Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for FBI Removes PlugX Ma ...

 Cyber News

The U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) announced the successful removal of PlugX malware from more than 4,200 computers in the United States. This multi-month operation, conducted in collaboration with international partners, addressed a widespread cyber threat posed by a   show more ...  

hacking group linked to the People’s Republic of China (PRC). According to court documents unsealed in the Eastern District of Pennsylvania, the hackers behind this operation are associated with PRC-sponsored groups known in cybersecurity circles as “Mustang Panda” and “Twill Typhoon.” These groups are believed to have used a advanced version of PlugX malware to infiltrate, control, and extract sensitive information from victim systems. PlugX Malware and Its Threat PlugX is a remote access tool (RAT) that has been around since at least 2008. Its primary function is to give attackers complete control over infected systems, allowing them to steal information, install additional malicious software, and manipulate system settings without detection. While the malware has been used by various hacking groups over the years, the version linked to Mustang Panda is particularly concerning due to its enhanced capabilities and widespread reach. According to the DOJ, Mustang Panda hackers targeted a wide array of victims, including U.S. businesses, European and Asian governments, and Chinese dissident groups. Despite cybersecurity warnings, many infected systems remained compromised, as most users were unaware of the malware lurking in their devices. The PRC government allegedly funded Mustang Panda to develop this specific variant of PlugX. The group’s hacking campaigns, which date back to at least 2014, illustrate the growing trend of state-sponsored cyber threats aimed at undermining global cybersecurity. Coordinated Efforts to Counter the Threat Recognizing the scale and severity of the PlugX infections, the DOJ and FBI launched a coordinated operation to mitigate the threat. The operation, which relied on court-authorized warrants, involved the deletion of the malware from infected U.S.-based computers. “The Department of Justice prioritizes proactively disrupting cyber threats to protect U.S. victims from harm,” said Assistant Attorney General Matthew G. Olsen of the DOJ’s National Security Division. Olsen highlighted that this operation builds on similar efforts to counter hacking groups like Volt Typhoon, Flax Typhoon, and APT28. The operation was not limited to the United States. French law enforcement and Sekoia.io, a France-based cybersecurity company, played a pivotal role. Sekoia.io identified the capability to remotely delete the PlugX malware from infected devices, and the FBI worked with its international partners to test and confirm the effectiveness of these commands. In August 2024, the DOJ and FBI obtained the first of nine court warrants authorizing the malware’s removal. The final warrant expired on January 3, 2025, marking the conclusion of the U.S. portion of the operation. By the end of the initiative, PlugX had been successfully removed from approximately 4,258 computers across the country. A Collaborative Approach to Cybersecurity “This wide-ranging hack and long-term infection of thousands of Windows-based computers demonstrates the recklessness and aggressiveness of PRC state-sponsored hackers,” said U.S. Attorney Jacqueline Romero for the Eastern District of Pennsylvania. She emphasized the importance of a “whole-of-society” approach to defending against cyber threats, noting the critical role of international and private-sector partnerships. Assistant Director Bryan Vorndran of the FBI’s Cyber Division also underscored the importance of collaboration, stating, “Leveraging our partnership with French law enforcement, the FBI acted to protect U.S. computers from further compromise by PRC state-sponsored hackers.” The operation’s success was made possible by contributions from the FBI’s Philadelphia Field Office, the DOJ’s National Security Cyber Section, the Paris Prosecution Office’s Cyber Division, the French Gendarmerie Cyber Unit C3N, and Sekoia.io. Protecting Victims and Preventing Reinfection The FBI is now working to notify affected users through their internet service providers. Victims are being advised to update their antivirus software, apply security patches, and remain vigilant against potential reinfection. To assist individuals who suspect their computers or devices may be compromised, the FBI recommends visiting its Internet Crime Complaint Center (IC3) or contacting a local FBI field office. The Broader Implications of the Operation This operation is a testament to the growing importance of international collaboration in addressing cyber threats. By working together, governments and private organizations can counter hacking campaigns that target individuals, businesses, and critical infrastructure worldwide. The removal of PlugX malware not only protects thousands of infected systems but also sends a clear message to state-sponsored hacking groups: cyber aggression will be met with a coordinated and decisive response. Lessons for Cybersecurity Best Practices The PlugX case higlights the need for proactive measures to secure digital systems. Key takeaways include: Regular Software Updates: Ensure all devices are running the latest security patches to mitigate vulnerabilities. Use of Antivirus Software: Employ reputable antivirus tools to detect and remove malicious programs. Monitoring Unusual Activity: Be vigilant for signs of unauthorized access or performance issues, which could indicate a malware infection. Collaboration and Reporting: Report suspected cyber incidents to appropriate authorities, such as the FBI’s IC3, to facilitate timely action. As cyber threats evolve, the importance of a proactive and collaborative approach to cybersecurity cannot be overstated. The PlugX operation highlights what can be achieved when nations, law enforcement agencies, and private organizations join forces to protect global cybersecurity.

image for Fortinet Vulnerabili ...

