Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Head Mare Targets Ru ...

 Cyber News

Cyble researchers have detected a new campaign targeting Russia by the hacktivist group Head Mare that uses a disguised LNK file to hide an executable. The campaign is also noteworthy for its ability to download additional payloads – including ransomware – and escalate a compromise via specific commands and   show more ...  

payloads, Cyble Research and Intelligence Labs (CRIL) researchers wrote in a blog post published today. “The group’s ability to collect victim data and deploy additional payloads, including ransomware, highlights the ongoing threat it poses,” the Cyble researchers said. Head Mare Emerges from War with Ukraine Head Mare emerged following Russia’s invasion of Ukraine as one of “numerous hacktivist groups whose main goal is often not financial gain but causing as much damage as possible to companies on the opposing side of the conflict.,” Kaspersky researchers wrote in a blog post earlier this year. Head Mare maintains a presence on X where it discusses its exploits. The group’s latest campaign uses a ZIP archive that contains both a malicious LNK file and an executable. “The executable is cleverly disguised as an archive file to deceive users and facilitate its malicious operations,” Cyble said. The LNK file contains commands to extract and execute the PhantomCore backdoor, which has switched from Golang to C++-compiled binaries and also includes the Boost.Beast library to communicate with the command-and-control (C&C) server. PhantomCore collects the victim’s information before deploying payloads – which often includes LockBit and Babuk ransomware – or executing additional commands on the compromised system. Head Mare has targeted Russia and Belarus by exploiting vulnerabilities such as the CVE-2023-38831 WinRAR vulnerability for initial access and to deliver malicious payloads. The group differs from other hacktivists in that it often demands a ransom from victims. Also read: New Russian Threat Group Z-Pentest Targets Energy System Controls Head Mare’s Latest Campaign In the latest campaign, Cyble discovered a ZIP archive named “Doc.Zip” that contained a malicious LNK file, an executable camouflaged as a “.zip” file extension (“Doc.zip”) that was identified as PhantomCore, and a corrupted lure PDF. The ZIP archive “Doc.zip,” downloaded from the file-sharing website filetransfer[.]io/data-package/AiveGg6u/download, “is suspected to have been delivered to the victim via a spam email,” Cyble said, likely with a social engineering theme designed to appear legitimate. All the files within the archive are in Russian, Cyble noted. Upon execution, the LNK file executes a PowerShell command that extracts the “Doc.Zip” archive into the “C:/ProgramData” directory and executes the file “Doc.zip” using cmd.exe. After executing, the Doc.zip file sets both the input and output code pages to OEM Russian (Cyrillic) using the SetConsoleCP and SetConsoleOutputCP Win32 APIs. It also sets the locale language of the victim machine to “ru_RU.UTF-8” to configure the system to use the Russian locale with UTF-8 encoding, Cyble said. The malware then attempts to connect to the C&C server at 45.10.247[.]152 using the User-Agent string “Boost.Beast/353”. After a successful connection is established, the malware gathers the victim’s information, such as the public IP address, Windows version, username, and other details, and sends them to a C&C server to await further instructions. “Moreover, the TA can execute commands on the victim’s machine and download additional payloads from the C&C server,” Cyble said. “This enables them to escalate the compromise, conduct further malicious activities, or expand the attack by deploying specific commands and payloads.” The full Cyble blog contains MITRE ATT&CK techniques and 24 Indicators of Compromise (IoCs), and the researchers also shared Yara and Sigma rules on GitHub to detect the campaign.

image for Microsoft December P ...

 Firewall Daily

Microsoft’s December Patch Tuesday update, the last one of 2024, addresses a massive number of vulnerabilities, including 71 newly identified flaws across various products. As part of the regular December Patch Tuesday, Microsoft has responded to a number of critical security issues, several of which have been   show more ...  

