Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for New Malware Campaign ...

 Firewall Daily

In a recent analysis by Cyble Research and Intelligence Labs (CRIL), a multi-stage cyberattack campaign has been identified, targeting the manufacturing industry. The attack, which heavily relies on process injection techniques, aims to deliver dangerous payloads, including Lumma Stealer and Amadey Bot.   Through a   show more ...  

series of evasive actions, the threat actor (TA) exploits various Windows tools and processes to bypass traditional security defenses, leading to potential data theft and persistent system control.  Lumma Stealer and Amadey Bot Attack: LNK File and Remote Execution  [caption id="attachment_99424" align="alignnone" width="586"] Infection Chain of the Attack (Source: Cyble)[/caption] CRIL recently discovered a sophisticated multi-stage attack campaign that begins with a spear-phishing email. The email contains a link that leads to an LNK file, disguised as a PDF document, which when clicked, triggers a series of commands. This LNK file is hosted on a WebDAV server, which makes it difficult for security software to trace.  For instance, one of the malicious links observed in the campaign was hxxp://download-695-18112-001-webdav-logicaldoc[.]cdn-serveri4732-ns.shop. The attack’s effectiveness stems from its ability to exploit the name of a legitimate cloud-based document management system (LogicalDOC), commonly used in manufacturing and engineering industries, to convince targets into opening the file.  Once the LNK file is executed, it launches ssh.exe, a legitimate system utility that can bypass security software's detection. Through ssh.exe, a PowerShell command is triggered, which fetches an additional payload from a remote server using mshta.exe. This process is designed to evade detection by using Google’s Accelerated Mobile Pages (AMP) framework combined with a shortened URL. The payload fetched is a script that contains additional obfuscated commands that eventually deliver the final malicious payload to the victim's system.  The Role of Living-off-the-Land Binaries and DLL Sideloading  In this advanced attack, the Lumma Stealer and Amadey Bot payloads are injected into the victim's system through a multi-stage code injection process. A significant part of this attack involves Living-off-the-Land Binaries (LOLBins), which are legitimate executables that attackers exploit to carry out their activities without triggering alarms. In this case, ssh.exe, powershell.exe, and mshta.exe are used to carry out a sequence of commands that bypass traditional security mechanisms. These LOLBins are highly effective because they are already trusted system utilities that rarely raise suspicion during normal operations.  The use of DLL sideloading further complicates detection. The attacker drops malicious DLL files alongside legitimate applications, like “syncagentsrv.exe,” and exploits these files to execute malicious code in memory. This technique is particularly evasive because the malware never writes malicious code to disk, making it harder to detect using conventional security software.  Once executed, the Amadey Bot and Lumma Stealer are deployed onto the victim’s system. Lumma Stealer is a notorious information-stealing malware designed to exfiltrate sensitive data, such as login credentials and other valuable system information. Meanwhile, the Amadey Bot serves as a powerful tool to establish persistence, allowing attackers to maintain control over the compromised system.  The Infection Chain  The infection chain begins with the LNK file, which runs ssh.exe and a subsequent PowerShell command to fetch additional scripts from the attacker’s server. These scripts are obfuscated, making it difficult for traditional security software to identify malicious behavior. They download a ZIP file, which is extracted, and a legitimate executable is used to sideload a malicious DLL.  The malicious DLL is designed to load encrypted payloads and execute them. This entire process takes place in memory, with no malicious files left on the disk to aid detection. After sideloading the malicious DLL, the system executes the Lumma Stealer and Amadey Bot, allowing attackers to steal sensitive information and maintain access to the infected systems.  The Exploitation of Legitimate Windows Tools and the Use of LOLBins  The threat actor’s use of legitimate tools like ssh.exe and mshta.exe is a clear example of the growing sophistication of modern cyberattacks. By leveraging these tools, the attacker avoids detection by traditional antivirus and endpoint protection systems. These tools are often left unchecked in enterprise environments, giving attackers an opportunity to bypass security measures with ease.  The campaign also makes use of IDATLoader, a powerful technique for deploying malware in multiple stages. IDATLoader is an essential part of the attack's ability to sideload and execute malicious DLLs, allowing the attacker to deploy both Lumma Stealer and Amadey Bot with precision.  Persistence Mechanisms  To maintain persistence on compromised systems, the attackers use the Task Scheduler. The Amadey Bot is configured to run automatically by creating a task called "NodeJS Web Framework" that launches the bot from the %Appdata% directory. This technique ensures that even if the victim attempts to remove the malware, it can be re-executed the next time the system is rebooted.  Furthermore, the attackers utilize msiexec.exe to inject Lumma Stealer into system processes, ensuring that their malware operates undetected by conventional security tools. This process enables the malware to continue functioning in the background, exfiltrating data and maintaining control over the infected machine.  Conclusion   To mitigate the risks of sophisticated attacks like those targeting the manufacturing industry, organizations should implement robust email filtering systems, educate users on the dangers of phishing emails, and restrict or monitor the use of Living-off-the-Land Binaries (LOLBins) such as ssh.exe, powershell.exe, and mshta.exe.   Disabling unnecessary services like WebDAV, using application whitelisting to prevent the execution of untrusted applications, and deploying advanced network and URL filtering can help block malicious redirects and AMP URLs. Additionally, restricting PowerShell scripts and other scripting languages can limit attackers’ ability to execute harmful commands. With these proactive measures, organizations can better protect against sophisticated threats like Lumma Stealer and Amadey Bot, ensuring the security of sensitive data and critical infrastructure. 