 Cyber News

The Australian Cyber Security Centre (ACSC) has issued an alert regarding a critical vulnerability in Fortinet's FortiOS and FortiProxy products. This Fortinet vulnerability has been actively exploited in the wild, posing significant risks to organizations that rely on these products. Technical users in Australian   show more ...  

businesses, organizations, and government entities are advised to take immediate action to secure their systems. Fortinet Vulnerability: What Happened? Fortinet identified a critical vulnerability in specific versions of FortiOS and FortiProxy. This vulnerability enables unauthenticated remote attackers to gain "super-admin" privileges by exploiting an alternate path or channel vulnerability (CWE-288). Reports confirm active exploitation, with threat actors performing various post-exploitation activities. Fortinet has provided detailed indicators of compromise (IOCs) and IP addresses associated with the threat actors. These can help organizations identify and investigate suspicious activities. Post-Exploitation Activities Observed: Threat actors exploiting this vulnerability have been observed performing the following actions: Creating Admin Accounts: Attackers create admin accounts on devices with random usernames. Adding Local Users: Threat actors create local user accounts with random names and integrate them into existing SSL VPN user groups. Adjusting Device Configurations: Changes to settings such as firewall policies have been noted. Establishing VPN Tunnels: Attackers log into SSL VPNs using compromised accounts to create tunnels into internal networks. Affected Versions The following Fortinet products and versions are impacted: FortiOS: Version 7.0 - From 7.0.0 to 7.0.16 Solution: Upgrade to 7.0.17 or later. FortiProxy: Version 7.0 - From 7.0.0 to 7.0.19 Solution: Upgrade to 7.0.20 or later. Version 7.2 - From 7.2.0 to 7.2.12 Solution: Upgrade to 7.2.13 or later. Non-Affected Versions: FortiOS 7.4, FortiOS 7.6, FortiProxy 7.4, and FortiProxy 7.6 are not impacted by this vulnerability. Mitigation Steps The ACSC urges organizations to take the following steps to protect their systems: Upgrade to Secure Versions: Immediately upgrade affected systems to the latest versions as per Fortinet’s recommendations. Use Fortinet's upgrade tool to determine the appropriate upgrade path. Investigate for Potential Compromise: Review Fortinet’s published IOCs to identify any signs of compromise in your environment. Conduct detailed investigations for unusual activity in connected networks and devices. Monitor Network Activity: Proactively monitor for suspicious behavior, such as unexpected user accounts or changes to firewall policies. Follow Fortinet’s Published Advice: Refer to Fortinet's vulnerability notification for additional technical details and guidance. Technical Background The Fortinet vulnerability exploits an authentication bypass using an alternate path or channel vulnerability (CWE-288). This flaw allows attackers to craft specific requests targeting the Node.js WebSocket module to gain super-admin privileges. The exploitation of this vulnerability can lead to unauthorized access, the ability to modify device configurations, and the potential for further lateral movement within the network. Why This Matters The critical nature of this vulnerability cannot be overstated. Threat actors gaining super-admin privileges can have devastating consequences for organizations, including data breaches, unauthorized system access, and loss of operational integrity. Fortinet products are widely used for securing enterprise and government networks. Ensuring these systems are updated and uncompromised is essential to maintaining a secure network infrastructure. Next Steps for Organisations Act Immediately: Upgrade vulnerable devices and investigate for any signs of compromise. Use the Fortinet Upgrade Tool: Simplify the upgrade process by leveraging Fortinet’s official tool. Stay Updated: Keep track of the latest advisories from both Fortinet and the ACSC. Enhance Security Measures: Ensure robust network monitoring, apply necessary patches promptly, and encourage staff to use strong authentication practices. If you suspect your systems have been compromised, report the issue immediately to the ACSC or your cybersecurity team. Protecting your systems from this Fortinet vulnerability is critical to safeguarding your organization’s data and operations. Take action now to ensure your network remains secure.

image for The Top 8 Countries ...

 Cyber Essentials

Organizations of all types are getting breached at an alarming rate everywhere, which makes picking the top countries leading the cyber defense race a challenging endeavor.  What matters ultimately is a nation’s leadership and responsiveness in cybersecurity matters, so we’ve weighted organizational and legal   show more ...  