actively exploited in the wild. Notable among the vulnerabilities patched this month is CVE-2024-49138, a zero-day flaw in the Windows Common Log File System (CLFS) driver 2024 has been a milestone year for Microsoft in terms of the number of vulnerabilities addressed. With a total of 1,009 Common Vulnerabilities and Exposures (CVEs) patched throughout the year, this marks the maximum number of vulnerabilities addressed. Although Microsoft has not yet surpassed its record of 1,245 CVEs patched in 2020, 2024 is only the second year in Patch Tuesday history where the company has exceeded the 1,000 mark. Overview of Microsoft Patch Tuesday December 2024 The latest data highlights that nearly 40% of the vulnerabilities fixed in 2024 were remote code execution (RCE) flaws, while 29% were elevation of privilege vulnerabilities, and 10% were denial of service issues. According to the advisory, a majority of these vulnerabilities were rated as "important," with a smaller portion categorized as "critical."  In its December Patch Tuesday update, Microsoft addressed a broad spectrum of vulnerabilities, including 27 elevation of privilege issues, 30 remote code execution flaws, 7 information disclosure vulnerabilities, 5 denial of service bugs, and 1 spoofing vulnerability. Among these, CVE-2024-49138 stands out as the most critical and urgent, particularly due to its exploitation in the wild.  CVE-2024-49138: A Zero-Day Elevation of Privilege Flaw CVE-2024-49138, an elevation of privilege vulnerability in the Windows CLFS driver, is the most notable issue addressed this month. This flaw has been actively exploited as a zero-day, meaning attackers were leveraging it before Microsoft issued a fix. The vulnerability is particularly malicious due to its potential for granting SYSTEM-level privileges to an attacker. The CLFS driver is a critical component of the Windows operating system, used for general-purpose logging by both user-mode and kernel-mode software.  The flaw is classified as a heap-based buffer overflow (CWE-122), a common type of vulnerability that can lead to crashes, denial of service, or even remote code execution. CVE-2024-49138 is the ninth CLFS-related vulnerability patched this year and the first to be actively exploited in the wild. Microsoft has rated this issue as "important," with a CVSSv3 score of 7.8.  In his analysis of this vulnerability, Satnam Narang, Senior Staff Research Engineer at Tenable, remarked, “In its final Patch Tuesday of 2024, Microsoft addressed CVE-2024-49138, an elevation of privilege zero-day in the Windows CLFS Driver, which is the lone flaw in this month’s release with the ‘exploited’ label.” Narang noted that ransomware operators have been particularly focused on exploiting CLFS vulnerabilities in recent years. These vulnerabilities enable them to move laterally across networks, stealing data, encrypting files, and extorting victims.  CVE-2024-49070: A Remote Code Execution Vulnerability in Microsoft SharePoint Another issue patched this month is CVE-2024-49070, a remote code execution vulnerability affecting Microsoft SharePoint. This vulnerability has been assigned a CVSSv3 score of 7.4 and is rated as "important." Successful exploitation of this vulnerability requires high complexity, as the attacker needs to prepare the target to ensure exploit reliability. Despite this, Microsoft assessed the exploitability of this flaw as "More Likely."  Additionally, Microsoft addressed other vulnerabilities in SharePoint, including two information disclosure flaws (CVE-2024-49062, CVE-2024-49064) and another elevation of privilege issue (CVE-2024-49068).  CVE-2024-49118 and CVE-2024-49122: Critical RCE Vulnerabilities in Microsoft Message Queuing Two other critical vulnerabilities patched in December’s release affect Microsoft Message Queuing (MSMQ). Both CVE-2024-49118 and CVE-2024-49122 are remote code execution flaws with a CVSSv3 score of 8.1, rated as "critical." These flaws require an attacker to exploit a race condition, but the exploitation is not always easy to achieve, as it depends on specific operations that occur infrequently. These vulnerabilities bring the total number of RCE flaws affecting MSMQ to six, with previous patches issued earlier in the year for related vulnerabilities.  Several critical vulnerabilities were also addressed in Windows Remote Desktop Services, including CVE-2024-49106, CVE-2024-49108, and others. These flaws are remote code execution vulnerabilities that could allow an attacker to exploit a race condition and create a use-after-free scenario, leading to arbitrary code execution.   The Bigger Picture: Ransomware and Exploits in 2024 In 2024, Microsoft has patched a total of 22 zero-day vulnerabilities, many of which have been actively exploited by threat actors. Narang highlighted that nearly 40% of these were remote code execution flaws, denoting the growing risks of RCE vulnerabilities. Ransomware operators, in particular, have developed a penchant for exploiting elevation of privilege flaws, such as those in the CLFS driver, to escalate their privileges and execute their attacks more effectively.  The December 2024 Patch Tuesday marks an important update from Microsoft, addressing a range of security vulnerabilities that could have serious implications for users and organizations alike. From zero-day exploits like CVE-2024-49138 to critical vulnerabilities in Microsoft SharePoint and Remote Desktop Services, this month's patching efforts highlights the ongoing efforts by cybersecurity professionals.  

image for How Cryptocurrency T ...