image for Cybersecurity in the ...

 Firewall Daily

A new report from the European Union Agency for Cybersecurity (ENISA) offers critical insights into the state of European Union cybersecurity, including recommendations to reinforce the EU's resilience against evolving cyber risks. The ENISA report, titled "The State of cybersecurity in the European Union   show more ...  

2024," serves as a comprehensive assessment of the EU's cybersecurity maturity, capabilities, and strategic initiatives. This inaugural report, required under Article 18 of the NIS2 Directive, reflects a collective effort by the Union to update cybersecurity frameworks, enhance cooperation between Member States, and protect critical sectors from growing cyber threats.  European Union Cybersecurity: Insights from ENISA  ENISA Executive Director Juhan Lepassaar stressed the importance of this initiative, stating, “Since its establishment, ENISA has been steadfast in its commitment to providing expertise and strategic support to EU Member States. Amidst growing cybersecurity threats, technological advancements, and a complex geopolitical landscape, it is vital to assess our capabilities. This process allows us to evaluate our maturity levels and strategically plan the next steps.”  The report is an evidence-based analysis that draws from various sources, including the EU Cybersecurity Index, ENISA’s Threat Landscape report, and consultations with the European Commission and all 27 EU Member States. The data and details highlight both progress and areas that require immediate attention to enhance the Union’s cybersecurity posture in 2024 and beyond.  EU Cybersecurity Capabilities: Progress and Challenges While the European Union has made improvements in protecting its cybersecurity infrastructure, the report reveals that vulnerabilities persist across different sectors and Member States. The EU’s cybersecurity risk assessment indicates that cyber threats remain substantial, with adversaries ranging from cybercriminals to state-aligned groups targeting critical sectors and governmental systems.  [caption id="attachment_99434" align="alignnone" width="1200"] Different types of cyberattacks targeted at EU (Source: ENISA)[/caption] Key cyber threats identified include:  Ransomware: Ransomware attacks continue to be one of the most significant threats facing the EU, with attackers increasingly shifting from encryption to data exfiltration. Small and medium-sized enterprises (SMEs) are particularly vulnerable, and the emergence of double-extortion tactics is making these attacks even more damaging.  Phishing and Social Engineering: Cybercriminals are leveraging sophisticated social engineering tactics, including phishing emails and social media scams, to steal credentials. The use of AI to generate convincing phishing emails and deepfake content has compounded these challenges.  Geopolitically Motivated Attacks: State-sponsored cyber espionage and disinformation campaigns remain a constant threat, targeting political systems and critical infrastructure.  Supply Chain Risks: As the EU becomes more reliant on global supply chains, these networks have become a primary target for cyberattacks.  National Strategies and Alignment in the EU ENISA's report also highlights the disparity in cybersecurity maturity across EU Member States. While some countries have established advanced, third-generation cybersecurity strategies, others are still implementing first-generation plans. In total, nine countries have made substantial progress with national strategies, while four are still in the early stages of execution.  Despite these differences, most EU nations share common objectives, such as improving supply chain security and enhancing overall resilience. However, gaps remain in sectors like the oil and transport industries, which require tailored support to boost their cybersecurity frameworks.  ENISA’s Six Recommendations for Strengthening Cybersecurity To enhance the EU’s cybersecurity posture, ENISA has outlined six key recommendations:  ENISA suggests providing both technical and financial assistance to EU institutions, national authorities, and entities under the NIS2 Directive’s scope to ensure effective and harmonized policy implementation.  Updating the EU’s framework for managing large-scale cyber incidents is crucial, particularly in terms of improving situational awareness and operational cooperation during crises.  There is a growing need to address the cybersecurity skills gap. ENISA calls for initiatives under the Cybersecurity Skills Academy to standardize training and develop an EU-wide certification scheme for cybersecurity professionals.  NISA stresses the importance of coordinated risk assessments to develop comprehensive policies that address supply chain vulnerabilities across all sectors.  Vulnerable sectors like healthcare, oil, and transport need tailored cybersecurity support to enhance their preparedness and resilience.  A more unified approach to improving cybersecurity awareness and cyber hygiene among EU citizens and professionals is essential for reducing risks associated with human error.  Conclusion The State of Cybersecurity in the European Union 2024 report highlights both the progress made and the ongoing challenges in strengthening the EU’s cybersecurity framework. Key issues such as the cybersecurity skills gap, the rise of AI-powered cyberattacks, and the potential risks posed by quantum computing are critical areas that demand immediate attention. ENISA's recommendations, including expanding cybersecurity education and workforce initiatives, as well as investing in future-proof technologies, are essential to building a resilient digital environment for the EU.

