Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for New CISA-Microsoft G ...

 Cyber News

The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Office of Management and Budget (OMB), the Office of the National Cyber Director (ONCD), and Microsoft, has announced the release of the Microsoft Expanded Cloud Log Implementation Playbook. This new guidance is designed to help   show more ...  

organizations in both the public and private sectors leverage Microsoft Purview Audit (Standard) logs to strengthen their cybersecurity operations. The Microsoft Expanded Cloud Log Implementation playbook offers step-by-step instructions on enabling and utilizing new logging capabilities to enhance threat detection, incident response, and enterprise security. By operationalizing these logs, organizations can better detect and defend against advanced cyber threats, particularly those targeting identity-based systems. What the Playbook Offers The playbook provides: Detailed Log Guidance: Information on how to enable and operationalize newly available cloud logs to detect malicious activity. Threat Hunting Scenarios: Scenario-based analysis to help organizations identify common tactics used in identity-based compromises. Best Practices: Recommendations on navigating Microsoft 365 logs and performing administrative actions to enable these logs effectively. Analytical Methodologies: Detailed guidance on leveraging the logs to detect sophisticated cyber threat actor behavior. The playbook focuses on enabling organizations to use advanced logs, such as: Mail Items Accessed: Monitoring unauthorized or suspicious access to emails. Mail Items Sent: Identifying potentially malicious outbound email activity. User Searches in SharePoint Online and Exchange Online: Detecting unusual or unauthorized searches. Additionally, the playbook explains how to ingest these logs into Security Information and Event Management (SIEM) systems like Microsoft Sentinel and Splunk for deeper analysis and integration into cybersecurity workflows. Significance of Expanded Cloud Logging Microsoft expanded its cloud logging capabilities in 2023, making advanced logs available to public entities using Microsoft Purview Audit (Standard), regardless of their license tier. Previously, these logs were restricted to Audit Premium subscription customers. This update significantly broadens access to critical security data, enabling more organizations to bolster their cyber defenses. CISA Director Jen Easterly emphasized the importance of this development: “CISA is pleased to provide this playbook to help organizations effectively use newly introduced Microsoft security logs to strengthen their cyber defense. Necessary security logs are critical for all organizations to protect their networks. We are pleased to see this progress and continue work to ensure greater adoption of Secure by Design principles.” National Cyber Director Harry Coker Jr. highlighted the value of collaboration in releasing this resource: “Today’s release of the playbook is a result of close collaboration with our federal and private sector partners. The upgraded logging features available will enable network defenders to enhance their threat detection capabilities. Every organization should bolster their security, and this playbook is another step in the right direction.” Empowering Organizations with Secure-by-Design Principles The Secure-by-Design approach is a cornerstone of modern cybersecurity. By default, it integrates critical security features into products and systems, helping organizations better defend against malicious cyber actors. CISA continues to advocate for Secure-by-Design principles in collaboration with government and industry partners, aiming to ensure all organizations have access to essential security data. Candice Ling, Senior Vice President of Microsoft Federal, reinforced this commitment: “With the final publication of the Enhanced Logging Playbook, we are not only providing the critical tools to detect ever-evolving cyber threats through advanced audit logs but also equipping defenders to effectively leverage these tools to protect their networks. Microsoft remains committed to partnering with the federal government to prioritize security above all else.” Target Audience The Microsoft Expanded Cloud Log Implementation playbook is designed for technical personnel responsible for log collection, aggregation, correlation, and incident-response orchestration. This includes government agencies and enterprises using Microsoft E3/G3-and-above licensing. The expanded logs, initially released to the Department of Defense and federal agencies to safeguard U.S. national security, are now accessible to a broader audience. Organizations within Microsoft’s identity boundaries can use this playbook to enhance their cyber defense capabilities. Practical Applications of the Playbook Organizations can leverage the playbook to: Enable Logs: Understand how to navigate Microsoft 365 and perform administrative actions to activate expanded logging capabilities. Integrate Logs into SIEMs: Use tools like Microsoft Sentinel and Splunk to centralize and analyze log data. Detect Threats: Identify suspicious behavior and advanced threat actor techniques, including identity-based attacks. Support Incident Response: Quickly detect and respond to potential security incidents. The playbook provides actionable insights and practical steps, empowering cybersecurity teams to integrate these advanced logs into their operations. Looking Ahead This release marks a significant step in improving access to critical cybersecurity tools. With the playbook, organizations of all sizes can enhance their security posture, detect advanced threats, and respond effectively to cyber incidents. CISA, ONCD, and Microsoft continue to collaborate on innovative solutions to address the evolving cyber threat landscape. By making advanced logs available and providing practical guidance, they aim to help organizations protect their networks and build a more secure digital ecosystem. For organizations using Microsoft E3/G3-and-above licensing, the playbook is a must-read resource to operationalize expanded cloud logs and strengthen cybersecurity defenses.

image for EU Steps Up Cyber De ...