 A Little Sunshine

A financial firm registered in Canada has emerged as the payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services aimed at Russian-speaking customers, new research finds. Meanwhile, an investigation into the Vancouver street address used by this company shows it is home   show more ...  

to dozens of foreign currency dealers, money transfer businesses, and cryptocurrency exchanges — none of which are physically located there. Richard Sanders is a blockchain analyst and investigator who advises the law enforcement and intelligence community. Sanders spent most of 2023 in Ukraine, traveling with Ukrainian soldiers while mapping the shifting landscape of Russian crypto exchanges that are laundering money for narcotics networks operating in the region. More recently, Sanders has focused on identifying how dozens of popular cybercrime services are getting paid by their customers, and how they are converting cryptocurrency revenues into cash. For the past several months, he’s been signing up for various cybercrime services, and then tracking where their customer funds go from there. The 122 services targeted in Sanders’ research include some of the more prominent businesses advertising on the cybercrime forums today, such as: -abuse-friendly or “bulletproof” hosting providers like anonvm[.]wtf, and PQHosting; -sites selling aged email, financial, or social media accounts, such as verif[.]work and kopeechka[.]store; -anonymity or “proxy” providers like crazyrdp[.]com and rdp[.]monster; -anonymous SMS services, including anonsim[.]net and smsboss[.]pro. The site Verif dot work, which processes payments through Cryptomus, sells financial accounts, including debit and credit cards. Sanders said he first encountered some of these services while investigating Kremlin-funded disinformation efforts in Ukraine, as they are all useful in assembling large-scale, anonymous social media campaigns. According to Sanders, all 122 of the services he tested are processing transactions through a company called Cryptomus, which says it is a cryptocurrency payments platform based in Vancouver, British Columbia. Cryptomus’ website says its parent firm — Xeltox Enterprises Ltd. (formerly certa-pay[.]com) — is registered as a money service business (MSB) with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). Sanders said the payment data he gathered also shows that at least 56 cryptocurrency exchanges are currently using Cryptomus to process transactions, including financial entities with names like casher[.]su, grumbot[.]com, flymoney[.]biz, obama[.]ru and swop[.]is. These platforms are built for Russian speakers, and they each advertise the ability to anonymously swap one form of cryptocurrency for another. They also allow the exchange of cryptocurrency for cash in accounts at some of Russia’s largest banks — nearly all of which are currently sanctioned by the United States and other western nations. A machine-translated version of Flymoney, one of dozens of cryptocurrency exchanges apparently nested at Cryptomus. An analysis of their technology infrastructure shows that all of these exchanges use Russian email providers, and most are directly hosted in Russia or by Russia-backed ISPs with infrastructure in Europe (e.g. Selectel, Netwarm UK, Beget, Timeweb and DDoS-Guard). The analysis also showed nearly all 56 exchanges used services from Cloudflare, a global content delivery network based in San Francisco. “Purportedly, the purpose of these platforms is for companies to accept cryptocurrency payments in exchange for goods or services,” Sanders told KrebsOnSecurity. “Unfortunately, it is next to impossible to find any goods for sale with websites using Cryptomus, and the services appear to fall into one or two different categories: Facilitating transactions with sanctioned Russian banks, and platforms providing the infrastructure and means for cyber attacks.” Cryptomus did not respond to multiple requests for comment. PHANTOM ADDRESSES? The Cryptomus website and its FINTRAC listing say the company’s registered address is Suite 170, 422 Richards St. in Vancouver, BC. This address was the subject of an investigation published in July by CTV National News and the Investigative Journalism Foundation (IJF), which documented dozens of cases across Canada where multiple MSBs are incorporated at the same address, often without the knowledge or consent of the location’s actual occupant. This building at 422 Richards St. in downtown Vancouver is the registered address for 90 money services businesses, including 10 that have had their registrations revoked. Image: theijf.org/msb-cluster-investigation. Their inquiry found 422 Richards St. was listed as the registered address for at least 76 foreign currency dealers, eight MSBs, and six cryptocurrency exchanges. At that address is a three-story building that used to be a bank and now houses a massage therapy clinic and a co-working space. But they found none of the MSBs or currency dealers were paying for services at that co-working space. The reporters found another collection of 97 MSBs clustered at an address for a commercial office suite in Ontario, even though there was no evidence these companies had ever arranged for any business services at that address. Peter German, a former deputy commissioner for the Royal Canadian Mounted Police who authored two reports on money laundering in British Columbia, told the publications it goes against the spirit of Canada’s registration requirements for such businesses, which are considered high-risk for money laundering and terrorist financing. “If you’re able to have 70 in one building, that’s just an abuse of the whole system,” German said. Ten MSBs registered to 422 Richard St. had their registrations revoked. One company at 422 Richards St. whose registration was revoked this year had a director with a listed address in Russia, the publications reported. “Others appear to be