image for Blue Yonder Attack A ...

 Cyber News

Last month’s attack on supply chain management platform Blue Yonder has been attributed to a new ransomware group known as “Termite.” The ransomware attack hit several downstream customers, including retail and manufacturing operations, and Blue Yonder continues to work at getting them all back online. Cyble   show more ...  

researchers examined the new ransomware strain in a technical blog and said it is “essentially a rebranding of the notorious Babuk ransomware.” So far the new ransomware group has claimed seven victims – two each in the U.S. and France, and one each in Oman, Germany and Canada. Termite Ransomware Binary Analyzed Cyble researchers examined a Termite ransomware binary that was first identified by PCrisk and determined that it was largely similar to the existing Babuk ransomware. After executing, the ransomware invokes the SetProcessShutdownParameters(0, 0) API “to ensure that its process is one of the last to be terminated during system shutdown,” Cyble said. “This tactic is used to maximize the time available for the ransomware to complete its encryption process.” The ransomware then terminates services on the victim machine to prevent interruptions during the encryption process, and terminates backup processes if those are running too. The malware’s vssadmin.exe process deletes all Shadow Copies to prevent system recovery after files have been encrypted, and the ransomware empties the recycling bin too to prevent any files there from being recovered. The ransom note dropped by the ransomware instructs victims to visit the onion site for additional information (image below). [caption id="attachment_99446" align="aligncenter" width="500"] Termite ransom note[/caption] After leaving the ransom note, the malware encrypts files on the victim machine and appends the ".termite" extension. Termite ransomware can also locate network shares and retrieve information about shared resources on a server, checking for the $ADMIN share and encrypting the files. The ransomware can also identify network drives connected to the infected machine and encrypt the files. 'A New and Growing Threat' The Cyble researchers said Termite ransomware is “a new and growing threat in the cyber landscape, leveraging advanced tactics such as double extortion to maximize its impact on victims. ... The emergence of Termite underscores the critical need for robust cybersecurity measures, proactive threat intelligence, and incident response strategies to counter the evolving tactics of ransomware groups.” The Blue Yonder ransomware attack also delivers a fresh reminder of the attraction of the software supply chain for threat actors, with their ability to infect or disrupt a whole lot of companies in one attack. The full Cyble blog digs deep into Termite ransomware’s processes, including indicators of compromise (IoCs) and MITRE ATT&CK techniques.

image for Kaspersky SIEM impro ...

 Business

In attacks on infrastructure of various companies, cybercriminals are increasingly resorting to manipulating modules that interact with the Local Security Authority (LSA) process. This enables them to steal user credentials, establish persistence in the system, elevate privileges, or extend the attack to other systems   show more ...  