 Cyber News

The European Commission has rolled out a comprehensive plan to fortify the cybersecurity of hospitals and healthcare providers across the EU. Recognizing the increasing frequency of cyberattacks on healthcare systems, this EU Action Plan aims to safeguard patient care, improve response capabilities, and establish   show more ...  

trust in digital healthcare solutions. The healthcare sector has witnessed a rise in cyberattacks in recent years. In 2023 alone, EU Member States reported 309 significant cybersecurity incidents targeting healthcare providers—more than any other critical industry. These disruptions, which can delay medical procedures and endanger lives, highlight the pressing need for resilient cybersecurity strategies. Key Highlights of the EU Action Plan The EU Action Plan is designed to tackle cybersecurity challenges in the healthcare sector through a four-pronged approach: prevention, detection, response, and deterrence. Enhanced Prevention The plan emphasizes strengthening the healthcare sector's preparedness to prevent cybersecurity incidents. This includes: Guidance on Critical Cybersecurity Practices: Hospitals and healthcare providers will receive tailored guidelines to implement best practices for cybersecurity. Cybersecurity Vouchers: Financial assistance in the form of vouchers will be made available to micro, small, and medium-sized healthcare providers to enhance their cybersecurity capabilities. Learning Resources: New educational tools and training programs will be developed to equip healthcare professionals with the knowledge needed to navigate cybersecurity challenges. Improved Threat Detection The EU Action Plan proposes the establishment of a Cybersecurity Support Centre for Hospitals and Healthcare Providers under the guidance of ENISA, the EU Agency for Cybersecurity. By 2026, the Centre will provide an EU-wide early warning system, offering near-real-time alerts about potential cyber threats. Effective Response to Cyberattacks To minimize the impact of cyber incidents, the Action Plan includes the following measures: A rapid response service under the EU Cybersecurity Reserve, leveraging private incident response providers to support healthcare organisations. Development of response playbooks to guide healthcare organisations in handling specific threats, such as ransomware. National cybersecurity exercises to strengthen incident response capabilities across Member States. Encouragement for Member States to mandate the reporting of ransom payments, enabling authorities to provide support and conduct follow-ups with law enforcement. Deterrence To discourage cyberattacks on European healthcare systems, the plan includes the use of the Cyber Diplomacy Toolbox—a coordinated EU diplomatic response to malicious cyber activities. This framework aims to hold cyber threat actors accountable and protect critical healthcare infrastructure. Collaborative Implementation and Next Steps The success of EU Action Plan will depend on collaboration among healthcare providers, Member States, and the cybersecurity community. To ensure the plan is effective and addresses the needs of all stakeholders, the Commission will soon launch a public consultation open to citizens and industry experts. The feedback gathered will help refine the proposed measures, with specific actions scheduled for rollout in 2025 and 2026. Building on a Strong Legislative Framework The EU Action Plan builds on existing EU legislation to strengthen cyber resilience. Healthcare providers are identified as a sector of high criticality under the NIS2 Directive, which works in tandem with the Cyber Resilience Act—a landmark EU regulation that mandates cybersecurity requirements for digital products. Additionally, the recently established Cyber Emergency Mechanism under the Cyber Solidarity Act will play a crucial role in detecting, preparing for, and responding to cybersecurity threats. The initiative also supports the broader goal of creating a European Health Data Space, a framework designed to empower citizens with control over their health data while ensuring the security of sensitive information. Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security, and Democracy, emphasized the importance of resilience in healthcare systems: "Modern healthcare has made incredible advances through digital transformation, which has meant citizens have benefited from better healthcare. Unfortunately, health systems are also subject to cybersecurity incidents and threats. That is why we are launching an Action Plan to ensure that healthcare systems, institutions, and connected medical devices are resilient. Prevention is better than cure, so we need to prevent cyber-attacks from happening. But if they happen, we need to have everything in place to detect them and to quickly respond and recover." Olivér Várhelyi, Commissioner for Health and Animal Welfare, highlighted the role of trust in digital healthcare: "Digital technologies and health data-driven solutions have opened unparalleled opportunities in healthcare. They enable precision medicine, real-time patient monitoring, and seamless communication between healthcare providers across borders. But digitalisation is only as strong as the trust it inspires and resilient from cyberattacks. Patients must feel confident that their most sensitive information is secure. Healthcare professionals must have faith in the systems they use daily to save lives. Today’s Action Plan is an important step towards securing that trust and safeguarding a more resilient health ecosystem for the future." A Step Towards a Secure Digital Healthcare Future The EU Action Plan reflects the Commission’s commitment to fostering a secure and resilient healthcare sector. By addressing cybersecurity challenges through prevention, detection, response, and deterrence, the plan lays the groundwork for a safer healthcare environment where technology empowers patients, enhances care, and supports professionals. As the healthcare sector continues to embrace digitalisation, the EU remains steadfast in its mission to protect its citizens and critical infrastructure from emerging cyber threats.

image for Biden Cybersecurity ...

 Cyber News

In one of his final acts in office, outgoing President Joe Biden on Thursday issued an ambitious order outlining plans to improve U.S. government cybersecurity – including demanding better security from software and cloud companies. The lengthy Biden cybersecurity order builds on plans that began nearly four years   show more ...  