directed by people who are also directors of companies in Cyprus and other high-risk jurisdictions for money laundering,” they wrote. A review of FINTRAC’s registry (.CSV) shows many of the MSBs at 422 Richards St. are international money transfer or remittance services to countries like Malaysia, India and Nigeria. Some act as currency exchanges, while others appear to sell merchant accounts and online payment services. Still, KrebsOnSecurity could find no obvious connections between the 56 Russian cryptocurrency exchanges identified by Sanders and the dozens of payment companies that FINTRAC says share an address with the Cryptomus parent firm Xeltox Enterprises. SANCTIONS EVASION In August 2023, Binance and some of the largest cryptocurrency exchanges responded to sanctions against Russia by cutting off many Russian banks and restricting Russian customers to transactions in Rubles only. Sanders said prior to that change, most of the exchanges currently served by Cryptomus were handling customer funds with their own self-custodial cryptocurrency wallets. By September 2023, Sanders said he found the exchanges he was tracking had all nested themselves like Matryoshka dolls at Cryptomus, which adds a layer of obfuscation to all transactions by generating a new cryptocurrency wallet for each order. “They all simply moved to Cryptomus,” he said. “Cryptomus generates new wallets for each order, rendering ongoing attribution to require transactions with high fees each time.” “Exchanges like Binance and OKX removing Sberbank and other sanctioned banks and offboarding Russian users did not remove the ability of Russians to transact in and out of cryptocurrency easily,” he continued. “In fact, it’s become easier, because the instant-swap exchanges do not even have Know Your Customer rules. The U.S. sanctions resulted in the majority of Russian instant exchanges switching from their self-custodial wallets to platforms, especially Cryptomus.” Russian President Vladimir Putin in August signed a new law legalizing cryptocurrency mining and allowing the use of cryptocurrency for international payments. The Russian government’s embrace of cryptocurrency was a remarkable pivot: Bloomberg notes that as recently as January 2022, just weeks before Russia’s full-scale invasion of Ukraine, the central bank proposed a blanket ban on the use and creation of cryptocurrencies. In a report on Russia’s cryptocurrency ambitions published in September, blockchain analysis firm Chainalysis said Russia’s move to integrate crypto into its financial system may improve its ability to bypass the U.S.-led financial system and to engage in non-dollar denominated trade. “Although it can be hard to quantify the true impact of certain sanctions actions, the fact that Russian officials have singled out the effect of sanctions on Moscow’s ability to process cross-border trade suggests that the impact felt is great enough to incite urgency to legitimize and invest in alternative payment channels it once decried,” Chainalysis assessed. Asked about its view of activity on Cryptomus, Chainanlysis said Cryptomus has been used by criminals of all stripes for laundering money and/or the purchase of goods and services. “We see threat actors engaged in ransomware, narcotics, darknet markets, fraud, cybercrime, sanctioned entities and jurisdictions, and hacktivism making deposits to Cryptomus for purchases but also laundering the services using Cryptomos payment API,” the company said in a statement. SHELL GAMES It is unclear if Cryptomus and/or Xeltox Enterprises have any presence in Canada at all. A search in the United Kingdom’s Companies House registry for Xeltox’s former name — Certa Payments Ltd. — shows an entity by that name incorporated at a mail drop in London in December 2023. The sole shareholder and director of that company is listed as a 25-year-old Ukrainian woman in the Czech Republic named Vira Krychka. Ms. Krychka was recently appointed the director of several other new U.K. firms, including an entity created in February 2024 called Globopay UAB Ltd, and another called WS Management and Advisory Corporation Ltd. Ms. Krychka did not respond to a request for comment. WS Management and Advisory Corporation bills itself as the regulatory body that exclusively oversees licenses of cryptocurrencies in the jurisdiction of Western Sahara, a disputed territory in northwest Africa. Its website says the company assists applicants with bank setup and formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. One of Certa Payments’ former websites — certa[.]website — also shared a server with 12 other domains, including rasd-state[.]ws, a website for the Central Reserve Authority of the Western Sahara. The website crasadr dot com, the official website of the Central Reserve Authority of Western Sahara. This business registry from the Czech Republic indicates Ms. Krychka works as a director at an advertising and marketing firm called Icon Tech SRO, which was previously named Blaven Technologies (Blaven’s website says it is an online payment service provider). In August 2024, Icon Tech changed its name again to Mezhundarondnaya IBU SRO, which describes itself as an “experienced company in IT consulting” that is based in Armenia. The same registry says Ms. Krychka is somehow also a director at a Turkish investment venture. So much business acumen at such a young age! For now, Canada remains an attractive location for cryptocurrency businesses to set up shop, at least on paper. The IJF and CTV News found that as of February 2024, there were just over 3,000 actively registered MSBs in Canada, 1,247 of which were located at the same building as at least one other MSB. “That analysis does not include the roughly 2,700 MSBs whose registrations have lapsed, been revoked or otherwise stopped,” they observed. “If they are included, then a staggering 2,061 out of 5,705 total MSBs share a building with at least one other MSB.”