capacity more heavily than other measures in ranking national cybersecurity efforts. Without pressure and urgency from the top, issues that can be ignored are likely to be ignored until they become a problem, so active central security agencies and leadership are necessary components in addressing the overwhelming volume of cybersecurity threats.  There are a number of resources that rank countries by their cybersecurity defenses, each with its own breadth and focus. Because of its comprehensive nature spanning 194 countries, we’ve given added weight to the recently updated United Nations International Telecommunication Union’s (ITU) Global Cybersecurity Index in developing this list. The National Cyber Security Index (NCSI) also has very good methodology and data, but with only 61 countries listed, it’s not nearly as comprehensive as ITU.  Here then are the top 8 countries for cybersecurity defense efforts, with an emphasis on those countries proposing fresh solutions to pressing cybersecurity problems as we head into 2025.  #1: Finland  Europe has been a clear leader in cybersecurity, with 20 countries receiving the top “Role-modelling” status from the ITU. That’s nearly double the number from APAC, the next-highest region in the report. Five of those countries – Denmark, Finland, Italy, Turkey and the UK – received perfect scores from the ITU.  Nordic countries in general do very well across almost all analyses for the top countries for cybersecurity, in part due to regional and international cooperation and educational initiatives, but we’ll give the nod to Finland for its new comprehensive national security strategy that shows deep understanding of current cybersecurity challenges – and a 10-year roadmap for staying on top of them.  Like all countries on this list, and indeed, all countries in general, Finland has had its share of cybersecurity challenges, including spoofing attacks targeting the Bank of Finland, cyberespionage linked to China’s APT31 threat group, and cyberattacks from Russia following Finland’s 2023 NATO membership, in addition to numerous ransomware attacks and data breaches. If the country can live up to its cybersecurity ambitions, it will be a model to watch.  #2: The UK  Despite leaving the EU in 2020, the UK has retained much of the EU’s world-leading approach to cybersecurity and data privacy. With a strong central cybersecurity agency – the National Cyber Security Centre (NCSC) – and membership in the “Five Eyes” intelligence alliance that also includes the U.S., Canada, Australia and New Zealand, the UK is well positioned both for domestic cyber defenses and international cooperation.  The UK will soon introduce in Parliament the Cyber Security and Resilience Bill, which is aimed at strengthening cybersecurity controls, reporting and incident response, a much-needed boost after a rough 2024 that included the brutal NHS London ransomware attack.  #3: The United States  The U.S. gets attacked ten times more than any other country, largely due to the very high number of rich targets and willingness of victims to pay, but the practical, open approach of security agencies like CISA merit a spot on this list. China-linked threat actors may be dwelling in U.S. critical infrastructure and telecom networks, but we know the details – including techniques, Indicators of Compromise (IoCs) and recommended solutions – only because CISA, the NSA and other agencies have openly shared critical information and solutions.  The U.S. is one of only two countries in the Americas to achieve the top “Role-modelling” rating from the ITU; Brazil is the other. Surprisingly, there were no perfect ITU scores in the Americas; the U.S. came up just short in training and awareness. One weakness in the U.S. is the lack of a national data privacy law – the U.S. is woefully out of step with other countries here, as well as many of its own states. Another weakness is that private organizations don’t always share the federal government’s responsive approach to cybersecurity, leading to frequent headlines of massive data breaches and ransomware attacks.  #4: Singapore  The Asia-Pacific region boasts several technology and cybersecurity powerhouses like Australia, Japan and India, but surprisingly, only Indonesia and South Korea (officially the Republic of Korea) had perfect marks from ITU, while Vietnam, Singapore and Thailand came up just short. Out of that impressive list we’ll pick Singapore – and give a nod to the Republic of Korea too.  Singapore came up just short of a perfect ITU score (a total of 99.86 points across the five 20-point areas measured by ITU, the same score as the U.S.), and is on this list because of a dizzying array of initiatives like a new operational technology (OT) master plan, training and education, research, consumer device labeling, a vulnerability discovery program and many other initiatives that reveal a deep understanding of – and innovative solutions to – evolving cybersecurity challenges. Every country should be that engaged in finding solutions to this pressing problem.  #5: South Korea  With you share a border with an adversary launching more than a million cyberattacks at you every day, cybersecurity becomes a pretty high priority, so the Republic of Korea (ROK), aka South Korea, is a country worth watching.  The new National Cybersecurity Basic Plan, a follow up to the National Cybersecurity Strategy released just a few months earlier in February 2024, includes dramatic goals such as conducting “preemptive and proactive cyber defense activities against cyber attacks and threat actors that undermine national security and interests, and establish a foundation for responding to ‘disinformation’ that divides public opinion and causes social unrest in cyberspace.”  Those are critically important goals for all countries, so any success ROK has will be worth duplicating elsewhere.  #6: Saudi Arabia  The Arab nations came in just behind Europe in the number of perfect ITU scores, with Egypt, Qatar, Saudi Arabia and the United Arab Emirates all registering a perfect 100.  Saudi Arabia is a clear leader in that group. In the last two years, the Kingdom has launched a National Cybersecurity Strategy, a guide to Essential Cybersecurity Controls, and a Personal Data Protection Law. Bold steps from a country committed to becoming a leader in cybersecurity.  #7: United Arab Emirates  Not to be outdone, the UAE has launched initiatives like the Dubai Cyber Security Strategy, which includes intriguing goals such as “advancing cyber security research, fostering an innovation ecosystem, ensuring secure adoption of emerging technologies.”  Coming soon: new policies on cloud and data security, IoT security, and security operations centers (SOCs). Quantum encryption for data transmission is expected to be part of those policies.  #8: Mauritius  As the only African country with a perfect ITU score, Mauritius – a tiny island nation of 1.3 million in the Indian Ocean about 1,000 miles east of Madagascar – rounds out this list. With a comprehensive three-year cybersecurity strategy and many other initiatives – including shared threat intelligence and a honeypot network – this tiny country shows that size is not an obstacle to achieving strong cybersecurity.  Conclusion: The Leading Cybersecurity Countries  The countries leading in cybersecurity defense share a few common themes:  Fresh strategies that show a deep understanding of cybersecurity threats and challenges – and creative solutions to address those challenges  Strong central agencies capable of providing leadership and technical assistance  A commitment to training, awareness and education  The year ahead will almost certainly see bold initiatives from other countries determined to tip the balance of power from attackers to defenders. 

image for Easterly Calls for R ...

 Cyber News

Jen Easterly, director of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), warned today that the U.S. must do more to protect against cyber threats posed by attackers linked to the People’s Republic of China (PRC). Easterly warned in a blog post that the PRC is likely to attempt “reunification”   show more ...  