ago in the wake of the Colonial Pipeline ransomware attack. It comes during a week when his top cybersecurity officials  – including CISA officials Jen Easterly and David Mussington and U.S. cyberspace ambassador Nathaniel Fick – have been urging the incoming Trump Administration to continue the fight against cyber threats and disinformation from Russia, China and others. Mussington also cited climate change as a threat to critical infrastructure resilience. In other last-minute moves by the Biden Administration, the U.S. held an informal UN Security Council meeting on efforts to stop the spread of spyware, and Biden himself took aim at the “tech industrial complex” and its effect on disinformation and “extreme wealth” in his farewell address on January 15. The incoming Trump Administration’s approach to cybersecurity and other issues remains to be seen, but the Biden executive order is noteworthy for the lessons his Administration learned in four tumultuous years for cybersecurity. Biden Cybersecurity Order Includes Software, Cloud Security Biden’s final cybersecurity plan lays out ambitious goals – and an equally ambitious timeline, as many of the directives would be implemented within a year. NIST, CISA, the OMB, and the Federal Acquisition Regulatory Council (FAR Council) would develop contract language requiring software providers to attest and validate that they use secure software development practices. Open source software will also be examined, with CISA, the OMB and the GSA developing “recommendations to agencies on the use of security assessments and patching of open source software and best practices for contributing to open source software projects.” Federal government contractors would be required to “follow applicable minimum cybersecurity practices identified” by NIST “when developing, maintaining, or supporting IT services or products that are provided to the Federal Government.” FedRAMP policies and practices would be developed for cloud service providers in the FedRAMP Marketplace to create “baselines with specifications and recommendations for agency configuration of agency cloud-based systems in order to secure Federal data based on agency requirements.” IAM, Post-Quantum Encryption Among Biden's Goals Biden’s order instructs the federal government to “adopt proven security practices from industry — to include in identity and access management — in order to improve visibility of security threats across networks and strengthen cloud security.” Pilot tests for commercial phishing-resistant standards such as WebAuthn are among the requirements for federal agencies, along with post-quantum cryptography (PQC) key establishment (or a hybrid that includes a PQC algorithm) “as soon as practicable upon support being provided by network security products and services already deployed in their network architectures.” Secure management of access tokens and cryptographic keys used by cloud service providers are another requirement. CISA will also lead development of “the technical capability to gain timely access to required data” from agencies’ EDR solutions and security operation centers to enable rapid threat hunting. BGP security shortcomings would be addressed with requirements for ISPs to deploy Internet routing security technologies such as Route Origin Authorizations, Route Origin Validation, route leak mitigation and source address validation. Encryption would be required for DNS traffic, email, video conferencing and instant messaging. Digital Identities 'Encouraged' by Biden Order The order also would “strongly encourage the acceptance of digital identity documents to access public benefits programs that require identity verification, so long as it is done in a manner that preserves broad program access for vulnerable populations and supports the principles of privacy, data minimization, and interoperability.” Agencies would work with states to develop and issue mobile driver’s licenses to meet that goal, along with identity fraud reporting. AI Cybersecurity Innovation and Controls AI “has the potential to transform cyber defense by rapidly identifying new vulnerabilities, increasing the scale of threat detection techniques, and automating cyber defense,” the Biden order states. “The Federal Government must accelerate the development and deployment of AI, explore ways to improve the cybersecurity of critical infrastructure using AI, and accelerate research at the intersection of AI and cybersecurity.” Those efforts would begin with a pilot program “on the use of AI to enhance cyber defense of critical infrastructure in the energy sector.” That pilot program may include vulnerability detection, automated patch management, and “the identification and categorization of anomalous and malicious activity across information technology (IT) or operational technology systems.” That would be followed by a Department of Defense program “to use advanced AI models for cyber defense.” The order also asks agencies to prioritize research on the following topics: human-AI interaction methods to assist defensive cyber analysis AI coding security assistance, including security of AI-generated code methods for designing secure AI systems methods for “prevention, response, remediation, and recovery of cyber incidents involving AI systems.” Secure Architecture a Long-Term Goal One of the few long-term goals in the order is a requirement that within three years, the Director of OMB would issue guidance “to address critical risks and adapt modern practices and architectures across Federal information systems and networks.” That includes, at a minimum, zero trust architectures, EDR capabilities, encryption, network segmentation, and phishing-resistant multi-factor authentication. One last requirement calls for agencies to assess “risks to mission-essential functions presented by concentration of IT vendors and services.” The Biden order applies to federal civilian agencies but not National Security Systems (NSS). However, NSS and “debilitating impact systems” would also be required to develop requirements “that are consistent with the requirements set forth in this order.”

image for New gadgets unveiled ...

 News

One of the worlds premier tech events traditionally takes place every year in Las Vegas in early January. Sure, the Consumer Electronics Show (CES) pays attention to cybersecurity, but by no means is it top of the agenda. Looking for a giant monitor or AI washing machine? Youre in luck! Smart home protection against   show more ...  