within the target company. Therefore, for the latest quarterly update of our SIEM system, the Kaspersky Unified Monitoring and Analysis Platform, weve added rules designed to detect such attempts. In terms of the MITRE ATT&CK classification, the new rules can detect techniques T1547.002, T1547.005 and T1556.002. What are techniques T1547.002, T1547.005 and T1556.002? Both variants of technique T1547 mentioned above involve using the LSA process to load malicious modules. Sub-technique 002 describes adding malicious dynamic-link libraries (DLLs) with Windows authentication packages, while sub-technique 005 involves DLLs with security support provider (SSP) packages. Loading these modules allows attackers to access the LSA process memory, which can contain critical data such as user credentials. Technique T1556.002 describes a scenario where an attacker registers a malicious password filter DLL in the system. These filters are essentially mechanisms for enforcing password policies. When a legitimate user changes a password or sets a new one, the LSA process compares it against all registered filters, and is forced to handle the passwords in plain text form, i.e., unencrypted. If an attacker manages to introduce a malicious password filter into the system, they can collect passwords with every request. All three techniques involve placing malicious libraries in the C:Windowssystem32 directory and registering them in the system registry under the following keys of the SYSTEMCurrentControlSetControlLSA branch: Authentication Packages for T1547.002, Security Packages for T1547.005, and Notification Packages for T1556.002. How our SIEM counters techniques T1547.002, T1547.005 and T1556.002 To counter these techniques, the Kaspersky Unified Monitoring and Analysis Platform will be updated with rules R154_02–R154_10, which detect, among other things, the following events: Loading of suspicious authentication packages, password filter packages, and security support provider modules using events 4610, 4614 and 4622, respectively. Commands executed in cmd.exe and powershell.exe and aimed at modifying the LSA registry branch and the Authentication Packages, Notification Packages and Security Packages keys. Changes (detected through registry modification event 4657) of the LSA registry branch that could enable a malicious file. Other improvements in the Kaspersky Unified Monitoring and Analysis Platform update In this update, were also introducing rule R999_99, which detects changes in Active Directory accounts critical attributes, such as scriptPath and msTSInitialProgram, which enable various actions to be performed upon login. These attributes set some scripts to execute every time a user logs into the system. This makes them an attractive target for attackers aiming to establish persistence in the network. Tampering with these attributes may indicate unauthorized attempts to gain a foothold in the system or escalate privileges — technique T1037.003 under the MITRE ATT&CK classification. The strategy for detecting these manipulations is to monitor Windows event logs — particularly event 5136. This event records any changes made to objects in Active Directory, including attribute modifications. After the latest update, our SIEM platform will provide over 700 rules. Thus, by the end of 2024, our solution will cover 400 MITRE ATT&CK techniques. Of course, were not aiming to create rules to detect every technique described in the matrix. A significant portion of them cannot be fully addressed due to their nature — for example, ones involving actions performed outside the protected perimeter or the techniques not fully covered by SIEM solutions by definition. However, in the fourth quarter of this year, weve focused on further expanding the coverage of MITRE ATT&CK techniques while enhancing the detection logic for already covered techniques. New and improved normalizers In the latest update, weve also added normalizers to our SIEM system that support the following event sources: [OOTB] McAfee Endpoint DLP syslog [OOTB] LastLine Enterprise syslog cef [OOTB] MongoDb syslog [OOTB] GajShield Firewall syslog [OOTB] Eltex ESR syslog [OOTB] Linux auditd syslog for KUMA 3.2 [OOTB] Barracuda Cloud Email Security Gateway syslog [OOTB] Yandex Cloud [OOTB] InfoWatch Person Monitor SQL [OOTB] Kaspersky Industrial CyberSecurity for Networks 4.2 syslog In addition, our experts have improved the following normalizers: [OOTB] Microsoft Products via KES WIN [OOTB] Microsoft Products for KUMA 3 [OOTB] KSC from SQL [OOTB] Ideco UTM syslog [OOTB] KEDR telemetry [OOTB] Vipnet TIAS syslog [OOTB] PostgreSQL pgAudit syslog [OOTB] KSC PostgreSQL [OOTB] Linux auditd syslog for KUMA 3.2 The full list of supported event sources in Kaspersky Unified Monitoring and Analysis Platform 3.4 can be found in the Online Help, where you can also find information on correlation rules. In our blog you can also read about the updates for our SIEM platform for the first, second and third quarters of 2024. To learn more about our SIEM system, the Kaspersky Unified Monitoring and Analysis Platform, please visit the official product page.

 Feed

The threat actor known as Gamaredon has been observed leveraging Cloudflare Tunnels as a tactic to conceal its staging infrastructure hosting a malware called GammaDrop. The activity is part of an ongoing spear-phishing campaign targeting Ukrainian entities since at least early 2024 that's designed to drop the Visual Basic Script malware, Recorded Future's Insikt Group said in a new analysis.

