Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for CRIL Investigates: L ...

 Firewall Daily

In recent years, cyber attackers have continuously upgraded their tactics, exploiting a variety of tools and techniques to evade detection and compromise systems. One such trend that has caught the attention of security experts is the increasing use of malicious LNK files in conjunction with SSH commands. These files,   show more ...  

often disguised as legitimate shortcuts, have become an effective weapon in the arsenals of threat actors (TAs), enabling them to infiltrate systems and deploy a wide range of malicious payloads. Cyble Research and Intelligence Labs (CRIL) has closely investigated this rising threat and found that, in 2024, the use of LNK files as an infection vector is on the rise. The Shift in Attack Vectors: LNK Files as an Entry Point In its investigation, CRIL identified a trend where attackers are increasingly using LNK files to infiltrate targeted systems. These shortcut files, typically designed to point to a specific application or location on a computer, are often disguised as innocuous documents or files to trick users into executing them. Once opened, they initiate a chain of malicious activities, leading to the deployment of more sophisticated malware and enabling cybercriminals to establish a foothold within the compromised environment. The growing use of LNK files as a delivery mechanism for cyberattacks is part of a broader shift in the tactics employed by threat actors. By leveraging these shortcut files, attackers aim to bypass traditional security defenses, including antivirus programs and endpoint detection and response (EDR) solutions. Living-Off-the-Land Binaries (LOLBins) and Evasion Techniques  One of the primary techniques utilized by attackers in these LNK-based campaigns is the use of Living-off-the-Land Binaries (LOLBins). These are trusted system binaries that are already present in the operating system and are typically used for legitimate purposes. However, when exploited by cybercriminals, they can serve as powerful tools for executing malicious commands without the need to deploy external malware. In many of these attacks, attackers leverage various LOLBins to download or execute additional malicious payloads, further advancing their attack chain.  While modern EDR solutions are designed to detect suspicious activities involving LOLBins, the sophistication of these attacks continues to evolve. Attackers have refined their methods to bypass detection, making it crucial for organizations to implement more advanced detection mechanisms that can identify malicious use of trusted system utilities.  SSH Commands in Malicious LNK Files: A New Layer of Sophistication  One of the more interesting developments observed in recent campaigns is the incorporation of SSH commands within malicious LNK files. Traditionally used for secure communication between systems, SSH commands have now been weaponized by attackers to establish persistent connections, execute malicious payloads, and maintain control over compromised systems.  CRIL's research has uncovered several campaigns where SSH commands, specifically those using the Secure Copy Protocol (SCP), have been used within LNK files. SCP allows attackers to download malicious files from remote servers to a compromised system, where they are then executed to further the attack.  Once the file is downloaded, it is executed, advancing the attacker’s objectives. This technique is particularly concerning because the use of SSH for such operations is not common on Windows systems, allowing the activity to go undetected by traditional security systems. Exploiting PowerShell and CMD Through SSH  In addition to using SCP for file downloads, threat actors have also employed SSH commands to indirectly execute malicious PowerShell or CMD commands through the LNK file. These commands can be configured to load and execute additional payloads or exploit other system utilities.  One such attack observed by CRIL involved a malicious LNK file that used an SSH command to trigger a PowerShell script, which then called mshta.exe to download a malicious payload from a remote URL. The execution of the malicious PowerShell script led to the deployment of a harmful file on the compromised system.  Furthermore, attackers have also leveraged cmd.exe and rundll32 commands to load malicious DLL files and execute them, further complicating detection efforts. In one such case, the attackers used the LNK file to execute a series of commands that ultimately launched a PDF file containing a lure document, which, when opened, triggered the execution of malicious code.  Tactics Employed by Advanced Persistent Threat (APT) Groups  As the sophistication of these attacks continues to grow, APT groups are increasingly incorporating SSH-based techniques into their campaigns. These groups are known for their targeted and long-term cyber espionage activities, and their use of LNK files and SSH commands demonstrates their ongoing refinement of attack methods.   Notably, the Transparent Tribe, a well-known APT group, has been linked to the deployment of stealer malware via similar techniques. In these attacks, the malicious payloads are often compiled using Go, making them harder to detect and analyze.  The Need for Vigilance and Enhanced Detection  The combination of LNK files and SSH commands represents a significant threat to organizations worldwide. As attackers continue to refine their methods, it is essential for security teams to implement monitoring strategies and detection systems capable of identifying abnormal activities, such as the malicious use of trusted system binaries.  EDR solutions must evolve to detect the subtle signs of malicious SSH and SCP activity, especially in environments where SSH is not typically used. By closely monitoring the legitimate SSH utility and restricting its use to authorized personnel, organizations can reduce the risk of exploitation. Additionally, disabling unnecessary features, such as OpenSSH, on systems where they are not required, can help limit the attack surface. 

image for LockBit Ransomware G ...

