Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Zero Day: Robert De ...

 Features

Netflix has dropped the first official trailer for its upcoming limited series "Zero Day", and it’s a chilling glimpse into a world thrown into chaos by a massive cyberattack. With its all-star cast led by Robert De Niro and a storyline that feels ripped from the headlines, the six-episode political   show more ...  

thriller is set to premiere on February 20, 2025, promising an edge-of-your-seat experience for viewers. The trailer wastes no time pulling you into the heart of the crisis. “Three thousand, four hundred and two people died on Zero Day,” says De Niro’s character, George Mullen, a former U.S. president, as haunting images of a crippled nation flash on screen. Smoke rises over New York City, office lights cut out, and panicked crowds scramble in chaos. News anchors label the event a "nationwide terror" as computer systems are hijacked, and a chilling warning flashes across every screen in America: "This will happen again". [caption id="attachment_100442" align="aligncenter" width="958"] Source: YouTube[/caption] At the center of this disaster is Mullen, brought back into the political spotlight to lead the Zero Day Commission, an elite team tasked with uncovering who was behind the devastating cyberattack. De Niro’s portrayal of the reluctant yet resolute leader adds a layer of gravitas, as Mullen’s investigation forces him to confront not only external threats but also his own personal demons. “If the public finds out how deep this really is, I don’t think we survive that,” warns Evelyn Mitchell, the current U.S. president played by Angela Bassett. Her character assigns Mullen the near-impossible task of navigating political intrigue, disinformation, and the ambitions of power brokers in technology, Wall Street, and government—all while a nation teeters on the brink of collapse. Zero Day: A Cyberattack That Hits Home Zero Day dives deep into the terrifying consequences of a large-scale cyberattack, blending drama with an uncomfortably plausible scenario. The attack causes not just widespread destruction but also thousands of deaths, leaving the nation in a state of unprecedented unrest. As misinformation spreads and the public demands answers, the series examines the delicate balance between national security and the political machinery working to control the narrative. The creators—Eric Newman (Narcos), Noah Oppenheim (former NBC News president), and Pulitzer Prize-winning journalist Michael S. Schmidt—use the show as a vehicle to explore themes that feel more relevant than ever: the dangers of disinformation, the fragility of digital infrastructures, and the moral compromises required of those in power. Directed by Lesli Linka Glatter (Homeland), who also serves as an executive producer, the series promises a visually intense and emotionally gripping experience. Robert De Niro not only stars but also serves as an executive producer, lending his creative touch to a project that feels both timely and timeless. The Human Cost of Leadership At its core, this Netflix series is as much about human resilience as it is about political intrigue. Mullen’s journey is fraught with personal sacrifices as he navigates fractured relationships with his family. Lizzy Caplan plays Alexandra Mullen, his daughter and a congresswoman, who grapples with her father’s reentry into public life amid doubts about his fitness for the role. Adding to the tension is Jesse Plemons as Roger Carlson, Mullen’s former bodyguard, whose loyalty is tested in the face of mounting suspicion. Connie Britton, Joan Allen, Matthew Modine, Clark Gregg, and Gaby Hoffmann round out the stellar cast, bringing depth and nuance to a narrative that doesn’t shy away from the complexities of power and responsibility. The series promises to keep viewers guessing: Is Mullen the hero the country needs, or has the burden of leadership taken too great a toll? The trailer hints at a man battling not just external enemies but also the ghosts of his past, raising the stakes for every decision he makes. A Timely Tale of Disinformation and Power Netflix’s description of Zero Day teases a story steeped in intrigue: “As disinformation runs rampant and the personal ambition of power brokers in technology, Wall Street, and government collide, Mullen’s unwavering search for the truth forces him to confront his own dark secrets while risking all he holds dear.” The show also sheds light on the vulnerabilities of modern societies in the face of cyber warfare. A Must-Watch Netflix Thriller For fans of political dramas and thrillers, Zero Day offers a potent mix of high-stakes action and thought-provoking commentary. The six-episode series will be available in its entirety on February 20, 2025, allowing viewers to binge-watch a story that feels all too real. Starring powerhouse actors Robert De Niro and Angela Bassett, Zero Day has generated significant buzz as one of Netflix’s anticipated releases this year. While the trailer teases a gripping narrative filled with intrigue, power struggles, and the fallout of a cyberattack, whether the series lives up to its promise remains to be seen. Audiences will have to wait until its release to judge how effectively it tackles its themes and delivers on its premise. I will definitely watch Zero Day and will soon share my review of the series right here. So, stay updated with The Cyber Express for more insights and analysis. Mark your calendars: Zero Day premieres globally on Netflix on February 20, 2025. Will George Mullen uncover the truth before another attack strikes, or will the cost of his mission be too great? The answers await in this electrifying limited series.

image for Four Critical Ivanti ...