image for Patch Tuesday, Decem ...

 Other

Microsoft today released updates to plug at least 70 security holes in Windows and Windows software, including one vulnerability that is already being exploited in active attacks. The zero-day seeing exploitation involves CVE-2024-49138, a security weakness in the Windows Common Log File System (CLFS) driver —   show more ...  

used by applications to write transaction logs — that could let an authenticated attacker gain “system” level privileges on a vulnerable Windows device. The security firm Rapid7 notes there have been a series of zero-day elevation of privilege flaws in CLFS over the past few years. “Ransomware authors who have abused previous CLFS vulnerabilities will be only too pleased to get their hands on a fresh one,” wrote Adam Barnett, lead software engineer at Rapid7. “Expect more CLFS zero-day vulnerabilities to emerge in the future, at least until Microsoft performs a full replacement of the aging CLFS codebase instead of offering spot fixes for specific flaws.” Elevation of privilege vulnerabilities accounted for 29% of the 1,009 security bugs Microsoft has patched so far in 2024, according to a year-end tally by Tenable; nearly 40 percent of those bugs were weaknesses that could let attackers run malicious code on the vulnerable device. Rob Reeves, principal security engineer at Immersive Labs, called special attention to CVE-2024-49112, a remote code execution flaw in the Lightweight Directory Access Protocol (LDAP) service on every version of Windows since Windows 7. CVE-2024-49112 has been assigned a CVSS (badness) score of 9.8 out of 10. “LDAP is most commonly seen on servers that are Domain Controllers inside a Windows network and LDAP must be exposed to other servers and clients within an enterprise environment for the domain to function,” Reeves said. “Microsoft hasn’t released specific information about the vulnerability at present, but has indicated that the attack complexity is low and authentication is not required.” Tyler Reguly at the security firm Fortra had a slightly different 2024 patch tally for Microsoft, at 1,088 vulnerabilities, which he said was surprisingly similar to the 1,063 vulnerabilities resolved in 2023 and the 1,119 vulnerabilities resolved in 2022. “If nothing else, we can say that Microsoft is consistent,” Reguly said. “While it would be nice to see the number of vulnerabilities each year decreasing, at least consistency lets us know what to expect.” If you’re a Windows end user and your system is not set up to automatically install updates, please take a minute this week to run Windows Update, preferably after backing up your system and/or important data. System admins should keep an eye on AskWoody.com, which usually has the details if any of the Patch Tuesday fixes are causing problems. In the meantime, if you run into any problems applying this month’s fixes, please drop a note about in the comments below.

 Feed

Microsoft closed out its Patch Tuesday updates for 2024 with fixes for a total of 72 security flaws spanning its software portfolio, including one that it said has been exploited in the wild. Of the 72 flaws, 17 are rated Critical, 54 are rated Important, and one is rated Moderate in severity. Thirty-one of the vulnerabilities are remote code execution flaws, and 27 of them allow for the

 Feed

The U.S. government on Tuesday unsealed charges against a Chinese national for allegedly breaking into thousands of Sophos firewall devices globally in 2020. Guan Tianfeng (aka gbigmao and gxiaomao), who is said to have worked at Sichuan Silence Information Technology Company, Limited, has been charged with conspiracy to commit computer fraud and conspiracy to commit wire fraud. Guan has been

 Feed

Ivanti has released security updates to address multiple critical flaws in its Cloud Services Application (CSA) and Connect Secure products that could lead to privilege escalation and code execution. The list of vulnerabilities is as follows - CVE-2024-11639 (CVSS score: 10.0) - An authentication bypass vulnerability in the admin web console of Ivanti CSA before 5.0.3 that allows a remote