with Taiwan by the end of the decade, if not sooner – and reiterated statements she and other officials have made that China’s persistent attacks on U.S. critical infrastructure may be in preparation for a move against Taiwan. She wrote: “Such action could be accompanied by disruptive attacks against ‘everything, everywhere, all at once:’ our transportation nodes, our telecommunications services, our power grids, our water facilities, and likely much more—all with the goal of inducing societal panic and deterring our ability to marshal military might and citizen will to expend American blood and treasure in defense of Taiwan.” Easterly’s post comes five days before she and CISA Deputy Director Nitin Natarajan are set to depart as the second Trump Administration is sworn in. CISA has engaged in a flurry of initiatives during the transition period – and one piece is expected to be a final cybersecurity executive order from outgoing President Joe Biden, which would have to be signed this week if it is to get done. Easterly: Tech Products Must Be More Secure [caption id="attachment_100236" align="alignright" width="240"] CISA Director Jen Easterly[/caption] Easterly said CISA has had success evicting PRC-linked threat actors from government networks and the energy, transportation, water and telecommunication sectors, and the agency has deployed resources “across nearly 7,000 critical infrastructure organizations” to help improve security. However, she noted that “what we have found is likely just the tip of the iceberg. This unrelenting PRC campaign underscores the urgent need for robust cyber defense and vigilance across public and private sectors.” Easterly made an impassioned plea for more secure product development, noting that product vulnerabilities have “made it easy” for cyber attackers. “Indeed, the PRC is largely taking advantage of known product defects,” she wrote. “The truth is that the technology base upon which our critical infrastructure depends is inherently insecure, because of decades of misaligned incentives that prioritized features and speed to market over security. That must stop. Technology companies must help ensure the PRC and other adversary threat actors cannot exploit defects in technology products to target our critical infrastructure. These weaknesses—and the resulting risks to our national security—can only be addressed at scale by companies building and selling products that are secure by design.” [Emphasis Easterly’s] Critical infrastructure organizations also need to do better, she said. “Every critical infrastructure organization should double down on their commitment to resilience,” Easterly wrote. “CEOs, Boards, and every business leader must recognize that they own cyber risk as a business risk and a matter of good governance. They must expect disruption, continually testing the continuity of critical systems and functions to ensure they can operate through disruption and recover rapidly from an attack.” CISA’s recent high-profile activities also serve to underscore the agency’s value even as its future in the new administration is uncertain. Biden Plans Sweeping Cybersecurity Order This week is also expected to bring a final cybersecurity executive order from Biden, which would call for strengthening the federal government and contractors from PRC actors and other cyber threats. Stronger standards for software and cloud security, more secure federal networks and authentication, third-party risk management, digital identities, improved BGP security, and promotion of AI-powered security technologies are some of the items that could be in the final order. The order is also expected to give CISA additional authority to enforce cybersecurity standards.

image for CISA Launches AI Cyb ...

 Cyber News

The Cybersecurity and Infrastructure Security Agency (CISA) has unveiled a new tool aimed at strengthening the cybersecurity resilience of AI systems. The AI Cybersecurity Collaboration Playbook, developed in collaboration with the Joint Cyber Defense Collaborative (JCDC), offers guidance on how AI providers,   show more ...  

developers, and adopters can voluntarily share cybersecurity incident information and vulnerabilities to enhance collective defense. This playbook represents a proactive step in the ongoing efforts to secure AI systems as their adoption grows across industries. By facilitating collaboration among federal, international, and private-sector partners, the playbook aims to improve the resilience of AI systems, providing stakeholders with the framework to detect, report, and respond to AI-related cybersecurity risks. The Growing Need for AI Cybersecurity Collaboration As AI technologies become increasingly integrated into critical sectors, they also open the door to new vulnerabilities and cyber threats. The nature of AI systems—particularly those that are autonomous and capable of learning from vast data sets—adds a layer of complexity to cybersecurity, making traditional defense mechanisms insufficient. Recognizing this, CISA and JCDC have worked alongside industry leaders and international partners to create the AI Cybersecurity Collaboration Playbook. This playbook serves as a living document, continuously evolving to meet the demands of the ever-changing AI security landscape. CISA Director Jen Easterly emphasized the importance of collaboration in AI security, stating, "The development of this playbook is a major milestone in our efforts to secure AI systems through active collaboration." The document was shaped by the expertise of approximately 150 AI specialists from various sectors, ensuring that the guidance is comprehensive and relevant. Key Objectives of the Playbook The AI Cybersecurity Collaboration Playbook lays out several objectives aimed at creating a cohesive and coordinated cybersecurity response for AI-related incidents: Facilitating Voluntary Information Sharing: The playbook guides organizations on how to voluntarily share cybersecurity incidents and vulnerabilities related to AI systems. This enables a faster, more efficient response to emerging threats and helps organizations collectively improve their defenses. Guidance on Actions by CISA: The playbook clearly outlines the steps CISA will take upon receiving shared information. This ensures transparency and builds trust between government agencies and private organizations, making it easier for them to collaborate on cybersecurity matters. Collaboration Across Critical Infrastructure: By improving awareness of AI cybersecurity risks, the playbook aims to enhance the security and resilience of AI technologies across sectors like finance, healthcare, energy, and transportation. Real-World Input and Dynamic Development To ensure that the playbook is practical and actionable, CISA hosted two tabletop exercises with key industry players, including Microsoft and Scale AI. These exercises involved real-world scenarios, helping refine the playbook and ensuring that it addresses the complexities unique to AI security. Through these exercises, participants identified gaps in current security practices and collaborated on how best to respond to evolving AI threats. The feedback from these sessions has shaped a document that is not static but will be regularly updated to adapt to new risks and technologies. As Omar Santos, a Distinguished Engineer at Cisco, pointed out, "Security for AI isn’t a solo mission; it’s a collective effort. Industry and Government Collaboration The development of the playbook also highlights the importance of collaboration between government and industry. Companies like Hidden Layer, Palo Alto Networks, and Protect AI have all been instrumental in shaping the playbook's guidance, providing valuable insights based on their expertise in securing AI systems. Malcolm Harkins, Chief Security & Trust Officer at Hidden Layer, noted, "Security for AI isn’t a solo mission; it’s a collective effort," emphasizing that the playbook empowers stakeholders to work together in real-time to combat an increasingly dynamic threat landscape. How the Playbook Benefits AI Stakeholders The AI Cybersecurity Collaboration Playbook is designed to be a helpful resource for AI stakeholders, including developers, providers, and adopters. It provides actionable guidelines on the following: Information Sharing: The playbook emphasizes how AI stakeholders can share critical incident information, vulnerabilities, and security intelligence with CISA and other JCDC partners. Strengthening Collective Defense: By fostering collaboration between the public and private sectors, the playbook enhances the collective defense against AI cybersecurity threats, ensuring a more robust and coordinated response. CISA’s Role: The playbook clearly outlines the steps CISA will take after receiving shared information, helping organizations understand the support they can expect from federal agencies. Moving Forward The AI Cybersecurity Collaboration Playbook marks an important step toward creating a unified approach to AI cybersecurity. While it focuses on collaboration within JCDC, it also offers guidance that extends to critical infrastructure stakeholders and other information-sharing mechanisms. This collaborative approach will help organizations build more secure AI systems, protecting them from evolving threats. As AI technology continues to evolve, so must the strategies to secure it. The playbook will be updated regularly to stay ahead of emerging risks, ensuring that AI technologies remain secure and resilient as they become an integral part of society’s digital infrastructure. CISA encourages all AI stakeholders to adopt the playbook’s recommendations to contribute to a unified approach to AI cybersecurity. By doing so, organizations can ensure that they are equipped to protect AI systems against emerging threats while also promoting innovation in a safe and secure environment.