hackers? Might have to shop around a bit Weve picked out the top trending announcements at CES 2025, with a focus on what new cyberthreats to expect as the latest innovations hit the shelves. NVIDIA Project DIGITS: your own mini supercomputer for running AI locally NVIDIA founder Jensen Huang unveiled the companys Mac-Mini-sized supercomputer to CES visitors. Powered by the GB10 Grace Blackwell superchip with a minimum 128 GB of memory, the device is capable of running large language models (LLMs) with 200 billion parameters. Connect two such computers, and you can run even larger models with up to 400 billion parameters! However, the US$3000 price tag will limit the buyer audience. Cybersecurity aspect: running LLMs locally stops confidential information from leaking to OpenAI, Google Cloud, and other such services. Until now, this wasnt very practical: on offer were either greatly simplified models that struggled to run on gaming computers, or solutions deployed on powerful servers in private clouds. NVIDIA Project DIGITS now made it easier for both small companies and wealthy hobbyists to run powerful local LLMs. The GB10 Grace Blackwell superchip, 128 GB of RAM, and 4 TB of SSD storage make this NVIDIA offer a decent platform for a local neural network. Source Roborock Saros Z70: a handy vacuum cleaner The inability of robot vacuum cleaners to cope with stairs and other obstacles, including things lying around, greatly limits their usefulness. Roborocks new model solves the latter issue with an extensible arm that picks up small and light objects from the floor. Cybersecurity aspect: the Saros Z70s object-rearranging ability is very limited, and Roborock has not been involved in any major cybersecurity scandals. So were unlikely to see any game-changing risks compared to existing vacuum cleaners. But later models or competitors products can theoretically be used in cyberphysical attacks such as burglary. For instance, researchers recently showed how to hack Ecovacs robot vacuums. But the Saros Z70 is notable for more than just its mechanical hand. Another of its officially announced features is video surveillance. The vendor claims that camera footage never leaves the device, but well believe that when we see it. After all, youll probably at least need a separate device to view the footage. The StarSight 2.0 system, due with a later software update, will let you train the robot to recognize specific household objects (for example, favorite toys) so that it can show where it last saw them on a map of your home. As to whether this handy feature works entirely on the device — or data about things in your home gets fed to the cloud — press releases are maintaining a tactful silence. The Roborock Saros Z70 can lift and carry objects weighing up to 300 grams. Source Bosch Revol: preying on parental fear How did a baby rocker manage to take home the Least private mock award for gadgets at CES 2025, as judged by Electronic Frontier Foundation and iFixIt? The Bosch Revol Smart Crib not only automatically rocks the crib, but continuously collects video and audio data, while simultaneously scanning the babys pulse and breathing rate using millimeter-wave radar. It also monitors temperature, humidity and fine-particle pollution levels. The camera is equipped with object recognition to detect toys, blankets and other potentially dangerous objects near the infants face. All data is instantly streamed to a parental smartphone and to the cloud, where it remains. Cybersecurity aspect: other vendors video baby monitors have been dogged by scandals, and hacked to conduct nasty pranks and spy on parents. In the case of the Revol, not only video, but medical data could end up in cybercriminal hands. When it comes to child and health-related tech, a cloud-free setup as part of a well-protected smart home is the way to go. TP-Link Tapo DL130: in the same vein? Among the many smart locks unveiled at CES 2025, it was TP-Links model that stood out for a feature thats still quite rare — biometrics based not only on face/fingerprint recognition, but also on palm veins matching. Simply wave your hand in front of the sensor, and the system will identify you as the owner with high accuracy. Unlike more common biometric factors, this method doesnt depend on lighting conditions, and works well even with wet and dirty hands. Plus, its more difficult to fake. Cybersecurity aspect: smart locks can be integrated into your home network and interact with your smart home (such as Alexa or Google Home), which creates a wide cyberattack surface. Given the numerous critical vulnerabilities in other TP-Link equipment, theres a risk that flaws in smart locks will allow attackers to open them in unconventional ways. Security researchers are sure to put TP-Links smart lock under the microscope once it goes on sale. Source Google Home + Matter: a cloud-free sky home A major update to Googles smart home hubs means they can now control curtains, sockets, light bulbs and other devices via the Matter protocol without connecting to a cloud server. At the heart of your smart home can be a Google Nest — an Android 14 smart TV or even a Chromecast device. Tell Google Assistant to switch on the bedroom light, and the command will be carried out even without an internet connection, and with minimal delay. If a staunch advocate of a cloud-based future like Google has implemented such offline scenarios, the demand for such functionality must be huge. Cybersecurity aspect: local control of your smart home reduces the risk of compromise and improves privacy — less data about what goes on in your home will leak to equipment vendors. Halliday Glasses: improve your AI-sight We chose Halliday AR glasses for the innovative image projection system that makes them lighter and more compact — though our takeaways also apply to dozens of other smart glasses presented at CES 2025. While some models address a simple and specific issue — such as combining glasses with a hearing aid or serving as a near-eye display for computer users on board a plane — quite a few of them come equipped with an AI assistant, camera, ChatGPT integration, and other features that potentially can be used to spy on you. Theyre used for live translation, teleprompting and other productivity-boosting tasks. Cybersecurity aspect: all AI features involve shifting large amounts of data to the makers servers for processing, so local AI in glasses is still a long way off. But unlike with computers and smartphones, the voices, photos and videos of all those around you will be included in the information flow generated by the glasses. From an ethical or legal standpoint, wearers of such glasses may have to continuously ask permission from everyone around to record them. And those who dont want to pose for Sam Altman should look out for wearers of smart glasses among their peers. Sony Honda AFEELA: I feel its going to be driving by subscription This luxury electric car from two Japanese giants is available to preorder — but only to California residents and with rollout scheduled for 2026 or later. Nevertheless, the Japanese vision could become the envy even of Google: the price of the vehicle includes a complimentary three-year subscription to a variety of in-car features, including Level 2+ ADAS driver-assist and an AI-powered personal assistant, and a choice of interactive car design and entertainment features such as augmented reality and virtual worlds. At the CES 2025 demonstration, the car was summoned onstage by the voice command Come on out, Afeela — but it remains unclear whether this handy feature will be available to drivers. Cybersecurity aspect: weve spotlighted the risks and vulnerabilities of connected cars many times. Whether manufacturers will be able to keep the security bar high, not only for vehicles, but also for telematics systems (especially critical if smart driving becomes subscription-based), is a big question for the future. Those who dont like the idea of their car suddenly turning into an iron pumpkin pending a software update or after a cyberattack are advised to refrain from splashing out at least for another decade or so. BenjiLock: a biometric padlock Now you can lock up your bike (or barn or whatever) without memorizing a code or carrying around a key. As the name suggests, the BenjiLock Outdoor Fingerprint Padlock is a padlock that stores and recognizes fingerprints — up to ten of them. No smartphone or Wi-Fi required, all the magic happens inside the lock itself. The device is resistant to both moisture and dust, and (according to the manufacturer) works on one charge for up to a year. Cybersecurity aspect: only real-world tests can prove resistance to old-school lock picking and inexpensive fingerprint faking. Smart locks are often vulnerable to both.