 Feed

Cybersecurity researchers have flagged a "critical" security vulnerability in Microsoft's multi-factor authentication (MFA) implementation that allows an attacker to trivially sidestep the protection and gain unauthorized access to a victim's account. "The bypass was simple: it took around an hour to execute, required no user interaction and did not generate any notification or provide the

 Feed

Cybersecurity researchers have discovered a new version of the ZLoader malware that employs a Domain Name System (DNS) tunnel for command-and-control (C2) communications, indicating that the threat actors are continuing to refine the tool after resurfacing a year ago. "Zloader 2.9.4.0 adds notable improvements including a custom DNS tunnel protocol for C2 communications and an interactive shell

 Feed

Cybersecurity researchers have discovered a novel surveillance program that's suspected to be used by Chinese police departments as a lawful intercept tool to gather a wide range of information from mobile devices. The Android tool, codenamed EagleMsgSpy by Lookout, has been operational since at least 2017, with artifacts uploaded to the VirusTotal malware scanning platform as recently as

 Feed

A suspected China-based threat actor has been linked to a series of cyber attacks targeting high-profile organizations in Southeast Asia since at least October 2023. The espionage campaign targeted organizations in various sectors spanning government ministries in two different countries, an air traffic control organization, a telecoms company, and a media outlet, the Symantec Threat Hunter Team

 Feed

The Russian nation-state actor tracked as Secret Blizzard has been observed leveraging malware associated with other threat actors to deploy a known backdoor called Kazuar on target devices located in Ukraine. The new findings come from the Microsoft threat intelligence team, which said it observed the adversary leveraging the Amadey bot malware to download custom malware onto "specifically

 Feed

A newly devised technique leverages a Windows accessibility framework called UI Automation (UIA) to perform a wide range of malicious activities without tipping off endpoint detection and response (EDR) solutions. "To exploit this technique, a user must be convinced to run a program that uses UI Automation," Akamai security researcher Tomer Peled said in a report shared with The Hacker News. "

 'Cyber

Source: cyble.com – Author: rohansinhacyblecom. Key takeaways Cyble Research and Intelligence Labs (CRIL) has identified a campaign associated with the infamous group Head Mare aimed at targeting Russians. This campaign involves a ZIP archive containing both a malicious LNK file and an executable. The   show more ...  

executable is cleverly disguised as an archive file to deceive users […] La entrada Head Mare Group Intensifies Attacks on Russia with PhantomCore Backdoor – Source:cyble.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: cyble.com – Author: daksh sharma. INTERPOL’s “Think Twice” campaign raises awareness of growing cyber and financial crimes. Learn about the rising threats like ransomware, malware, and romance-baiting scams and how to protect yourself online. Overview In response to the growing threat of cyber and   show more ...  

financial crimes targeting individuals and organizations, INTERPOL has launched a […] La entrada Think Twice Before You Click: INTERPOL Unveils Alarming Cybercrime Trends – Source:cyble.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: cyble.com – Author: daksh sharma. Overview The TP-Link Archer C50 V4, a popular dual-band wireless router designed for small office and home office (SOHO) networks, has been found to contain multiple security vulnerabilities that could expose users to a range of cyber threats. These TP-Link Archer   show more ...  

router vulnerabilities, identified under the CVE-2024-54126 and CVE-2024-54127 […] La entrada Security Risks in TP-Link Archer Router Could Lead to Unauthorized Access – Source:cyble.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. SUMMARY Black Basta Campaign Resurgence: Rapid7 researchers report a sophisticated social engineering campaign by the Black Basta ransomware group, refining tactics and targeting organizations globally. Enhanced Tactics: Attackers use email bombing, impersonation via   show more ...  

Microsoft Teams, and tools like QuickAssist and AnyDesk to gain remote access, bypass MFA, and execute […] La entrada Black Basta Ransomware Uses MS Teams, Email Bombing to Spread Malware – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. SUMMARY: Critical Vulnerability Alert: Dell Power Manager versions before 3.17 have a high-severity access control flaw (CVE-2024-49600) allowing attackers to gain elevated privileges. Exploitation Risk: Attackers with local access can execute arbitrary code, bypass   show more ...  

security measures, and compromise system confidentiality, integrity, and availability. Software Update: Dell has released Power […] La entrada Dell Urges Immediate Update to Fix Critical Power Manager Vulnerability – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. SUMMARY AppLite Trojan: A new, stealthy banking trojan targeting Android devices, capable of stealing banking credentials, crypto wallets, and sensitive data. Phishing Campaign: Delivered via fake job offer emails mimicking HR teams from reputable companies, tricking   show more ...  