image for Legitimate Chrome ex ...

 Business

Right after Christmas, news broke of a multi-stage attack targeting developers of popular Chrome extensions. Ironically, the biggest-name target was a cybersecurity extension created by Cyberhaven — compromised just before the holidays (wed previously warned about such risks). As the incident investigation unfolded,   show more ...  

the list grew to include no fewer than 35 popular extensions, with a combined total of 2.5 million installations. The attackers goal was to steal data from the browsers of users who installed trojanized updates of these extensions. The focus of the campaign was on stealing credentials for Meta services to compromise business accounts and display ads at victims expense. However, thats not the only data that malicious extensions can steal from browsers. We explain how the attack works, and what measures you can take to protect yourself against it at different stages. Attacking developers: OAuth abuse To inject trojan functionality into popular Chrome extensions, cybercriminals have developed an original phishing scheme. They send developers emails disguised as standard Google alerts claiming that their extension violates Chrome Web Store policies and needs a new description. The text and layout of the message mimic typical Google emails, so the victim is often convinced. Moreover, the email is often sent from a domain set up to attack a specific extension and containing the name of the extension in the actual domain name. Clicking the link in the email takes the user to a legitimate Google authentication page. After that, the developer sees another standard Google screen prompting to sign in via OAuth to an app called Privacy Policy Extension, and to grant certain permissions to it as part of the authentication process. This standard procedure takes place on legitimate Google pages, except that the Privacy Policy Extension app requests permission to publish other extensions to the Chrome Web Store. If this permission is granted, the creators of Privacy Policy Extension are able to publish updates to the Chrome Web Store on behalf of the victim. In this case, theres no need for the attackers to steal the developers password or other credentials, or to bypass multi-factor authentication (MFA). They simply abuse Googles system for granting permissions to trick developers into authorizing the publication of updates to their extensions. Judging by the long list of domains registered by the attackers, they attempted to attack far more than 35 extensions. In cases where the attack was successful, they released an updated version of the extension, adding two files for stealing Facebook cookies and other data (worker.js and content.js). Attacking users Chrome extensions typically receive updates automatically, so users who switched on their machines between December 25 and December 31, and opened Chrome, may have received an infected update of a previously installed extension. In this event, a malicious script runs in the victims browser and sends data needed for compromising Facebook business accounts to the attackers server. In addition to Facebook identifiers and cookies, the malware steals information required to log in to the targets advertising account, such as the user-agent data to identify the users browser. On facebook.com, even mouse-click data is intercepted to help the threat actors bypass CAPTCHA and two-factor authentication (2FA). If the victim manages ads for their company or private business on Meta, the cybercriminals get to spend their advertising budget on their own ads — typically promoting scams and malicious sites (malvertising). On top of the direct financial losses, the targeted organization faces legal and reputational risks, as the fake ads are published under its name. The malware can conceivably steal data from other sites too, so its worth checking your browser even if you dont manage Facebook ads for a company. What to do if you installed an infected extension update To stop the theft of information from your browser, the first thing you need to do is to uninstall the compromised extension or update it to a patched version. See here for a list of all known infected extensions with their current remediation status. Unfortunately, simply uninstalling or updating the infected extension is not enough. You should also reset any passwords and API keys that were stored in the browser or used during the incident period. Then, check the available logs for signs of communication with the attackers servers. IoCs are available here and here. If communication with malicious servers was made, look for traces of unauthorized access in all services that were opened in the infected browser. After that, if Meta or any other advertising accounts were accessed from the infected browser, manually check all running ads, and stop any unauthorized advertising activity you find. Lastly, deactivate any compromised Facebook account sessions on all devices (Log out all other devices), clear the browser cache and cookies, log in to Facebook again, and change the account password. Incident takeaways This incident is another example of supply-chain attacks. In the case of Chrome, its made worse by the fact that updates are installed automatically without notifying the user. While updates are usually a good thing, here the auto-update mechanism allowed malicious extensions to spread quickly. To mitigate the risks of this scenario, companies are advised to do the following: Use group policies or the Google Admin console to restrict the installation of browser extensions to a trusted list; Create a list of trusted extensions based on business needs and information security practices used by the developers of said extensions; Apply version pinning to disable automatic extension updates. At the same time, itll be necessary to put in place a procedure for update monitoring and centralized updating of approved extensions by administrators; Install an EDR solution on all devices in your organization to protect against malware and monitor suspicious events. Companies that publish software, including web extensions, need to ensure that permission to publish is granted to the minimum number of employees necessary — ideally from a privileged workstation with additional layers of protection, including MFA and tightly configured application launch control and website access. Employees authorized to publish need to undergo regular information security training, and be familiar with the latest attacker tactics, including spear phishing.