image for Chinese Innovations ...

 A Little Sunshine

Residents across the United States are being inundated with text messages purporting to come from toll road operators like E-ZPass, warning that recipients face fines if a delinquent toll fee remains unpaid. Researchers say the surge in SMS spam coincides with new features added to a popular commercial phishing kit   show more ...  

sold in China that makes it simple to set up convincing lures spoofing toll road operators in multiple U.S. states. Last week, the Massachusetts Department of Transportation (MassDOT) warned residents to be on the lookout for a new SMS phishing or “smishing” scam targeting users of EZDriveMA, MassDOT’s all electronic tolling program. Those who fall for the scam are asked to provide payment card data, and eventually will be asked to supply a one-time password sent via SMS or a mobile authentication app. Reports of similar SMS phishing attacks against customers of other U.S. state-run toll facilities surfaced around the same time as the MassDOT alert. People in Florida reported receiving SMS phishing that spoofed Sunpass, Florida’s prepaid toll program. This phishing module for spoofing MassDOT’s EZDrive toll system was offered on Jan. 10, 2025 by a China-based SMS phishing service called “Lighthouse.” In Texas, residents said they received text messages about unpaid tolls with the North Texas Toll Authority. Similar reports came from readers in California, Colorado, Connecticut, Minnesota, and Washington. This is by no means a comprehensive list. A new module from the Lighthouse SMS phishing kit released Jan. 14 targets customers of the North Texas Toll Authority (NTTA). In each case, the emergence of these SMS phishing attacks coincided with the release of new phishing kit capabilities that closely mimic these toll operator websites as they appear on mobile devices. Notably, none of the phishing pages will even load unless the website detects that the visitor is coming from a mobile device. Ford Merrill works in security research at SecAlliance, a CSIS Security Group company. Merrill said the volume of SMS phishing attacks spoofing toll road operators skyrocketed after the New Year, when at least one Chinese cybercriminal group known for selling sophisticated SMS phishing kits began offering new phishing pages designed to spoof toll operators in various U.S. states. According to Merrill, multiple China-based cybercriminals are selling distinct SMS-based phishing kits that each have hundreds or thousands of customers. The ultimate goal of these kits, he said, is to phish enough information from victims that their payment cards can be added to mobile wallets and used to buy goods at physical stores, online, or to launder money through shell companies. A component of the Chinese SMS phishing kit Lighthouse made to target customers of The Toll Roads, which refers to several state routes through Orange County, Calif. Merrill said the different purveyors of these SMS phishing tools traditionally have impersonated shipping companies, customs authorities, and even governments with tax refund lures and visa or immigration renewal scams targeting people who may be living abroad or new to a country. “What we’re seeing with these tolls scams is just a continuation of the Chinese smishing groups rotating from package redelivery schemes to toll road scams,” Merrill said. “Every one of us by now is sick and tired of receiving these package smishing attacks, so now it’s a new twist on an existing scam.” In October 2023, KrebsOnSecurity wrote about a massive uptick in SMS phishing scams targeting U.S. Postal Service customers. That story revealed the surge was tied to innovations introduced by “Chenlun,” a mainland China-based proprietor of a popular phishing kit and service. At the time, Chenlun had just introduced new phishing pages made to impersonate postal services in the United States and at least a dozen other countries. SMS phishing kits are hardly new, but Merrill said Chinese smishing groups recently have introduced innovations in deliverability, by more seamlessly integrating their spam messages with Apple’s iMessage technology, and with RCS, the equivalent “rich text” messaging capability built into Android devices. “While traditional smishing kits relied heavily on SMS for delivery, nowadays the actors make heavy use of iMessage and RCS because telecom operators can’t filter them and they likely have a higher success rate with these delivery channels,” he said. It remains unclear how the phishers have selected their targets, or from where their data may be sourced. A notice from MassDOT cautions that “the targeted phone numbers seem to be chosen at random and are not uniquely associated with an account or usage of toll roads.” Indeed, one reader shared on Mastodon yesterday that they’d received one of these SMS phishing attacks spoofing a local toll operator, when they didn’t even own a vehicle. Targeted or not, these phishing websites are dangerous because they are operated dynamically in real-time by criminals. If you receive one of these messages, just ignore it or delete it, but please do not visit the phishing site. The FBI asks that before you bin the missives, consider filing a complaint with the agency’s Internet Crime Complaint Center (IC3), including the phone number where the text originated, and the website listed within the text.