 Feed

The threat actors behind the More_eggs malware have been linked to two new malware families, indicating an expansion of its malware-as-a-service (MaaS) operation. This includes a novel information-stealing backdoor called RevC2 and a loader codenamed Venom Loader, both of which are deployed using VenomLNK, a staple tool that serves as an initial access vector for the deployment of follow-on

 Feed

Cybersecurity researchers have disclosed multiple security flaws impacting open-source machine learning (ML) tools and frameworks such as MLflow, H2O, PyTorch, and MLeap that could pave the way for code execution. The vulnerabilities, discovered by JFrog, are part of a broader collection of 22 security shortcomings the supply chain security company first disclosed last month. Unlike the first

 Feed

The modern business landscape is thrilling yet daunting. Rapidly evolving technology, persistent cyberthreats and escalating operational complexities make data protection and seamless business continuity challenging for businesses of all sizes. Your organization needs robust security measures that go beyond traditional backup solutions to address the intricacies of today’s complex IT ecosystems.

 Feed

A Russian programmer accused of donating money to Ukraine had his Android device secretly implanted with spyware by the Federal Security Service (FSB) after he was detained earlier this year. The findings come as part of a collaborative investigation by First Department and the University of Toronto's Citizen Lab. "The spyware placed on his device allows the operator to track a target device's

 Cyber Security News

Source: go.theregister.com – Author: Thomas Claburn Malware-poisoned versions of the widely used JavaScript library @solana/web3.js were distributed via the npm package registry, according to an advisory issued Wednesday by project maintainer Steven Luscher. An advisory, covering CVE-2024-54134 (CVSS-B: 8.3   show more ...  

High), explains that a hijacked @solana account with permission to publish the library was used to […] La entrada Solana blockchain’s popular web3.js npm package backdoored to steal keys, funds – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Annaliese Ingrams Webinar Managing endpoints in today’s dynamic IT environments is becoming increasingly complex. With a growing number of devices and constant software updates, IT teams can find themselves overwhelmed by manual patching and vulnerability management   show more ...  

processes. On December 9th at 9am PT/12PM ET/6pm GMT, join The Register’s Tim Phillips as […] La entrada Explore strategies for effective endpoint control – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 British

Source: go.theregister.com – Author: Connor Jones Both National Health Service trusts that oversee the various hospitals hit by separate cyberattacks last week have confirmed they’re still in the process of restoring systems. NHS Wirral University Teaching Hospital, which also looks after the nearby   show more ...  

Clatterbridge and Arrowe Park hospitals, downgraded its “major incident” to a “business […] La entrada British hospitals hit by cyberattacks still battling to get systems back online – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: go.theregister.com – Author: Connor Jones BT Group confirmed it is dealing with an attempted attack on one of its legacy business units after the Black Basta ransomware group claimed they broke in. Black Basta posted “BT Group” on its data leak site on Wednesday, although it wouldn’t be   show more ...  

the first time these types of […] La entrada BT Group confirms attackers tried to break into Conferencing division – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Contributed by the SANS Institute and the Department for Science, Innovation and Technology Partner Content The opportunity to identify, foster and nurture talented young people towards a cyber security career should always be grabbed with both hands. Industry is invited to   show more ...  

shape the future of young cyber professionals by sponsoring the […] La entrada Shape the future of UK cyber security – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Connor Jones Two US subsidiaries of alcohol giant Stoli Group filed for bankruptcy protection this week over financial difficulties exacerbated by an August ransomware attack. Charles Caldwell, CEO at Stoli USA and Kentucky Owl (KO), told the bankruptcy court in Dallas,   show more ...  

Texas, that they faced more than $84 million in debts. […] La entrada Ransomware hangover, Putin grudge blamed for vodka maker’s bankruptcy – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Waqas. SUMMARY Network Access: Chinese hackers maintained access to a major U.S. company’s network for at least four months, likely stealing sensitive information, including emails. Techniques Used: Hackers employed DLL sideloading, exploited Google and Apple software, and used   show more ...  

tools like Impacket and FileZilla to move within the network. Targeted Data: The […] La entrada Chinese Hackers Breach US Firm, Maintain Network Access for Months – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: CyberNewswire. One Identity named Hot Company: Privileged Access Management (PAM) in 12th Cyber Defense Magazine’s Annual InfoSec Awards during CyberDefenseCon 2024. One Identity proudly announces it has been named a winner in the Hot Company: Privileged Access Management   show more ...  