 Cyber News

The LockBit ransomware group will soon launch a comeback with the planned release of LockBit 4.0 in February 2025, Cyble dark web researchers reported in a note to clients today. The launch of LockBit 4.0 will come almost a year after a global law enforcement action disrupted its operations and led to the recovery of   show more ...  

nearly 7,000 decryption keys. RansomHub has since emerged as the most active ransomware group. The Cyble note to clients included an image of LockBit’s announcement, edited to remove profanity: [caption id="attachment_99732" align="aligncenter" width="400"] LockBit announces plans for LockBit 4.0 release (Source: Cyble)[/caption] “Want a lamborghini, ferrari and lots of ... girls?” the group’s announcement said. “Sign up and start your pentester billionaire journey in 5 minutes with us.” Can LockBit Make a Comeback? It remains to be seen if LockBit can successfully mount a comeback after being hit by significant takedowns, arrests and the release of decryption keys. It has been more than two years since the release of LockBit 3.0, and as LockBit was said to be developing the 4.0 version at the time of the law enforcement actions, significant changes likely would have been required if law enforcement obtained access to any source code. Cyble researchers noted that “it is uncertain whether LockBit will regain traction, as the group has faced declining credibility amidst competition from other RaaS groups, such as RansomHub, which currently dominate the ransomware landscape.” The official release of the LockBit 4.0 Ransomware-as-a-Service (RaaS) program is set for February 3, 2025, Cyble noted, and the group included keys for accessing their dark leak site (DLS). LockBit 4.0 Will Join Growing RaaS Services The RaaS model has become increasingly popular with ransomware groups, selling tools, playbooks and infrastructure in exchange for a share of the profits. And with LockBit competing against versions of its own ransomware built on leaked source code, the group appears to face significant hurdles in staging a comeback.

image for The best privacy ser ...

 Privacy

With just a few days left before Christmas, overwhelmed shipping services might fail to deliver your gifts on time. Of course, you could always get a last-minute digital gift-card or subscription — but the fact is that everyone who might be interested in a Netflix or Spotify account probably already has one. And   show more ...  