 Feed

Cybersecurity researchers have detailed an attack that involved a threat actor utilizing a Python-based backdoor to maintain persistent access to compromised endpoints and then leveraged this access to deploy the RansomHub ransomware throughout the target network. According to GuidePoint Security, initial access is said to have been facilitated by means of a JavaScript malware downloaded named

 Feed

Ivanti has rolled out security updates to address several security flaws impacting Avalanche, Application Control Engine, and Endpoint Manager (EPM), including four critical bugs that could lead to information disclosure. All the four critical security flaws, rated 9.8 out of 10.0 on the CVSS scale, are rooted in EPM, and concern absolute path traversal flaws that allow a remote unauthenticated

 Feed

The digital world is exploding. IoT devices are multiplying like rabbits, certificates are piling up faster than you can count, and compliance requirements are tightening by the day. Keeping up with it all can feel like trying to juggle chainsaws while riding a unicycle. Traditional trust management? Forget it. It's simply not built for today's fast-paced, hybrid environments. You need a

 Feed

You can tell the story of the current state of stolen credential-based attacks in three numbers: Stolen credentials were the #1 attacker action in 2023/24, and the breach vector for 80% of web app attacks. (Source: Verizon). Cybersecurity budgets grew again in 2024, with organizations now spending almost $1,100 per user (Source: Forrester).  Stolen credentials on criminal forums cost as

 Feed

Details have emerged about a now-patched security vulnerability that could allow a bypass of the Secure Boot mechanism in Unified Extensible Firmware Interface (UEFI) systems. The vulnerability, assigned the CVE identifier CVE-2024-7344 (CVSS score: 6.7), resides in a UEFI application signed by Microsoft's "Microsoft Corporation UEFI CA 2011" third-party UEFI certificate, according to a new

 Feed

Cybersecurity researchers have found that the Microsoft Active Directory Group Policy that's designed to disable NT LAN Manager (NTLM) v1 can be trivially bypassed by a misconfiguration. "A simple misconfiguration in on-premise applications can override the Group Policy, effectively negating the Group Policy designed to stop NTLMv1 authentications," Silverfort researcher Dor Segal said in a

 Feed

Threat actors have been observed concealing malicious code in images to deliver malware such as VIP Keylogger and 0bj3ctivity Stealer as part of separate campaigns. "In both campaigns, attackers hid malicious code in images they uploaded to archive[.]org, a file-hosting website, and used the same .NET loader to install their final payloads," HP Wolf Security said in its Threat Insights Report

 Feed

The Russian threat actor known as Star Blizzard has been linked to a new spear-phishing campaign that targets victims' WhatsApp accounts, signaling a departure from its longstanding tradecraft in a likely attempt to evade detection. "Star Blizzard's targets are most commonly related to government or diplomacy (both incumbent and former position holders), defense policy or international relations

 AI

The video game Path of Exile 2 suffers a security breach, we explore the issues of using predictive algorithms in travel surveillance systems, and the very worst IoT devices are put on show in Las Vegas. Oh, and has Elon Musk accidentally revealed he cheats at video games? All this and much more is discussed in the   show more ...  

latest edition of the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by The Cyberwire's Dave Bittner.

 0CISO2CISO

Source: www.schneier.com – Author: Bruce Schneier Menu Blog Newsletter Books Essays News Talks Academic About Me HomeBlog Phishing False Alarm A very security-conscious company was hit with a (presumed) massive state-actor phishing attack with gift cards, and everyone rallied to combat it—until it turned out   show more ...  

it was company management sending the gift cards. Tags: false […] La entrada Phishing False Alarm – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. A recent cyberattack, mimicking the tactics of the notorious Black Basta ransomware group, targeted one of SlashNext’s clients. Within 90 minutes, 1,165 malicious emails bombarded 22 user inboxes, aiming to trick users into clicking on malicious links. Researchers   show more ...  

at SlashNext have published new findings revealing attackers using tactics similar […] La entrada Black Basta-Style Cyberattack Hits Inboxes with 1,165 Emails in 90 Minutes – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: CyberNewswire. Silver Spring, United States / Maryland, January 15th, 2025, CyberNewsWire Aembit, the non-human identity and access management (IAM) company, unveiled the full agenda for NHIcon 2025, a virtual event dedicated to advancing non-human identity security, streaming   show more ...  

live on Jan. 28 and headlined by industry luminary Kevin Mandia. NHIcon 2025 is […] La entrada Aembit Announces Speaker Lineup for the Inaugural NHIcon – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: CyberNewswire. Tel Aviv, Israel, January 15th, 2025, CyberNewsWire Sweet Security, a leader in cloud runtime detection and response, today announced the launch of its groundbreaking patent-pending Large Language Model (LLM)-powered cloud detection engine. This innovation enhances   show more ...  

Sweet’s unified detection and response solution, enabling it to reduce cloud detection noise to an […] La entrada Sweet Security Introduces Patent-Pending LLM-Powered Detection Engine, Reducing Cloud Detection Noise to 0.04% – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. CVE-2024-44243, a critical macOS vulnerability discovered recently by Microsoft, can allow attackers to bypass Apple’s System Integrity Protection (SIP). Learn how this vulnerability can be exploited and how to protect your devices from this threat. A recently   show more ...  

discovered macOS vulnerability tracked as CVE-2024-44243, has raised alarms for jeopardizing the […] La entrada Microsoft Discovers macOS Flaw CVE-2024-44243, Bypassing SIP – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: CyberNewswire. Prague, Czech republic, January 15th, 2025, CyberNewsWire Quantum computing is set to revolutionize technology, but it also presents a significant security risk for financial institutions. Czech cybersecurity startup Wultra has raised €3 million from Tensor   show more ...  