victims into downloading malware. Advanced Capabilities: AppLite intercepts SMS, logs keystrokes, captures screenshots, […] La entrada Hackers Target Job Seekers with AppLite Trojan Using Fake Job Emails – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Uzair Amir. The Digital Operational Resilience Act (DORA) sets strict EU rules for financial institutions and IT providers, emphasizing strong cyber risk management, reporting, red teaming, and testing by 2025. The Digital Operational Resilience Act (DORA) is a set of EU rules   show more ...  

around how companies handle disruptions. Each half-decade, digital security […] La entrada How Red Teaming Helps Meet DORA Requirements – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.schneier.com – Author: Bruce Schneier HomeBlog Comments Matthias Urlichs • December 10, 2024 7:20 AM They don’t survive in-person scrutinity, but video cameras? no contest. Maybe if you zoom directly to the face with HD video. wiredog • December 10, 2024 8:51 AM Considering that the (alleged)   show more ...  

ceo killer fooled all the face recognition […] La entrada Full-Face Masks to Frustrate Identification – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. This blog series counts down 8 high-impact vulnerability types, along with examples of how HackerOne helped avoid breaches associated with them. This is the second in the series after we kicked things off with Privilege Escalation. We selected these 8 vulnerability   show more ...  

types based on a combination of OWASP Top 10 […] La entrada 8 High-Impact Bugs and How HackerOne Customers Avoided a Breach: Information Disclosure – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. Building a small company’s security team is a unique challenge. Budgets are tight. Hiring is difficult. And security typically rests on the shoulders of one individual…and it might not be their only role.  At Security@ 2019, Jon Evans, columnist at TechCrunch,   show more ...  

interviewed three security leaders who joined companies at various […] La entrada Scaling Security: From Startup to Unicorn – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. Two years ago, Laurie Mercer joined HackerOne as a security engineer. Before that, he was a developer, penetration tester, and solutions engineer — but also a lecturer at a Chinese university, where he milked a yak, among other things. In short, Laurie has had a   show more ...  

varied and interesting past! In […] La entrada Why Laurie Mercer Became a Security Engineer at HackerOne – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. Phil Venables, senior advisor and board director at Goldman Sachs, has seen more than his share of highs and lows in the security world. The former Goldman Sachs CISO has held senior-level information security roles at Deutsche Bank, Standard Chartered Bank, and   show more ...  

Barclays Bank over the past 25-plus years — […] La entrada Security@ Fireside Chat: Insights from Phil Venables of Goldman Sachs – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. Fueled by tremendous demand for hacker-powered security in the region, security veteran Attley Ng has joined HackerOne as Vice President of Asia Pacific, based in our Singapore office. Public and private organizations across Asia Pacific have been setting an example   show more ...  

for the rest of the world to follow with their […] La entrada Q&A with HackerOne’s New Vice President, APAC, Attley Ng – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. Each blog in the series “Breaking Down the Benefits of Hacker-Powered Pentests”  has focused on one of the key findings in Forrester Consulting’s report The Total Economic Impact Of HackerOne Challenge: Improved Security And Compliance.  This   show more ...  

blog looks at the dollar savings customers realize when they switch to HackerOne from traditional […] La entrada Lowering Your Pentesting Fees with HackerOne – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. This blog post was contributed by Slack Staff Technical Program Manager Branden Jordan. Over the past five years, Slack and HackerOne have established a partnership and commitment to ensure Slack’s platform is secure for its over 12 million daily active users. To   show more ...  

build on this momentum and engage top researchers […] La entrada Slack Increases Minimum Bounties for High and Critical Bugs for 30 Days – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. Customers tell us that a big difference between hacker-powered security and traditional approaches is the impact. Since hackers make money for reporting vulnerabilities with a clear business impact—the bigger the impact, the bigger the bounty—hacker-powered   show more ...  

security programs make you demonstrably safer. In contrast, we often hear that traditional penetration tests […] La entrada 8 High-Impact Bugs and How HackerOne Customers Avoided a Breach: Privilege Escalation – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. HackerOne and the U.S. Department of Defense began working together in 2016 with the launch of Hack the Pentagon. Announced at the third annual Security@ San Francisco, in three short years, hackers discovered 11,000 valid vulnerabilities exclusively through the   show more ...  