Telegram Premium? Thats a little awkward just now. But there is a solution! Why not give the gift of an increased level of daily security this festive season? (A dull idea? Beats socks, surely?!) Many people know they should protect their data and online activity, but dont have the time or energy to do so. A service that ensures their privacy is therefore not only an unusual gift, but a genuinely helpful one too. Privacy services are generally paid for — with a few rare exceptions. After all, maintaining servers to store data and developing hack-resistant software comes with a cost. Without subscription fees, these services would have to sell user data to advertisers — just like Google and Meta do — which would defeat the point. So a year-long subscription to a privacy-enhancing service has financial value as well. With our recommended services, your giftee can replace unsafe office applications, note-taking services, and messengers with privacy-focused alternatives that dont misuse stored information. But before making a purchase, keep in mind two key points: First, services designed for communication or collaboration, such as encrypted messengers, are useless to gift to a single person. Who will you message if none of your friends use the app? Its probably better to gift such a service to an entire group. Second, privacy tools may offer less convenience and functionality compared to popular alternatives that prioritize less on security. Whether this compromise proves critical will depend on the recipients needs and habits. With these provisos duly noted, lets explore some high-quality privacy-oriented alternatives to popular services that would make great gifts this Christmas or New Year. Office applications Personal diaries, research-paper drafts, and financial calculations are becoming harder to protect from prying eyes. Services like Google Docs have always been completely online — sparking both concerns about leaks, and debates over how Google processes stored data. Microsoft has been trying to catch up in recent years, including with a host of questionable features even in its offline Office suite such as auto-saving to OneDrive, optional connected experiences, and LinkedIn integrations. Storing data in the cloud isnt necessarily problematic in itself, but there are concerns that documents can be used for ad targeting, AI training, or other unrelated purposes. Is it possible to combine collaborative document editing and cloud storage without these concerns? As it turns out, yes. A less feature-rich, yet convenient and private alternative to Google Docs and Office365 is the CryptPad service. You can work together on documents, slides, spreadsheets, and whiteboards, while storing all data on servers with end-to-end encryption. If you want (and have the needed tech-wherewithal), you can set up a CryptPad server independently. However, theres no need for ordinary users to do so. The developers themselves maintain the cryptpad.fr server, offering paid plans for increased storage and other benefits. Plans are available for €5, €10, and €15 per month, with discounts for annual payments. You can explore other public CryptPad servers here. VPN Although weve written repeatedly about the benefits of using a VPN, lets remember once again that a VPN is not a standalone privacy tool. However, when used correctly alongside other tools, a VPN can indeed help enhance privacy. For example, it can protect against surveillance by your internet provider or Wi-Fi hotspot owner, and secures your data from hackers sitting at the next table in a cafe. There are thousands of VPN services to choose from, with people using them for a variety of practical ends. But free VPNs always come with a question: how do they remain free? After all, maintaining a VPN service has its costs. Alas, the adage if youre not paying for the product, you are the product applies here too. Thats why we recommend using a trusted, paid VPN instead of just some random one from the internet. Choose a paid-only service from a company with proven expertise in cybersecurity. For example, a fast and unlimited VPN like can be purchased either can be purchased either independently, or as part of the Kaspersky Plus or Kaspersky Premium subscriptions. Messengers While popular messengers like WhatsApp and Signal already provide end-to-end encryption, theres still room for improvement when it comes to privacy. Both apps require a phone number for registration, and WhatsApp, as part of the Meta empire, collects metadata about users social connections. The Threema messenger is free of these issues. Threema allows registration with a random ID and doesnt require a phone number. It also enables users to manage the trust level of their contacts. For example, you can verify encryption keys by physically being near your conversation partner. While similar verification features exist in Signal and WhatsApp, theyre buried deep in menus. Threema, on the other hand, shows the trust level right next to the contacts name. The app is paid, but affordable — €6 for lifetime usage. Note-taking apps There are tons of note apps out there — and every smartphone comes with its own — but data synchronization between devices often lacks robust encryption. We compared several private note apps in a separate article, so here well just remind you that one of the best options for securely storing notes is Obsidian, a very powerful app with rich functionality. Obsidian itself is free, but its encrypted note synchronization service, Obsidian Sync, costs around $48 per year. Browsers and email Youll be hard pressed to find a gift subscription to a private browser or email service, as browsers are generally free — even private ones. Meanwhile, the privacy of a specific email service doesnt mean much when emails are still sent via standardized, open communication channels to recipients who dont use private services. However, your everyday online activities can be made significantly more private by using Kaspersky Premium. This is the most advanced version of our comprehensive home user protection, with maximum privacy protection functionality. Thanks to Private Browsing and Webcam and Mic Control, Kaspersky Premium minimizes your digital footprint on the internet, and prevents more dangerous threats like spyware and phishing. The Safe Money feature protects your finances when shopping/paying online, while Identity Theft Check notifies you of any data leaks and advises on how to address them. On mobile devices, Kaspersky Premium not only prevents harm from phishing and malware, but also protects against surveillance from AirTags or stalkerware. And of course, Kaspersky Premium includes the Kaspersky Password Manager, the unlimited high-speed Kaspersky VPN Secure Connection, and even a year of Kaspersky Safe Kids protection. Any of these gifts is a perfect way to share your care — ensuring the privacy and security of your loved ones in the year ahead.

image for Web Hacking Service ...

 A Little Sunshine

Cybercriminals are selling hundreds of thousands of credential sets stolen with the help of a cracked version of Acunetix, a powerful commercial web app vulnerability scanner, new research finds. The cracked software is being resold as a cloud-based attack tool by at least two different services, one of which   show more ...  