Ventures, Elevator Ventures, and J&T Ventures to accelerate the development of its post-quantum authentication technology, […] La entrada Wultra Secures €3M to Protect Financial Institutions from Quantum Threats – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. A critical vulnerability (CVE-2024-50603) in the Aviatrix Controller allows unauthenticated RCE. Active exploitation observed by Wiz Research in the wild for cryptojacking and backdoors. Learn about the risks and how to mitigate them. Wiz Research, a prominent player   show more ...  

in the cloud security space, has observed that a critical security […] La entrada Hackers Use CVE-2024-50603 to Deploy Backdoor on Aviatrix Controllers – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Adam Barnett

Source: krebsonsecurity.com – Author: BrianKrebs Microsoft today unleashed updates to plug a whopping 161 security vulnerabilities in Windows and related software, including three “zero-day” weaknesses that are already under active attack. Redmond’s inaugural Patch Tuesday of 2025 bundles more fixes than   show more ...  

the company has shipped in one go since 2017. Rapid7‘s Adam Barnett says January […] La entrada Microsoft: Happy 2025. Here’s 161 Security Updates – Source: krebsonsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A new initiative aimed at improving collaboration on artificial intelligence (AI) cybersecurity across critical infrastructure has been introduced by the Cybersecurity and Infrastructure Security Agency (CISA) in the US. The JCDC AI Cybersecurity Collaboration   show more ...  

Playbook provides detailed guidance for AI developers, providers and adopters on voluntarily sharing cybersecurity information with CISA […] La entrada CISA Launches Playbook to Boost AI Cybersecurity Collaboration – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chinese

Source: www.infosecurity-magazine.com – Author: A version of “PlugX” malware used by Chinese state-backed hackers has been deleted from thousands of US computers worldwide following a multi-month law enforcement operation, the US Department of Justice (DoJ) has announced. The malware was used by Chinese   show more ...  

cyber espionage group Mustang Panda to infect, control and steal information from […] La entrada Chinese PlugX Malware Deleted in Global Law Enforcement Operation – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini A previously unknown threat actor released config files and VPN passwords for Fortinet FortiGate devices on a popular cybercrime forum. A previously unknown threat actor named Belsen Group published configuration files and VPN passwords for over 15,000   show more ...  

Fortinet FortiGate appliances. “2025 will be a fortunate year for the world. […] La entrada Threat actor leaked config files and VPN passwords for over Fortinet Fortigate devices – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini Microsoft Patch Tuesday security updates for January 2025 addressed 161 vulnerabilities, including three actively exploited issues. Microsoft Patch Tuesday security updates for January 2025 addressed 161 vulnerabilities in Windows and Windows Components,   show more ...  

Office and Office Components, Hyper-V, SharePoint Server, .NET and Visual Studio, Azure, BitLocker, Remote Desktop Services, and […] La entrada Microsoft Patch Tuesday updates for January 2025 fixed three actively exploited flaws – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiOS vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiOS authorization   show more ...  

bypass vulnerability, tracked as CVE-2024-55591 (CVSS score: 9.6) to its Known Exploited Vulnerabilities (KEV) catalog. Remote attackers can exploit the […] La entrada U.S. CISA adds Fortinet FortiOS to its Known Exploited Vulnerabilities catalog – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 aws

Source: securityaffairs.com – Author: Pierluigi Paganini The ransomware group Codefinger is using compromised AWS keys to encrypt S3 bucket data using SSE-C, Halcyon researchers warn. The ransomware group Codefinger has been spotted using compromised AWS keys to encrypt data in S3 buckets. The threat actor used   show more ...  

AWS’s Server-Side Encryption with Customer Provided Keys (SSE-C) for […] La entrada Codefinger ransomware gang uses compromised AWS keys to encrypt S3 bucket – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Apple

Source: securityaffairs.com – Author: Pierluigi Paganini Microsoft disclosed details of a vulnerability in Apple macOS that could have allowed an attacker to bypass the OS’s System Integrity Protection (SIP). Microsoft disclosed details of a now-patched macOS flaw, tracked as CVE-2024-44243 (CVSS score: 5.   show more ...  

5), that allows attackers with “root” access to bypass System Integrity Protection (SIP). SIP […] La entrada CVE-2024-44243 macOS flaw allows persistent malware installation – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Jessica Lyons GoDaddy has failed to protect its web-hosting platform with even basic infosec tools and practices since 2018, according to the FTC, but the internet giant won’t face any immediate consequences for its many alleged acts of omission. As one of the   show more ...  

world’s largest web-hosting companies, and a registry and […] La entrada GoDaddy slapped with wet lettuce for years of lax security and ‘several major breaches’ – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Brandon Vigliarolo Drone maker DJI has decided to scale back its geofencing restrictions, meaning its software won’t automatically stop operators from flying into areas flagged as no-fly zones.  While the FBI searches for a drone operator responsible for a collision   show more ...  

with a firefighting aircraft battling wildfires in California, mystery drone sightings […] La entrada DJI loosens flight restrictions, decides to trust operators to follow FAA rules – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 China's

Source: go.theregister.com – Author: Jessica Lyons Beijing’s Salt Typhoon cyberspies had been seen in US government networks before telcos discovered the same foreign intruders in their own systems, according to CISA boss Jen Easterly. Speaking at a Foundation for Defense of Democracies (FDD) event on   show more ...  