(PAM) category in the 12th annual Cyber Defense Awards by Cyber Defense Magazine (CDM), the industry’s […] La entrada One Identity Named Winner of the Coveted Top InfoSec Innovator Awards for 2024 – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. SUMMARY Manson Market Takedown: Europol and international law enforcement dismantled the notorious Manson Market cybercrime platform, disrupting phishing networks and seizing stolen data. Sophisticated Marketplace: Manson Market allowed cybercriminals to buy and sell   show more ...  

stolen data with advanced filtering options, facilitating targeted fraud and financial crimes. Phishing Scams Uncovered: Investigators […] La entrada Police Dismantle Manson Market, Seize 50 Servers and 200TB Evidence – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Owais Sultan. eCommerce has become an essential part of our daily lives with hundreds of thousands of stores powered by Shopify, Magento, and WooCommerce. According to Mangosoft, a custom ecommerce application development firm, as of the end of Q2 2024, there are approximately   show more ...  

30,722,000 ecommerce sites worldwide, and approximately 88% of US consumers have […] La entrada The Future of eCommerce: How Custom Apps Help You Get Ahead of the Competition – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blog

Source: socprime.com – Author: Veronika Telychko New day, a new menace for cyber defenders. Recently, security researchers from ThreatLabz have uncovered two novel malicious strains adding to the 100 million count of those already identified in 2024. As per reports, the newly revealed RevC2 and Venom Loader   show more ...  

have been making the rounds since the summer […] La entrada RevC2 and Venom Loader Detection: New Malware Strains Massively Deployed via MaaS in a Sophisticated Campaign – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.lastwatchdog.com – Author: cybernewswire Alisa Viejo, Calif., Dec. 5, 2024, CyberNewswire — One Identity proudly announces it has been named a winner in the Hot Company: Privileged Access Management (PAM) category in the 12th annual Cyber Defense Awards by Cyber Defense Magazine (CDM), the   show more ...  

industry’s leading information security magazine. Logan “We are deeply honored […] La entrada News alert: One Identity wins 2024 Cyber Defense Award: Hot Company – PAM category – Source: www.lastwatchdog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 critical infrastructure

Source: www.csoonline.com – Author: The manufacturing sector remains a prominent target for cybercriminals, due to complex supply chains, legacy industry control and IoT systems, and a lack of appetite for downtime. The manufacturing sector’s rapid digital transformation, complex supply chains, and reliance   show more ...  

on third-party vendors make for a challenging cyber threat environment for CISOs. Manufacturers […] La entrada 8 biggest cybersecurity threats manufacturers face – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: News 06 Dezember 20243 Minuten CyberkriminalitätGenerative AIMacOS-Sicherheit Die Mac-Flotten von Unternehmen könnten für Cyberkriminelle deutlich attraktivere Ziele darstellen als bislang angenommen. MacOS galt lange als „Malware-frei“. Eine Studie legt nahe: Diese   show more ...  

Zeiten sind längst vorbei. Zyracuze | shutterstock.com MacOS und das Apple-Ökosystem allgemein gelten sowohl unter Benutzern als auch unter Experten […] La entrada Sind Macs noch sicher? – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Ransomware remains one of the biggest cyber threats to companies today. In a survey by security provider Cohesity, 83% of respondents said they were affected by a ransomware attack in the first half of 2024. According to security experts, there is no relief in sight for 2025   show more ...  

either. But according to security […] La entrada Data deletion enters the ransomware chat – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Vorsicht, dieses Film-Listicle kann zu Prokrastination verführen! Nomad Soul | shutterstock.com Security-Profis und -Entscheider mit Hang zur Filmkunst müssen auch nach Feierabend nicht auf ihr Leib-und-Magen-Thema verzichten – einer Fülle cineastischer Ergüsse sei   show more ...  

Dank. Das Film-Pflichtprogramm für Security-Profis Wir haben die unserer Meinung nach besten (Achtung: Nerd-Brille erforderlich) Hacker-Filme nachfolgend für […] La entrada Die besten Hacker-Filme – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: News 05 Dec 20245 mins Patch Management SoftwareThreat and Vulnerability Management Though only 27% of decision makers surveyed have deployed one of these solutions now, analyst says their use is a best practice. Failing to patch vulnerabilities keeps biting CISOs. The most   show more ...  

recent evidence: Last month, the Five Eyes cybersecurity agencies […] La entrada CISOs still cautious about adopting autonomous patch management solutions – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Application Security

Source: www.csoonline.com – Author: Guarding the gateways—it’s time to strengthen API security in cloud-native applications. Learn more today. Despite their capabilities and benefits, cloud-native applications also present several security challenges. Application programming interfaces (APIs) are among the   show more ...  