KrebsOnSecurity traced to an information technology firm based in Turkey. Araneida Scanner. Cyber threat analysts at Silent Push said they recently received reports from a partner organization that identified an aggressive scanning effort against their website using an Internet address previously associated with a campaign by FIN7, a notorious Russia-based hacking group. But on closer inspection they discovered the address contained an HTML title of “Araneida Customer Panel,” and found they could search on that text string to find dozens of unique addresses hosting the same service. It soon became apparent that Araneida was being resold as a cloud-based service using a cracked version of Acunetix, allowing paying customers to conduct offensive reconnaissance on potential target websites, scrape user data, and find vulnerabilities for exploitation. Silent Push also learned Araneida bundles its service with a robust proxy offering, so that customer scans appear to come from Internet addresses that are randomly selected from a large pool of available traffic relays. The makers of Acunetix, Texas-based application security vendor Invicti Security, confirmed Silent Push’s findings, saying someone had figured out how to crack the free trial version of the software so that it runs without a valid license key. “We have been playing cat and mouse for a while with these guys,” said Matt Sciberras, chief information security officer at Invicti. Silent Push said Araneida is being advertised by an eponymous user on multiple cybercrime forums. The service’s Telegram channel boasts nearly 500 subscribers and explains how to use the tool for malicious purposes. In a “Fun Facts” list posted to the channel in late September, Araneida said their service was used to take over more than 30,000 websites in just six months, and that one customer used it to buy a Porsche with the payment card data (“dumps”) they sold. Araneida Scanner’s Telegram channel bragging about how customers are using the service for cybercrime. “They are constantly bragging with their community about the crimes that are being committed, how it’s making criminals money,” said Zach Edwards, a senior threat researcher at Silent Push. “They are also selling bulk data and dumps which appear to have been acquired with this tool or due to vulnerabilities found with the tool.” Silent Push also found a cracked version of Acunetix was powering at least 20 instances of a similar cloud-based vulnerability testing service catering to Mandarin speakers, but they were unable to find any apparently related sales threads about them on the dark web. Rumors of a cracked version of Acunetix being used by attackers surfaced in June 2023 on Twitter/X, when researchers first posited a connection between observed scanning activity and Araneida. According to an August 2023 report (PDF) from the U.S. Department of Health and Human Services (HHS), Acunetix (presumably a cracked version) is among several tools used by APT 41, a prolific Chinese state-sponsored hacking group. THE TURKISH CONNECTION Silent Push notes that the website where Araneida is being sold — araneida[.]co — first came online in February 2023. But a review of this Araneida nickname on the cybercrime forums shows they have been active in the criminal hacking scene since at least 2018. A search in the threat intelligence platform Intel 471 shows a user by the name Araneida promoted the scanner on two cybercrime forums since 2022, including Breached and Nulled. In 2022, Araneida told fellow Breached members they could be reached on Discord at the username “Ornie#9811.” According to Intel 471, this same Discord account was advertised in 2019 by a person on the cybercrime forum Cracked who used the monikers “ORN” and “ori0n.” The user “ori0n” mentioned in several posts that they could be reached on Telegram at the username “@sirorny.” Orn advertising Araneida Scanner in Feb. 2023 on the forum Cracked. Image: Ke-la.com. The Sirorny Telegram identity also was referenced as a point of contact for a current user on the cybercrime forum Nulled who is selling website development services, and who references araneida[.]co as one of their projects. That user, “Exorn,” has posts dating back to August 2018. In early 2020, Exorn promoted a website called “orndorks[.]com,” which they described as a service for automating the scanning for web-based vulnerabilities. A passive DNS lookup on this domain at DomainTools.com shows that its email records pointed to the address ori0nbusiness@protonmail.com. Constella Intelligence, a company that tracks information exposed in data breaches, finds this email address was used to register an account at Breachforums in July 2024 under the nickname “Ornie.” Constella also finds the same email registered at the website netguard[.]codes in 2021 using the password “ceza2003” [full disclosure: Constella is currently an advertiser on KrebsOnSecurity]. A search on the password ceza2003 in Constella finds roughly a dozen email addresses that used it in an exposed data breach, most of them featuring some variation on the name “altugsara,” including altugsara321@gmail.com. Constella further finds altugsara321@gmail.com was used to create an account at the cybercrime community RaidForums under the username “ori0n,” from an Internet address in Istanbul. According to DomainTools, altugsara321@gmail.com was used in 2020 to register the domain name altugsara[.]com. Archive.org’s history for that domain shows that in 2021 it featured a website for a then 18-year-old Altuğ Şara from Ankara, Turkey. Archive.org’s recollection of what altugsara dot com looked like in 2021. LinkedIn finds this same altugsara[.]com domain listed in the “contact info” section of a profile for an Altug Sara from Ankara, who says he has worked the past two years as a senior software developer for a Turkish IT firm called Bilitro Yazilim. Neither Altug Sara nor Bilitro Yazilim responded to requests for comment. Invicti’s website states that it has offices in Ankara, but the company’s CEO said none of their employees recognized either name. “We do have a small team in Ankara, but as far as I know we have no connection to the individual other than the fact that they are also in Ankara,” Invicti CEO Neil Roseman told KrebsOnSecurity. Researchers at Silent Push say despite Araneida using a seemingly endless supply of proxies to mask the true location of its users, it is a fairly “noisy” scanner that will kick off a large volume of requests to various API endpoints, and make requests to random URLs associated with different content management systems. What’s more, the cracked version of Acunetix being resold to cybercriminals invokes legacy Acunetix SSL certificates on active control panels, which Silent Push says provides a solid pivot for finding some of this infrastructure, particularly from the Chinese threat actors. Further reading: Silent Push’s research on Araneida Scanner.

image for Fortinet Addresses U ...