Wednesday, the agency director said her threat hunters detected the […] La entrada China’s Salt Typhoon spies spotted on US govt networks before telcos, CISA boss says – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Thomas Claburn Researchers at cyber-defense contractor PeopleTec have found that facial-recognition algorithms’ focus on specific areas of the face opens the door to subtler surveillance avoidance strategies. In a pre-print paper titled “Novel AI Camera   show more ...  

Camouflage: Face Cloaking Without Full Disguise,” David Noever, chief scientist, and Forrest McKee, data scientist, describe […] La entrada Even modest makeup can thwart facial recognition – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Richard Speed Devices that have Citrix’s Session Recording software installed are having problems completing this month’s Microsoft Patch Tuesday update, which includes important fixes. Microsoft noted the problem in the list of known issues with the update,   show more ...  

which arrived on January 14. According to the Windows vendor, affected devices will download […] La entrada Windows Patch Tuesday hits snag with Citrix software, workarounds published – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Waqas. Technology is changing the global economy, and fintech companies are at the backbone of this transformation. To keep up, businesses need to understand that while complex regulations may sound difficult to deal with; cybersecurity threats are the real danger to their   show more ...  

credibility and success. Here are six strategies that showcase […] La entrada 6 Strategic Innovations Transforming the Fintech Industry – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. SUMMARY Cybercriminals are exploiting the California wildfires to launch phishing campaigns. Veriti Research found fake domains like “malibu-firecom” designed to mimic legitimate services. These domains aim to steal personal information or install malware under   show more ...  

the guise of fire-related assistance. Scammers are using fear and urgency to deceive victims into […] La entrada Scammers Exploit California Wildfires, Posing as Fire Relief Services – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: heimdalsecurity.com – Author: Gabriella Antal The NIS2 Directive is a pivotal regulation aimed at enhancing cybersecurity within critical sectors across the European Union. With its stringent requirements for managing cyber risks, securing supply chains, and reporting incidents, it’s essential for   show more ...  

organizations to ensure compliance. This article outlines the crucial steps for aligning with NIS2 […] La entrada Your Ultimate Guide to NIS2 Compliance: Key Steps and Insights – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CISA

Source: www.securityweek.com – Author: Associated Press Jen Easterly, the outgoing head of the U.S. government’s Cybersecurity and Infrastructure Security Agency, said Wednesday she hopes her agency is allowed to continue its election-related work under new leadership despite “contentiousness” around that   show more ...  

part of its mission. “I really, really hope that we can continue to support those […] La entrada Head of US Cybersecurity Agency Says She Hopes It Keeps up Election Work Under Trump – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 China

Source: www.securityweek.com – Author: Ryan Naraine The FBI, working in tandem with law enforcement authorities in France, have turned the PlugX malware’s own self-delete mechanism against it, erasing the China-linked remote access trojan from more than 4,200 infected computers in the United States. Using   show more ...  

court-approved access to a command-and-control (C2) server, investigators sent self-delete commands […] La entrada FBI Uses Malware’s Own ‘Self-Delete’ Trick to Erase Chinese PlugX From US Computers – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Compliance

Source: www.securityweek.com – Author: Trevin Edgeworth The International Monetary Fund estimates that in the past two decades, nearly one-fifth of reported cyber incidents have affected the global financial sector, causing $12 billion in direct losses to financial firms. Not only has the EU taken notice, but   show more ...  

it is also on the verge of taking action. […] La entrada DORA’s Deadline Looms: Navigating the EU’s Mandate for Threat Led Penetration Testing – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Kevin Townsend SecurityWeek’s Cyber Insights 2025 examines expert opinions on the expected evolution of more than a dozen areas of cybersecurity interest over the next 12 months. We spoke to hundreds of individual experts to gain their expert opinions. Here we discuss   show more ...  

what to expect in Open Source and the Software […] La entrada Cyber Insights 2025: Open Source and Software Supply Chain Security – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Ionut Arghire A vulnerability in Google’s OAuth implementation can be abused to take over the accounts of former employees of failed startups by purchasing their domains, according to a report from secrets scanning firm Truffle Security. The issue is relatively   show more ...  

straightforward: when purchasing a failed startup’s domain, anyone can re-create old […] La entrada Google OAuth Flaw Leads to Account Takeover When Domain Ownership Changes – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chrome

Source: www.securityweek.com – Author: Ionut Arghire Google on Tuesday announced the release of Chrome 132 to the stable channel with 16 security fixes, including 13 that resolve vulnerabilities reported by external researchers. Of the externally reported flaws, five are high-severity bugs affecting browser   show more ...  

components such as the V8 JavaScript engine, Navigation, the open source 2D […] La entrada Chrome 132 Patches 16 Vulnerabilities – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Ionut Arghire Nvidia, Zoom, and Zyxel this week announced fixes for multiple high-severity vulnerabilities in their products, urging users to update devices as soon as possible. Nvidia released patches for three security defects in Container Toolkit and GPU Operator for   show more ...  

Linux, including two high-severity improper isolation bugs that could be exploited […] La entrada Nvidia, Zoom, Zyxel Patch High-Severity Vulnerabilities – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-01
Aggregator history
Thursday, January 16
WED
THU
FRI
SAT
SUN
MON
TUE
JanuaryFebruaryMarch