top areas of risk for these applications. This isn’t surprising. As organizations look to enhance connections between digital […] La entrada Securing cloud-native applications: Why a comprehensive API security strategy is essential – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Application Security

Source: www.csoonline.com – Author: News 05 Dec 20245 mins Application SecurityThreat and Vulnerability ManagementVulnerabilities Researchers released a proof-of-concept exploit for a path traversal flaw in the enterprise VoIP suite that, coupled with an arbitrary file read issue, can give attackers access to   show more ...  

protected files, among other possible attack paths. Security researchers have discovered a new […] La entrada Mitel MiCollab VoIP authentication bypass opens new attack paths – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: The challenges facing branch networks are multifaceted, requiring IT leaders to address increased demand, growing complexity, and IoT exposure while ensuring robust security. As organizations embrace digital transformation, branch offices have become critical hubs for   show more ...  

innovation and operations. They host diverse devices, users, and cloud-enabled applications that drive business agility and […] La entrada Solving networking and security challenges in the modern branch – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: cyble.com – Author: Cyble. Overview  Two Russian hacktivist groups are increasingly targeting critical infrastructure in the U.S. and elsewhere, and their attacks go well beyond the DDoS attacks and website defacements that hacktivist groups typically engage in.  The groups – the People’s Cyber   show more ...  

Army and Z-Pentest – have posted videos to their Telegram channels […] La entrada Russian Hacktivists Increasingly Tamper with Energy and Water System Controls – Source:cyble.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: cyble.com – Author: Cyble. Overview  The Cybersecurity and Infrastructure Security Agency (CISA) has recently updated its Known Exploited Vulnerabilities (KEV) Catalog, adding three critical flaws that are currently being actively exploited. These vulnerabilities impact a range of products, from   show more ...  

industrial control systems (ICS) to web-based applications. The newly added vulnerabilities include CVE-2023-45727, CVE-2024-11680, and […] La entrada CISA Updates Known Exploited Vulnerabilities Catalog, Adding 3 Critical Flaws – Source:cyble.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: cyble.com – Author: Cyble. Overview  The European Union’s cybersecurity framework continues to evolve in response to mounting threats, rapid digital transformation, and complex geopolitical challenges. The 2024 ENISA report on “The State of Cybersecurity in the Union” offers an evidence-based   show more ...  

assessment of Europe’s cybersecurity maturity, capabilities, and the measures needed to address pressing challenges.   […] La entrada The State of Cybersecurity in the European Union 2024: Insights from ENISA’s Report – Source:cyble.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Ransomware group Brain Cipher claimed to have breached Deloitte UK and threatened to publish the data it had stolen earlier this week. However, despite the claims, a Deloitte spokesperson told Infosecurity that its investigation indicates that the allegations   show more ...  

relate to a single client’s system which sits outside of the Deloitte network. […] La entrada Deloitte Denies Breach, Claims Cyber-Attack Targeted Single Client – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A European law enforcement operation has dismantled a criminal marketplace that facilitates large-scale online fraud, Europol has announced. Coordinated actions were carried out across Europe on December 4, resulting in the takedown of infrastructure linked to a   show more ...  

specialized online marketplace that operated as a central hub for the trade of illegally […] La entrada Europol Dismantles Major Online Fraud Platform in Major Blow to Fraudsters – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A supply chain attack on the widely used @solana/web3.js npm library, targeting private keys to steal funds, has put developers and cryptocurrency users at risk. The malicious versions, 1.95.6 and 1.95.7, were published briefly on December 2 2024, but have since   show more ...  

been removed. The attack exploited the library’s maintainers, likely through phishing, allowing […] La entrada Solana Library Supply Chain Attack Exposes Cryptocurrency Wallets – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Two severe vulnerabilities in Veeam Service Provider Console (VSPC) software have been patched, including one with a near-maximum CVSS score of 9.9. The issues, designated as CVE-2024-42448 and CVE-2024-42449, were identified during internal testing by Veeam. Both   show more ...  

flaws pose significant risks to system integrity, requiring immediate attention from affected service providers. […] La entrada Veeam Urges Immediate Update to Patch Severe Vulnerabilities – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. For the fifth year in a row, HackerOne published a report that provides insights from the world’s largest database of vulnerabilities and bug bounty customer programs. Here are the top five findings: The adoption of ethical hacker programs is growing across all   show more ...  