 Feed

Fortinet has patched CVE-2023-34990 in its Wireless LAN Manager (FortiWLM), which combined with CVE-2023-48782 could allow for unauthenticated remote code execution (RCE) and the ability to read all log files.

 News

Telegram’s “similar channels” feature, introduced last year, recommends extremist channels even when users browse channels on nonpolitical topics such as celebrities or technology, according to a report by the U.S. nonprofit legal advocacy organization Southern Poverty Law Center (SPLC).

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 25-01, ordering federal civilian agencies to secure their cloud environments and abide by Secure Cloud Business Applications (SCuBA) secure configuration baselines. "Recent cybersecurity incidents highlight the significant risks posed by misconfigurations and weak security controls,

 Feed

The Dutch Data Protection Authority (DPA) on Wednesday fined video on-demand streaming service Netflix €4.75 million ($4.93 million) for not giving consumers enough information about how it used their data between 2018 and 2020. An investigation launched by the DPA in 2019 found that the tech giant did not inform customers clearly enough in its privacy statement about what it does with the data

 Feed

The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed that a threat actor it tracks as UAC-0125 is leveraging Cloudflare Workers service to trick military personnel in the country into downloading malware disguised as Army+, a mobile app that was introduced by the Ministry of Defence back in August 2024 in an effort to make the armed forces go paperless. Users who visit the

 Feed

Juniper Networks is warning that Session Smart Router (SSR) products with default passwords are being targeted as part of a malicious campaign that deploys the Mirai botnet malware. The company said it's issuing the advisory after "several customers" reported anomalous behavior on their Session Smart Network (SSN) platforms on December 11, 2024. "These systems have been infected with the Mirai

 Feed

Fortinet has issued an advisory for a now-patched critical security flaw impacting Wireless LAN Manager (FortiWLM) that could lead to disclosure of sensitive information. The vulnerability, tracked as CVE-2023-34990, carries a CVSS score of 9.6 out of a maximum of 10.0. "A relative path traversal [CWE-23] in FortiWLM may allow a remote unauthenticated attacker to read sensitive files," the

 Feed

Threat actors have been observed uploading malicious typosquats of legitimate npm packages such as typescript-eslint and @types/node that have racked up thousands of downloads on the package registry. The counterfeit versions, named @typescript_eslinter/eslint and types-node, are engineered to download a trojan and retrieve second-stage payloads, respectively. "While typosquatting attacks are

 AI

This week, we delve into the dark world of fake CAPTCHAs designed to hijack your computer. Plus, the AI safety clock is ticking down – is doomsday closer than we think? And to top it off, we uncover the sticky situation of Krispy Kreme facing a ransomware attack. All this and more is discussed in the latest   show more ...  

jam-packed edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by Mark Stockley of "The AI Fix" podcast.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: US federal agencies and departments have been mandated to implement new cybersecurity practices for cloud services. The Cybersecurity and Infrastructure Security Agency (CISA) published Binding Operational Directive 25-01: Implementing Secure Practices for Cloud   show more ...  

Services on December 17, which sets out actions federal agencies must take to identify and secure all production […] La entrada US Government Issues Cloud Security Requirements for Federal Agencies – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A sharp increase in phishing attacks, including a 202% rise in overall phishing messages in the second half of 2024, has been identified by cybersecurity experts. According to SlashNext’s 2024 Phishing Intelligence Report, a substantial 703% surge in credential   show more ...  

phishing attacks was also observed in the same period. Key findings from […] La entrada Phishing Attacks Double in 2024 – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 attacks

Source: www.infosecurity-magazine.com – Author: A recent investigation by security researchers has revealed a troubling surge in malicious campaigns exploiting popular development tools, including VSCode extensions and npm packages. These campaigns compromise local development environments and pose risks to   show more ...  

broader software supply chains. From VSCode Marketplace to npm Initially detected by ReversingLabs in the VSCode Marketplace, […] La entrada New Attacks Exploit VSCode Extensions and npm Packages – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Attacker

Source: www.infosecurity-magazine.com – Author: A threat actor has been observed using vishing via Microsoft Teams to deploy DarkGate malware and gain remote control over the victim’s computer network. Trend Micro reported that the attacker posed as an employee of a known client on an MS Teams call, enabling   show more ...  

them to dupe the target user into […] La entrada Attacker Distributes DarkGate Using MS Teams Vishing Technique – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A network of 792 people has been arrested in Lagos, Nigeria’s most populated city, for their alleged involvement in a large-scale cryptocurrency fraud scheme and romance scam activity. The arrest was made public on December 16 by Ola Olukoyede, the Executive   show more ...  