organization’s Vulnerability Disclosure Program (VDP). Congratulations to the Department of Defense […] La entrada HackerOne Congratulates the Department of Defense on 11K Vulnerability Reports – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. For the first time ever, a hacker writes a live hacking recap blog, highlighting what it is like to attend a live event. Katie (@InsiderPhD) gives a first-person narrative of h1-604. From seeing a bear for the first time to collaborating closely with peers, Katie   show more ...  

covers all the adventures of […] La entrada Through a Hacker’s Eyes: Recapping h1-604 – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. SUMMARY The new DCOM attack leverages Windows Installer service for stealthy backdoor deployment. Attack exploits the IMsiServer interface for remote code execution and persistence. Malicious DLLs are remotely written, loaded, and executed to compromise systems. It   show more ...  

requires the attacker and victim to be within the same domain, limiting the […] La entrada New DCOM Attack Exploits Windows Installer for Backdoor Access – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: levelblue.com – Author: hello@alienvault.com. This holiday season our SOC analysts have observed a sharp uptick in cyber threat activity. Specifically, they’ve seen a rise in attempted ransomware attacks, which started during the American Thanksgiving holiday period (November 25–31, 2024) and are   show more ...  

expected to continue throughout the holiday season. We’re sharing details on the threat […] La entrada LevelBlue SOC Analysts See Sharp Rise in Cyber Threats: Stay Vigilant – Source:levelblue.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Simon Sharwood The US Departments of Treasury and Justice have named a Chinese business and one of its employees as the actors behind the 2020 exploit of a zero-day flaw in Sophos firewalls The attack was made possible by a critical-rated SQL injection flaw known as   show more ...  

CVE-2020-12271 that was exploited in […] La entrada US names Chinese national it alleges was behind 2020 attack on Sophos firewalls – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Iain Thomson Patch Tuesday Microsoft hasn’t added too much coal to the stocking this Patch Tuesday, with just 72 fixes, only one of which scored more than nine on the CVSS threat ranking scale. Of more immediate concern is one vulnerability in the list that is actively   show more ...  

being exploited – CVE-2024-49138 […] La entrada Microsoft holds last Patch Tuesday of the year with 72 gifts for admins – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Iain Thomson The US Navy, Air Force, and Marine Corps have grounded their fleet of Boeing-Bell-made Osprey V-22s on safety grounds. A spokesperson for the Naval Air Systems Command (NAVAIR) told The Register that the decision had been made following an incident where one of   show more ...  

the aircraft made an emergency landing. […] La entrada US military grounds entire Osprey tiltrotor fleet over safety concerns – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Thomas Claburn Researchers have found that the security mechanism AMD uses to protect virtual machine memory can be bypassed with $10 of hardware – and perhaps not even that. AMD Secure Encrypted Virtualization (SEV) is designed to provide a Trusted Execution Environment   show more ...  

(TEE) that safeguards computation and memory, along the lines […] La entrada AMD secure VM tech undone by DRAM meddling – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: news.sophos.com – Author: Angela Gunn Microsoft on Tuesday released 71 patches touching 10 product families. Seventeen of the addressed issues, all affecting Windows, are considered by Microsoft to be of Critical severity and all have a CVSS base score of 8.1 or higher. Ten of these involve Remote   show more ...  

Desktop Services. At patch time, one […] La entrada December Patch Tuesday arrives bearing 71 gifts – Source: news.sophos.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: news.sophos.com – Author: Chris McCormack PRODUCTS & SERVICES Tips to better protect your network while you take some well-deserved time off. It’s that time of year when people in many parts of the world are looking forward to spending time with family and friends and taking a bit of a break.   show more ...  

Unfortunately, this time […] La entrada Network security best practices for the holidays – Source: news.sophos.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Security researchers have warned customers of the popular file transfer software vendor Cleo that a zero-day vulnerability is currently being exploited in the wild to steal their data. Security vendor Huntress was the first to publicize the attacks on Monday,   show more ...  

claiming that the remote code execution (RCE) bug CVE-2024-50623 affects the Cleo Harmony, […] La entrada Zero Day in Cleo File Transfer Software Exploited En Masse – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Snowflake has announced it will make multi-factor authentication (MFA) mandatory for all accounts by November 2025. The firm said it will block sign-ins using single factor authentication with passwords as part of its commitment to the Cybersecurity and   show more ...  

Infrastructure Security Agency (CISA)’s Secure by Design pledge, of which it is a […] La entrada Snowflake Pledges to Make MFA Mandatory – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-12
Aggregator history
Wednesday, December 11
SUN
MON
TUE
WED
THU
FRI
SAT
DecemberJanuaryFebruary