 Feed

The U.S. Department of Justice (DoJ) on Tuesday disclosed that a court-authorized operation allowed the Federal Bureau of Investigation (FBI) to delete PlugX malware from over 4,250 infected computers as part of a "multi-month law enforcement operation." PlugX, also known as Korplug, is a remote access trojan (RAT) widely used by threat actors associated with the People's Republic of China (PRC

 Feed

Microsoft kicked off 2025 with a new set of patches for a total of 161 security vulnerabilities across its software portfolio, including three zero-days that have been actively exploited in attacks. Of the 161 flaws, 11 are rated Critical, and 149 are rated Important in severity. One other flaw, a non-Microsoft CVE related to a Windows Secure Boot bypass (CVE-2024-7344), has not been assigned

 Feed

Cybersecurity researchers have disclosed multiple security flaws in SimpleHelp remote access software that could lead to information disclosure, privilege escalation, and remote code execution. Horizon3.ai researcher Naveen Sunkavally, in a technical report detailing the findings, said the "vulnerabilities are trivial to reverse and exploit." The list of identified flaws is as follows -

 Feed

Cybersecurity researchers have identified infrastructure links between the North Korean threat actors behind the fraudulent IT worker schemes and a 2016 crowdfunding scam. The new evidence suggests that Pyongyang-based threamoret groups may have pulled off illicit money-making scams that predate the use of IT workers, SecureWorks Counter Threat Unit (CTU) said in a report shared with The Hacker

 Feed

As many as six security vulnerabilities have been disclosed in the popular Rsync file-synchronizing tool for Unix systems, some of which could be exploited to execute arbitrary code on a client. "Attackers can take control of a malicious server and read/write arbitrary files of any connected client," the CERT Coordination Center (CERT/CC) said in an advisory. "Sensitive data, such as SSH keys,

 Feed

Why does ICS/OT need specific controls and its own cybersecurity budget today? Because treating ICS/OT security with an IT security playbook isn’t just ineffective—it’s high risk. In the rapidly evolving domain of cybersecurity, the specific challenges and needs for Industrial Control Systems (ICS) and Operational Technology (OT) security distinctly stand out from traditional IT security. ICS/OT

 Feed

Cybersecurity researchers have alerted to a new malvertising campaign that's targeting individuals and businesses advertising via Google Ads by attempting to phish for their credentials via fraudulent ads on Google. "The scheme consists of stealing as many advertiser accounts as possible by impersonating Google Ads and redirecting victims to fake login pages," Jérôme Segura, senior director of

 Feed

The North Korea-linked Lazarus Group has been attributed to a new cyber attack campaign dubbed Operation 99 that targeted software developers looking for freelance Web3 and cryptocurrency work to deliver malware. "The campaign begins with fake recruiters, posing on platforms like LinkedIn, luring developers with project tests and code reviews," Ryan Sherstobitoff, senior vice president of Threat

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: The Biden-Harris Administration has introduced a new Interim Final Rule on Artificial Intelligence Diffusion aimed at enhancing US national security and preventing the misuse of advanced US technology by countries of concern. The rule strengthens protections   show more ...  

against misuse of advanced AI technologies by countries of concern. Measures defined in the new […] La entrada New AI Rule Aims to Prevent Misuse of US Technology – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Browser-Based

Source: www.infosecurity-magazine.com – Author: Written by Browser-based cyber-threats have surged throughout 2024, marking a significant shift in the tactics employed by malicious actors. According to new findings from the 2024 Threat Data Trends report by the eSentire Threat Response Unit (TRU), while malware   show more ...  

delivered via email declined last year, browser-sourced threats, including drive-by downloads and […] La entrada Browser-Based Cyber-Threats Surge as Email Malware Declines – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Manchester-based law firm Barings Law has rallied 15,000 people to sue Google and Microsoft over numerous alleged violations of data misuse. Following a two-year investigation into Google and Microsoft, the law firm claimed to have found evidence that significant   show more ...  

amounts of the data the two tech giants collected were being used […] La entrada Manchester Law Firm Leads 15,000 to Sue Google and Microsoft over AI Data – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Considers

Source: www.infosecurity-magazine.com – Author: The UK government has proposed banning public sector and critical infrastructure organizations from making ransomware payments. The proposed payment ban been included in a Home Office-led consultation published on January 14. It focuses on protecting hospitals,   show more ...  

schools, railways and other essential public services from the growing ransomware threat. The Home Office […] La entrada UK Considers Ban on Ransomware Payments by Public Bodies – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Critical national infrastructure (CNI) providers are getting better at remediating exploited vulnerabilities and other cyber hygiene best practices, according to the US Cybersecurity and Infrastructure Security Agency (CISA). The agency’s new Cybersecurity   show more ...  