Chairman of Nigeria’s Economic and Financial Crimes Commission (EFCC). The […] La entrada Nigeria Cracks Down on Cryptocurrency Investment Fraud and Romance Scams – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Meta has been fined €251m ($263m) by the Irish Data Protection Commission (DPC) for a massive 2018 data breach which impacted around 29 million Facebook accounts. The incident in question arose between September 14-28 2018, when unauthorized individuals   show more ...  

exploited a vulnerability in the social media platform’s “View As” feature, enabling them to […] La entrada Meta Hit with Massive $263m GDPR Fine – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: The European Commission has launched a new investigation into whether TikTok contravened the Digital Services Act (DSA) by allowing foreign actors to interfere in recent Romanian elections. A second round of voting in the presidential election was cancelled by the   show more ...  

courts earlier this month after unknown independent and Putin-admirer Calin Georgescu […] La entrada European Commission Opens TikTok Election Integrity Probe – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: news.sophos.com – Author: rajansanhotra G2, a major technology user review platform, has just released its Winter 2025 Reports, and Sophos ranks as the #1 overall Firewall, MDR, and EDR solution. Sophos is – once again – the only vendor named a Leader across the G2 Overall Grid® Reports for   show more ...  

Endpoint Protection Suites, Endpoint Detection […] La entrada Sophos ranked #1 overall for Firewall, MDR, and EDR in the G2 Winter 2025 Reports – Source: news.sophos.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Uzair Amir. Stay alert to crypto scams with our guide to 2024’s top threats, including phishing, malware, Ponzi schemes, and fake wallets. Learn how to protect your assets today! With the increasing adoption and user base of cryptocurrencies and crypto markets also comes a   show more ...  

growing number of scammers and frauds. There […] La entrada Biggest Crypto Scam Tactics in 2024 and How to Avoid Them – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. KEY SUMMARY POINTS FBI Alert on HiatusRAT: The FBI issued a Private Industry Notification (PIN) warning about HiatusRAT malware campaigns targeting Chinese-branded web cameras and DVRs, leveraging remote access for device infiltration. Evolving Cyber Threat:   show more ...  

HiatusRAT, active since 2022, has been used to exploit outdated network devices, Taiwanese organizations, […] La entrada FBI Warns of HiatusRAT Malware Targeting Webcams and DVRs – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Owais Sultan. Many professionals juggle multiple document formats, leading to confusion and wasted time. Imagine a streamlined process that simplifies your tasks and enhances overall productivity, allowing you to focus on higher-priority tasks. Grasping online document solutions   show more ...  

can be the game-changer you need, helping you manage your files easily and confidently […] La entrada Maximizing Productivity with Online Document Solutions – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: securityboulevard.com – Author: Amy Cohn Why is Access Control Crucial in Cybersecurity? In the expansive and complex world of cybersecurity, have you ever wondered how vital a role access control plays? It’s the cornerstone of securing Non-Human Identities (NHIs) and managing their secrets   show more ...  

effectively. With increasing digital transformation and cloud migration, securing NHIs is […] La entrada How Does Enhanced Access Control Bolster Your Security? – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: securityboulevard.com – Author: Amy Cohn Why is Secure Automation Essential for Cloud Operations? Modern businesses operate within a complex ecosystem. How can they ensure their cloud operations remain secure, streamlined, and efficient? The answer lies in secure automation. This blog post will delve   show more ...  

into why secure automation is a must-have for any business, especially […] La entrada How Secure Automation Saves Your Cloud Operations – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud-Native Security

Source: securityboulevard.com – Author: Amy Cohn Is Secrets Security Management Crucial for High-Growth Environments? The digital age is expanding at an unprecedented rate, constantly evolving with revolutionary technologies that are redefining business models. In such high-growth environments, the criticality   show more ...  

of effective secrets security is amplified. In particular, Non-Human Identities (NHIs) and their respective secrets play […] La entrada Scaling Secrets Security in High-Growth Environments – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 @jjx

