armenia. Armenia’s National Computer Incident Response Team AM-CERT now joins three dozen other   show more ...  

national counterparts in gaining visibility into how […] La entrada Welcoming the Armenian Government to Have I Been Pwned – Source: www.troyhunt.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: www.csoonline.com – Author: Opinion 05 Dec 20246 mins Business IT AlignmentCEOCSO and CISO Veteran CISO Tyler Farrar offers an open letter to CEOs whose business strategies expect security chiefs to be accountable without authority — or who hire CISOs incapable of fulfilling a true leadership role. As   show more ...  

a CISO, I’ve spent years navigating the […] La entrada Dear CEO: It’s time to rethink security leadership and empower your CISO – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: A rise in macOS-targeted malware as well as increasing Apple market share may mean corporate Mac fleets are more attractive targets for cybercriminals than previously thought. The Apple ecosystem has been recognized for years by users and cybersecurity experts as among the   show more ...  

most secure, offering flagship security features and a high […] La entrada Is the tide turning on macOS security? – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSO and CISO

Source: www.csoonline.com – Author: A group of European law enforcement agencies broke a cyberthief-created secure messaging app and monitored their discussions in real time. The implications for CISOs: However little you now trust encryption, trust it a lot less. A group of European law enforcement agencies   show more ...  

were able to crack a high-level encryption app that […] La entrada European law enforcement breaks high-end encryption app used by suspects – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.networkworld.com – Author: News Dec 04, 20243 mins Cloud ComputingCloud SecurityHybrid Cloud FortiAppSec Cloud combines web and API security, server load balancing, and threat analytics under a single console. Fortinet has melded some of its previously available services into an integrated cloud   show more ...  

package aimed at helping customers secure applications. The new service, FortiAppSec Cloud, […] La entrada Fortinet offers integrated cloud app security service – Source: www.networkworld.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Communications Security

Source: www.csoonline.com – Author: News 04 Dec 20245 mins Communications SecuritySecurityTelecommunications Industry The biggest hack since the Aurora attacks of 2009 used traditional vectors and vulnerabilities rather than novel hacking techniques, CISA says. Security teams and individuals across the US need   show more ...  

to take immediate precautions to counter the surveillance threat posed by Chinese ‘Salt Typhoon’ […] La entrada Security teams should act now to counter Chinese threat, says CISA – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.csoonline.com – Author: News 04 Dezember 20243 Minuten Cloud-Sicherheit KI-basierte Detection- und automatisierte Response-Fähigkeiten versprechen das Incident Management zu optimieren. Amazon Web Services erweitert seine Cloud-Security-Angebote um KI- und ML-Funktionalitäten. Gorodenkoff /   show more ...  

Shutterstock Wenn zunehmend komplexe Cloud-Umgebungen und wachsende Cyberbedrohungen zusammenkommen, sind Sicherheitsteams regelmäßig mit Problemen konfrontiert wie Security-Alerts in überwältigendem Ausmaß, fragmentierten Workflows […] La entrada Neue AWS-KI-Rezepte gegen Cloud-Bedrohungen – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: www.csoonline.com – Author: News 04 Dezember 20243 Minuten Ransomware Wodka-Hersteller Stoli meldet in den USA nach russischem Ransomware-Angriff Insolvenz an. Russische Behörden und Hacker treiben Die unliebsame Exil-Firma in den Ruin. Alex Alaks/shutterstock.com Die US-Unternehmen der Stoli Group, zu   show more ...  

denen unter anderem die Wodka-Marken Stoli und Elit gehören, hat Insolvenz angemeldet. Den Schritt begründete […] La entrada Russland knöpft sich Exil-Wodka vor – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.schneier.com – Author: B. Schneier It’s been the biggest year for elections in human history: 2024 is a “super-cycle” year in which 3.7 billion eligible voters in 72 countries had the chance to go the polls. These are also the first AI elections, where many feared that deepfakes and artificial   show more ...  

intelligence-generated misinformation would overwhelm […] La entrada AI and the 2024 Elections – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.lastwatchdog.com – Author: bacohido Cheltenham, England, Dec. 4, 2024 –A majority of senior cybersecurity professionals at the UK’s largest organisations struggle with feelings of helplessness and professional despair, new research by Green Raven Limited indicates. These negative emotions   show more ...  

result from practitioners’ anticipation of eventual, inevitable failure to protect their organisation. Most practitioners say these same feelings spill over into […] La entrada News alert: Green Raven study shows cybersecurity to be a black hole in more ways than just budget – Source: www.lastwatchdog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.lastwatchdog.com – Author: bacohido By Andrey Karpov In the modern world of software development, code quality is becoming a critical factor that determines a project success. Errors in code can entail severe consequences. Related: The convergence of network, application security For example,   show more ...  