Performance Goals Adoption Report analyzed the performance of close to 7800 CNI organizations since 2022. It found that: Remediation […] La entrada Remediation Times Drop Sharply as Cyber Hygiene Take Up Surges – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: The UK’s top level domain registry has revealed to customers that it suffered a security breach recently when threat actors exploited a zero-day vulnerability in Ivanti VPN products. Nominet, which manages over 11 million .uk domains as well as .wales and .   show more ...  

cymru, issued an alert to its customers last week. The […] La entrada UK Registry Nominet Breached Via Ivanti Zero-Day – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Critical

Source: www.infosecurity-magazine.com – Author: Critical infrastructure organizations have been urged to take action to ensure their operational technology (OT) products are secure by design. Government agencies from the Five Eyes intelligence and security alliance, alongside European partners, issued a joint   show more ...  

advisory on January 13 to critical infrastructure firms setting out the key security considerations when […] La entrada Critical Infrastructure Urged to Scrutinize Product Security During Procurement – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Banshee stealer

Source: socprime.com – Author: Daryna Olyniychuk New year, new menaces for cyber defenders. Cybersecurity researchers have uncovered a novel variant of the notorious Banshee Stealer, which is increasingly targeting Apple users worldwide. This stealthy infostealer malware employs advanced evasion techniques,   show more ...  

successfully slipping past detection by leveraging string encryption from Apple’s XProtect antivirus engine. Going exclusively […] La entrada Detect Banshee Stealer: Stealthy Apple macOS Malware Evades Detection Using XProtect Encryption – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Iain Thomson Patch Tuesday The first Patch Tuesday of 2025 has seen Microsoft address three under-attack privilege-escalation flaws in its Hyper-V hypervisor, plus plenty more problems that deserve your attention. The Hyper-V vulnerabilities are CVE-2025-21333,   show more ...  

CVE-2025-21334, and CVE-2025-21335, and were already being exploited in the wild as zero-days. They are rated […] La entrada Microsoft fixes under-attack privilege-escalation holes in Hyper-V – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: go.theregister.com – Author: Jessica Lyons The FBI, working with French cops, obtained nine warrants to remotely wipe PlugX malware from thousands of Windows-based computers that had been infected by Chinese government-backed criminals, according to newly unsealed court documents. The Feds had been   show more ...  

tracking a crew called Mustang Panda, aka Twill Typhoon, for years, and […] La entrada FBI wipes Chinese PlugX malware from thousands of Windows PCs in America – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 appears

Source: go.theregister.com – Author: Connor Jones Updated Developer security company Snyk is at the center of allegations concerning the possible targeting or testing of Cursor, an AI code editor company, using “malicious” packages uploaded to NPM. Paul McCarty, a security researcher at   show more ...  

SourceCodeRed.com, said he made the “strange” finding during a malicious package detection routine. […] La entrada Snyk appears to deploy ‘malicious’ packages targeting Cursor for unknown reason – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: go.theregister.com – Author: Lindsay Clark Analysis A little more than two months out from its first legal deadline, the UK’s Online Safety Act is causing concern among smaller online forums caught within its reach. The legislation, which came into law in the autumn of 2023, applies to search services   show more ...  

and services that allow users […] La entrada It’s not just Big Tech: The UK’s Online Safety Act applies across the board – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Owais Sultan. Cybersecurity is facing new challenges with advances in AI, cloud tech, and increasing cyber threats. Solutions like blockchain are emerging to support data security and trust. Cybersecurity faces considerable challenges in light of recent technological developments,   show more ...  

from artificial intelligence to exposed programming vulnerabilities. At the same time, emerging attacks […] La entrada Blockchain in cybersecurity: opportunities and challenges  – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 APT

Source: securityaffairs.com – Author: Pierluigi Paganini The FBI has removed Chinese PlugX malware from over 4,200 computers in networks across the United States, the U.S. Department of Justice reported. The Justice Department and FBI, along with international partners, announced they deleted PlugX malware from   show more ...  

thousands of infected computers worldwide as part of a multi-month law […] La entrada FBI deleted China-linked PlugX malware from over 4,200 US computers – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 APT

Source: securityaffairs.com – Author: Pierluigi Paganini Russia-linked threat actor UAC-0063 targets Kazakhstan to gather economic and political intelligence in Central Asia. Russia-linked threat actors UAC-0063 is targeting Kazakhstan as part of a cyber espionage campaign to gather economic and political   show more ...  

intelligence in Central Asia. The Computer Emergency Response Team of Ukraine (CERT-UA) first detailed the […] La entrada Russia-linked APT UAC-0063 target Kazakhstan in with HATVIBE malware – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini Experts warn of a new campaign targeting an alleged zero-day in Fortinet FortiGate firewalls with management interfaces exposed online. Arctic Wolf researchers observed a campaign targeting Fortinet FortiGate firewalls with exposed management interfaces,   show more ...  

likely exploiting a zero-day vulnerability. Threat actors gained unauthorized access to network devices, created accounts, and […] La entrada A new campaign is likely targeting a zero-day in Fortinet FortiGate firewalls – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Aviatrix Controller

Source: securityaffairs.com – Author: Pierluigi Paganini A critical vulnerability in Aviatrix Controller is actively exploited to deploy backdoors and cryptocurrency miners in the wild. A security researcher Jakub Korepta discovered a critical vulnerability, tracked as CVE-2024-50603 (CVSS score: 10.0), in   show more ...  

the Aviatrix Controller. The flaw impacts Aviatrix Controller pre-7.1.4191 and 7.2.x pre-7.2.4996, it allows unauthenticated attackers to […] La entrada Threat actors exploit Aviatrix Controller flaw to deploy backdoors and cryptocurrency miners – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 AI (Artificial Intelligence)

Source: securityboulevard.com – Author: Deepak Gupta – Tech Entrepreneur, Cybersecurity Author The cybersecurity landscape is entering an unprecedented era of complexity, marked by converging challenges that are fundamentally reshaping how organizations approach digital security. The World Economic   show more ...  