Source: securityboulevard.com – Author: Sulagna Saha Since the earliest incidents of computer break-ins, experts have maintained that making the internet a safe place is going to be an uphill battle. Their reasons, while largely technical, also encompass human complacency. Research shows that most organizations   show more ...  

and users fail to follow the simple practices that make computing […] La entrada Ground Rule of Cyber Hygiene: Keep Your Password Policy Up to Date – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Santiago Rodriguez In an increasingly complex threat landscape, sophisticated mobile-targeted phishing campaigns continue to evolve, leveraging multiple redirection techniques and platform-specific behaviors to evade detection. Spear phishing, a highly targeted form of   show more ...  

social engineering, is a preferred attack vector against corporate executives, specifically designed to compromise high-value credentials that grant access […] La entrada Mobile Spear Phishing Targets Executive Teams – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman Wednesday, December 18, 2024 Home » Security Bloggers Network » DEF CON 32 – Gotta Cache ‘Em All Bending The Rules Of Web Cache Exploitatio Authors/Presenters: Martin Doyhenard Our sincere appreciation to DEF CON, and the Authors/Presenters for   show more ...  

publishing their erudite DEF CON 32 content. Originating from the conference’s […] La entrada DEF CON 32 – Gotta Cache ‘Em All Bending The Rules Of Web Cache Exploitatio – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cgaurd free Trial 45 days

Source: securityboulevard.com – Author: Pushpendra Mishra In today’s ever-evolving digital landscape, businesses face increasingly sophisticated cyber threats. Protecting sensitive data, ensuring compliance, and maintaining operational continuity have never been more critical. This is where Seceon’s   show more ...  

aiSIEM-CGuard emerges as a game-changer, offering advanced threat detection and response capabilities. And now, for a limited time, you can […] La entrada Free Trial of aiSIEM-CGuard for 45 Days: Experience the Future of Cybersecurity – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jennifer Lawinski Source: Andrii Yalansky via Alamy Stock Photo NEWS BRIEF The United States Cybersecurity and Infrastructure Security Agency (CISA) has released a draft version of the National Cyber Incident Response Plan (NCIRP), outlining how public and private sector   show more ...  

organizations should handle significant cyber incidents.The public comment period ends Jan. 15, […] La entrada CISA Releases Draft of National Cyber Incident Response Plan – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Robert Lemos, Contributing Writer Source: Ketut Agus Suardika via Shutterstock Cyberattacks targeting India-based organizations continue to double year-over-year, a rate far higher than the global average, highlighting the rapidly rising risk facing companies and government   show more ...  

agencies in South Asia. Overall, organizations in India encountered nearly 1.2 billion attacks in the third […] La entrada India Sees Surge in API Attacks, Especially in Banking, Utilities – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Becky Bracken, Senior Editor, Dark Reading Source: Olga Yastremska via Alamy Stock Photo NEWS BRIEF Victims of online scams are being deterred from coming forward for fear of being associated with language like “pig butchering,” a phrase used to describe   show more ...  

long-con romance fraud schemes, according to Interpol, which has released an […] La entrada Interpol: Can We Drop the Term ‘Pig Butchering’? – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Tara Seals, Managing Editor, News, Dark Reading Source: JHG via Alamy Stock Photo NEWS BRIEF The Russian government has set a new precedent for itself by officially designating Recorded Future, the cyber threat intelligence (CTI) company, as “undesirable.”   show more ...  

It’s a development that the company’s CEO sees as a badge of honor. […] La entrada Recorded Future: Russia’s ‘Undesirable’ Designation Is a Compliment – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Elizabeth Montalbano, Contributing Writer Source: Anatolii Babii via Alamy Stock Photo Attackers are spoofing Google Calendar invites in a fast-spreading phishing campaign that can bypass email protections and aims to steal credentials, ultimately to defraud users for   show more ...  

financial gain. The campaign, discovered by researchers at Check Point Software, relies on modified […] La entrada Phishers Spoof Google Calendar Invites in Fast-Spreading, Global Campaign – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Nate Nelson, Contributing Writer Source: Ascannio via Alamy Stock Photo A full 20,000 employees of European manufacturing companies have been targeted by a phishing campaign. According to Palo Alto Networks’ Unit 42, the activity peaked in June and survived until at   show more ...  

least September. The cyberattackers targeted automotive, chemical, and industrial compound […] La entrada Manufacturers Lose Azure Creds to HubSpot Phishing Attack – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 APT