vulnerabilities in banking applications can lead to financial data leaks, and errors […] La entrada GUEST ESSAY: The key role static code analyzers play in detecting coding errors, eliminating flaws – Source: www.lastwatchdog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: levelblue.com – Author: hello@alienvault.com. Security leaders continue to be under intense pressure. Increasingly, they are turning toward third parties for support and expertise as their cybersecurity woes become more dire and it becomes harder to recruit and retain talent.  This is reflected in the   show more ...  

projected growth for cybersecurity services through 20281 (managed security services, […] La entrada How Regional Service Providers Can Grab a Larger Share of the Cybersecurity Market – Source:levelblue.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: cyble.com – Author: rohansinhacyblecom. Key takeaways Cyble Research and Intelligence Labs (CRIL) identified a malicious campaign targeting the manufacturing industry, leveraging a deceptive LNK file disguised as a PDF file. This campaign leverages multiple Living-off-the-Land Binaries (LOLBins), such   show more ...  

as ssh.exe, powershell.exe, and mshta.exe, to bypass traditional security mechanisms and remotely execute the next-stage payload. […] La entrada Threat Actor Targets the Manufacturing industry with Lumma Stealer and Amadey Bot – Source:cyble.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Waqas. Any technological innovation comes with security risks, and open banking is no exception. Open banking relies on APIs to connect banks (and their essential services) to their customers. While it is exceptionally convenient and provides several valuable services for   show more ...  

consumers, open banking relies on APIs to function. APIs are a […] La entrada API Security in Open Banking: Balancing Innovation with Risk Management – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Analyzing

Source: www.proofpoint.com – Author: In 2024, healthcare organizations experienced multiple expensive cyberattacks, costing an average of nearly $10 million.1 And with the expansion of ransomware and extortion exploits, healthcare will likely continue to be targeted by such attacks. “[Threat actors] are   show more ...  

trying to extort payment from organizations. That’s a trend we’re seeing,” said Ryan Witt, […] La entrada Analyzing user behavior and content across all channels can help defend data – Source: www.proofpoint.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.proofpoint.com – Author: When Selena Larson began shifting her focus from state-sponsored advanced persistent threats (APTs) during her transition to her role as a senior threat intelligence analyst at Proofpoint, the response from peers in cybersecurity was initially mixed. APTs had long been   show more ...  

considered the apex of sophisticated threats. Larson, however, saw a different, equally […] La entrada How women innovators are shaping the cybersecurity landscape – Source: www.proofpoint.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.proofpoint.com – Author: News Analysis 21 Nov 20246 mins Application SecurityMalwarePhishing IT teams should revisit PowerShell restrictions as an increasingly used click-and-fix technique has users self-serving fake system issues by invoking malicious PowerShell scripts themselves, reducing   show more ...  

suspicion. Threat groups are increasingly adopting a social engineering technique dubbed ClickFix to trick users into copying malicious […] La entrada Rising ClickFix malware distribution trick puts PowerShell IT policies on notice – Source: www.proofpoint.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: UK investigators say they have sent a clear message that the country is “not a safe haven for money laundering,” after making scores of arrests and seizing millions from two major Russian criminal networks. The National Crime Agency (NCA) yesterday revealed   show more ...  

Operation Destabilise, a significant effort to unmask two previously unknown […] La entrada UK’s NCA Disrupts Multibillion-Dollar Russian Money Launderers – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Pro-Russian hacktivist gang Noname has claimed over 6600 attacks since March 2022, almost exclusively targeting European nations, new research from Orange Cyberdefense has shown. The cybersecurity vendor’s Security Navigator 2025 report found that 96% of   show more ...  

Noname’s attacks targets included Ukraine, Czech Republic, Spain, Poland and Italy and have been ongoing since […] La entrada Pro-Russian Hacktivist Group Claims 6600 Attacks Targeting Europe – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Ransomware attacks on manufacturing companies have caused an estimated $17bn in downtime since 2018. According to new figures by Comparitech, these incidents have disrupted operations at 858 manufacturers worldwide, with each day of downtime costing an average of   show more ...  

$1.9m. This significant financial impact stems from the widespread disruption of ransomware attacks. […] La entrada Ransomware Costs Manufacturing Sector $17bn in Downtime – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: The Federal Trade Commission (FTC) has banned data brokers Gravy Analytics and Mobilewalla from collecting, using or selling sensitive location data that reveals Americans’ visits to places like healthcare facilities, military bases and religious institutions.   show more ...  

The settlements, announced on Tuesday, also require both companies to delete previously collected data and impose strict […] La entrada FTC Safeguards US Consumers from Location Data Misuse – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-12
Aggregator history
Thursday, December 05
SUN
MON
TUE
WED
THU
FRI
SAT
DecemberJanuaryFebruary