industries, with a 34% increase in total customer […] La entrada Top 5 Takeaways from the 2021 Hacker-Powered Security Report: Industry Insights – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. Updated September 1, 2023 Are you wondering about CWE? We explain CWE (Common Weakness Enumeration) and why this community-based initiative is essential in cybersecurity. Common Weakness Enumeration (CWE) is a system to categorize software and hardware security   show more ...  

flaws—implementation defects that can lead to vulnerabilities. It is a community project to […] La entrada CWE (Common Weakness Enumeration) and the CWE Top 25 Explained – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. This post is about the severe and widespread Log4j vulnerability, known as Log4Shell. It gives a technical overview of the vulnerability, mitigations HackerOne has put in place to protect our platform and customers, and the related vulnerability submission   show more ...  

activity HackerOne is seeing on its platform. HackerOne will continually update this with […] La entrada Log4j Vulnerability Activity on the HackerOne Platform – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: Debbie Cotton. Recognizing team members’ unique strengths and abilities is crucial for achieving optimal performance.  Employees at HackerOne utilize the Working Genius model, which provides individuals and teams with a straightforward, practical, and effective   show more ...  

framework for leveraging each other’s natural talents. This approach enhances productivity and minimizes unnecessary criticism. Developed by Patrick […] La entrada Harnessing the Working Genius for Team Success – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Thomas Claburn A US federal appeals court has rejected a challenge to the law that prevents popular apps that collect data on Americans from being controlled by a foreign adversary. The decision puts the ongoing operation of social media network TikTok, a subsidiary of   show more ...  

China-based ByteDance, at risk. Unless the ruling […] La entrada Facing sale or ban, TikTok tossed under national security bus by appeals court – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Dan Robinson The head of America’s Federal Communications Commission (FCC) wants to force telecoms operators to tighten network security in the wake of the Salt Typhoon revelations, and to submit an annual report detailing measures taken. Jessica Rosenworcel, outgoing   show more ...  

chair of the US telecoms regulator, has proposed rules that would require […] La entrada Salt Typhoon forces FCC’s hand on making telcos secure their networks – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Badass

Source: go.theregister.com – Author: Connor Jones A Russian programmer defied the Federal Security Service (FSB) by publicizing the fact his phone was infected with spyware after being confiscated by authorities. Kirill Parubets was detained in Russia for 15 days after being accused of sending money to Ukraine,   show more ...  

during which time the man was beaten and […] La entrada Badass Russian techie outsmarts FSB, flees Putinland all while being tracked with spyware – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: David Gordon Sponsored Post According to the 2024 IBM Cost of the Data Breach Report 40 percent of data breaches identified between March 2023 and February 2024 involved data stored across multiple environments, including the cloud. What’s more, the cost of   show more ...  

breached data stored in public clouds during that period incurred the […] La entrada Protect your clouds – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Jessica Lyons updated A zero-day arbitrary file read vulnerability in Mitel MiCollab can be chained with a now-patched critical bug in the same platform to give attackers access to sensitive files on vulnerable instances.  A proof-of-concept (PoC) exploit that strings   show more ...  

together the two flaws, both spotted and disclosed to Mitel by […] La entrada PoC exploit chains Mitel MiCollab 0-day, auth-bypass bug to access sensitive files – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Jessica Lyons A Chinese government-linked group that Microsoft tracks as Storm-2077 has been actively targeting critical organizations and US government agencies as of yesterday, according to Redmond’s threat intel team. The new-ish crew has been around since at least   show more ...  

January, and while Microsoft declined to enumerate Storm-2077’s victim count, “there are […] La entrada Microsoft: Another Chinese cyberspy crew targeting US critical orgs ‘as of yesterday’ – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 APT

Source: securelist.com – Author: Alexander Kolesnikov Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly   show more ...  

used subsystems. For example, a log integrity check is set to appear in […] La entrada Exploits and vulnerabilities in Q3 2024 – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cryptohack

Source: www.govinfosecurity.com – Author: Blockchain & Cryptocurrency , Cryptocurrency Fraud , Fraud Management & Cybercrime Also, Man Who Stole $3.5M of Cloud Computing to Mine $1M in Crypto Pleads Guilty Prajeet Nair (@prajeetspeaks) • December 5, 2024     Image: Shutterstock Every week, ISMG   show more ...  

rounds up cybersecurity incidents in digital assets. This week, malicious npm […] La entrada Cryptohack Roundup: Solana npm Package Attack’s Wallet Risks – Source: www.govinfosecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-12
Aggregator history
Friday, December 06
SUN
MON
TUE
WED
THU
FRI
SAT
DecemberJanuaryFebruary