Forum’s Global Cybersecurity Outlook 2025 reveals a critical inflection point where traditional security approaches are being challenged by […] La entrada The Future of Cybersecurity: Global Outlook 2025 and Beyond – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Robert Lemos, Contributing Writer Source: Andy.LIU via Shutterstock Using phishing emails and zero-day exploits, China’s cyber-operations groups targeted Taiwanese organizations — including government agencies, telecommunications firms, and transportation — with   show more ...  

significantly higher volumes of attacks in 2024. On average, Taiwan saw more than 2.4 million attack attempts per day, double the […] La entrada As Tensions Mount With China, Taiwan Sees Surge in Cyberattacks – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer Source: Elena11 via Shutterstock Microsoft’s January update contains patches for a record 159 vulnerabilities, including eight zero-day bugs, three of which attackers are already actively exploiting. The update is Microsoft’s   show more ...  

largest ever and is notable also for including three bugs that the company said were discovered by […] La entrada Microsoft Rings in 2025 With Record Security Update – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Apple

Source: www.darkreading.com – Author: Becky Bracken, Senior Editor, Dark Reading Source: Andrey Kryuchkov via Alamy Stock Photo Cyber defenders are encouraged to ensure systems have been updated with the latest macOS patch, which includes a fix for a vulnerability that exposed the entire operating system to   show more ...  

further compromise. The bug, tracked under CVE-2024-44243, was patched […] La entrada Apple Bug Allows Root Protections Bypass Without Physical Access – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Kristina Beek, Associate Editor, Dark Reading Source: Herr Loeffler via Shutterstock NEWS BRIEF The US Justice Department and the FBI said on Jan. 14 that they were able to delete “PlugX” malware from thousands of devices globally as part of a cooperative effort.   show more ...  

The operation spanned a series of months, targeting […] La entrada FBI Wraps Up Eradication Effort of Chinese ‘PlugX’ Malware – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 asd

Source: www.techrepublic.com – Author: Ben Abbott We may earn from vendors via affiliate links or sponsorships. This might affect product placement on our site, but not the content of our reviews. See our Terms of Use for details. Cyber security maturity declines among Australian government agencies in 2024, as   show more ...  

legacy IT systems hinder progress under […] La entrada Australian Government Agencies Failing to Keep Up With Cyber Security Change – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.techrepublic.com – Author: Luis Millares Windscribe VPN fast facts Our rating: 4.1 stars out of 5 Pricing: Starts at $5.75 (annual plan) Key features: Has a generous free version. ScribeForce team accounts for organizations. Unlimited device connections. Windscribe VPN is a decent option for those   show more ...  

seeking a virtual private network with a fully functional […] La entrada Windscribe VPN Review (2025): Features, Pricing, and Security – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Eduard Kovacs Schneider Electric, Siemens, Phoenix Contact and CISA have released ICS product security advisories on the January 2025 Patch Tuesday. Schneider Electric published nine new advisories this month. Six of them describe high-severity vulnerabilities affecting   show more ...  

PowerLogic HDPM6000 High-Density Metering System (privilege escalation), RemoteConnect and SCADAPackTM x70 utilities (potential remote code […] La entrada ICS Patch Tuesday: Security Advisories Published by Schneider, Siemens, Phoenix Contact, CISA – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Adobe

Source: www.securityweek.com – Author: Ryan Naraine Software maker Adobe on Tuesday rolled out fixes for more than a dozen security defects in multiple products and warned that malicious hackers can exploit these bugs in remote code execution attacks. The company said the vulnerabilities affect Adobe Photoshop,   show more ...  

Substance 3D Stager, Illustrator for iPad, Adobe Animate, and […] La entrada Adobe: Critical Code Execution Flaws in Photoshop – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CVE-2025-21333

Source: www.securityweek.com – Author: Ryan Naraine Microsoft’s struggles with zero-days have stretched into 2025 with fresh news of a trio of already-exploited vulnerabilities in the Windows Hyper-V platform. The software giant on Tuesday called urgent attention to three separate flaws in the Windows Hyper-V   show more ...  

NT Kernel Integration Virtualization Service Provider (VSP) and warned that malicious […] La entrada Microsoft Patches Trio of Exploited Windows Hyper-V Zero-Days – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Artificial Intelligence

Source: www.securityweek.com – Author: Associated Press President Joe Biden on Tuesday signed an ambitious executive order on artificial intelligence that seeks to ensure the infrastructure needed for advanced AI operations, such as large-scale data centers and new clean power facilities, can be built quickly   show more ...  

and at scale in the United States. The executive order directs […] La entrada Biden Signs Executive Order Aimed at Growing AI Infrastructure in the US – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-01
Aggregator history
Wednesday, January 15
WED
THU
FRI
SAT
SUN
MON
TUE
JanuaryFebruaryMarch