Source: securelist.com – Author: Vasily Berdnikov, Sojun Ryu Over the past few years, the Lazarus group has been distributing its malicious software by exploiting fake job opportunities targeting employees in various industries, including defense, aerospace, cryptocurrency, and other global sectors. This attack   show more ...  

campaign is called the DeathNote campaign and is also referred to as “Operation […] La entrada Lazarus group evolves its infection chain with old and new malware – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 AI

Source: grahamcluley.com – Author: Graham Cluley Skip to content This week, we delve into the dark world of fake CAPTCHAs designed to hijack your computer. Plus, the AI safety clock is ticking down – is doomsday closer than we think? And to top it off, we uncover the sticky situation of Krispy Kreme facing a   show more ...  

[…] La entrada Smashing Security podcast #398: Fake CAPTCHAs, Harmageddon, and Krispy Kreme – Source: grahamcluley.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: heimdalsecurity.com – Author: Gabriella Antal Your Essential Guide to Vendor Risk Management. Last updated on December 19, 2024 Effectively managing third-party risks starts with a solid plan, and our Vendor Risk Assessment Template is the perfect tool to help you evaluate vendors and protect your   show more ...  

business. Third-party vendors can introduce significant risks—ranging from cybersecurity […] La entrada Free & Downloadable Vendor Risk Assessment Template – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 All things Heimdal

Source: heimdalsecurity.com – Author: Madalina Popovici The holiday season is a time of celebration, but it’s also a high-risk period for cyberattacks. Cybercriminals look to exploit reduced staffing, remote work, and the surge in online activity. As everyone scrambles for last-minute deals, these attackers   show more ...  

find it easier than ever to slip through the cracks in your […] La entrada A Sysadmin’s Holiday Checklist: Keep Your Company Safe This Festive Season – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Credentials theft

Source: securelist.com – Author: Ashley Muñoz, Francesco Figurelli, Cristian Souza, Eduardo Ovalle, Areg Baghinyan Introduction During a recent incident response, Kaspersky’s GERT team identified a set of TTPs and indicators linked to an attacker that infiltrated a company’s networks by targeting a   show more ...  

Fortinet vulnerability for which a patch was already available. This vulnerability is an […] La entrada Attackers exploiting a patched FortiClient EMS vulnerability in the wild – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.lastwatchdog.com – Author: bacohido By Byron V. Acohido To wrap up our 2024 year-end roundtable, we turn our attention to new technologies and trends that are emerging to help bridge the gaps. Part four of our  four-part series From cybersecurity skills shortages to the pressures of hybrid work,   show more ...  

the challenges facing organizations are at […] La entrada LW ROUNDTABLE:  Predictive analytics, full-stack visualization to solidify cyber defenses in 2025 – Source: www.lastwatchdog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 antivirus

Source: www.techrepublic.com – Author: Drew Robb We may earn from vendors via affiliate links or sponsorships. This might affect product placement on our site, but not the content of our reviews. See our Terms of Use for details. Norton and McAfee are among the original AV vendors. Does one have an edge over   show more ...  

the other? […] La entrada McAfee vs Norton: Which Antivirus Software Is Best? – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blog

Source: socprime.com – Author: Oleksandr L [post-views] December 19, 2024 · 2 min read If you are using Logstash and need to enrich event data with geolocation information based on IP addresses, the following filter configuration can help. This setup checks if the source IP is an external IP and applies   show more ...  

geolocation enrichment. For internal […] La entrada Enhancing Events with Geolocation Data in Logstash – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blog

Source: socprime.com – Author: Oleksii K. WRITTEN BY Oleksii K. DevOps Engineer [post-views] December 19, 2024 · 3 min read The Split Index API in OpenSearch is a useful feature that allows you to split an existing index into multiple smaller indices. This can be particularly valuable when you want to   show more ...  

improve performance, scale your index, or […] La entrada OpenSearch Split Index API – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blog

Source: socprime.com – Author: Oleksandr L Reindexing is an essential Elasticsearch operation that enables administrators to copy documents from one index to another, either within the same cluster or across clusters. This guide provides examples of reindexing and monitoring tasks, including cross-cluster   show more ...  

reindexing, along with references to the official Elasticsearch documentation. Basic Reindexing Example The […] La entrada Reindexing in Elasticsearch: A Guide for Administrators – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-12
Aggregator history
Thursday, December 19
SUN
MON
TUE
WED
THU
FRI
SAT
DecemberJanuaryFebruary