 Cyber News

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have jointly issued a Cybersecurity Advisory to address the active exploitation of critical vulnerabilities in Ivanti Cloud Service Appliances (CSA). These Ivanti CSA Vulnerabilities —CVE-2024-8963,   show more ...  

CVE-2024-9379, CVE-2024-8190, and CVE-2024-9380—were exploited in September 2024 by threat actors to compromise victim networks. Ivanti CSA Vulnerabilities Overview The vulnerabilities being exploited include: CVE-2024-8963: An administrative bypass vulnerability (Path Traversal) that allows unauthorized access to restricted features of the appliance. CVE-2024-8190: An OS command injection vulnerability enabling threat actors to authenticate remotely and execute arbitrary commands. CVE-2024-9379: A SQL injection vulnerability permitting attackers with administrative privileges to run malicious SQL statements. CVE-2024-9380: A command injection vulnerability allowing remote code execution (RCE) when exploited by attackers with admin privileges. Threat actors utilized two primary exploit chains: one combining CVE-2024-8963 with CVE-2024-8190 and CVE-2024-9380, and the other combining CVE-2024-8963 with CVE-2024-9379. These exploitations enabled initial access, RCE, credential theft, and the implantation of malicious webshells. Affected Versions Vulnerabilities CVE-2024-8963, CVE-2024-8190, and CVE-2024-9380 impact Ivanti CSA 4.6x versions prior to build 519. CVE-2024-9379 and CVE-2024-9380 additionally affect CSA versions 5.0.1 and below. Notably, Ivanti CSA 4.6 has reached end-of-life (EOL) and no longer receives security patches or updates. Users of version 4.6 are strongly advised to upgrade to the latest supported versions to mitigate these risks. Key Findings from Incident Response CISA and trusted third-party incident responders analyzed the attacks and found: Credential Theft and Lateral Movement: Attackers used the vulnerabilities to exfiltrate credentials and move laterally within compromised networks. Webshell Implantation: Webshells were deployed to maintain persistent access and execute malicious commands. Detection of Anomalous Activity: Organizations that detected and responded quickly successfully mitigated further exploitation. Examples of Incident Response Three victim organizations shared their experiences with CISA and the FBI: Organization 1: Detected anomalous user account creation early, likely preventing lateral movement. They replaced compromised systems and upgraded them, limiting damage. Organization 2: Leveraged an endpoint protection platform (EPP) that alerted defenders to malicious script execution. Webshell creation was prevented. Organization 3: Used indicators of compromise (IOCs) from other victim organizations to detect and respond to the threat. They identified activity involving tools like Obelisk and GoGo Scanner, which generated large amounts of logs, aiding in detection. Mitigation Measures To counter these Ivanti CSA Vulnerabilities, CISA and FBI recommend the following steps: Upgrade Software: Immediately upgrade to the latest supported version of Ivanti CSA. Note that Ivanti CSA 4.6 is EOL and unsupported. Implement Endpoint Detection and Response (EDR): Deploy EDR solutions to monitor and alert on anomalous activity. Log Network Activity: Maintain detailed logs of network traffic, user account behavior, and software activity to identify malicious behavior. Patch Management: Ensure operating systems, software, and firmware are regularly updated. Apply patches within 24-48 hours of vulnerability disclosures to minimize exposure. The advisory aligns with the MITRE ATT&CK® Matrix framework for Enterprise to detail threat actors’ activities. Tactics include initial access, credential dumping, and remote command execution. CISA and FBI Guidance Organizations should consider credentials and sensitive data within compromised Ivanti appliances to be at risk. Immediate action should be taken to analyze logs and artifacts for signs of malicious activity. The advisory provides specific detection methods and IOCs for defenders to utilize. Additionally, network administrators and security professionals are encouraged to refer to CISA’s Known Exploited Vulnerabilities Catalog to stay informed on actively exploited vulnerabilities and emerging threats. This advisory serves as a critical reminder of the importance of maintaining up-to-date software, rapid vulnerability patching, and effective threat detection strategies. Organizations relying on Ivanti CSA must prioritize upgrading to the latest versions and implementing robust security practices to defend against these attacks.

image for Cisco Warns of Criti ...

 Firewall Daily

Cisco has issued a security advisory regarding a critical privilege escalation vulnerability found in Cisco Meeting Management. The vulnerability is tied to the REST API component of the platform, and if exploited, it could allow an attacker to escalate their privileges from a low-level authenticated user to an   show more ...  

administrator.   This issue has the potential to compromise the security of the affected devices, granting unauthorized access to sensitive features and settings.  Cisco Meeting Management: Advisory Overview  The vulnerability, identified by advisory ID cisco-sa-cmm-privesc-uy2Vf8pc, was first published on January 22, 2025, at 16:00 GMT. The issue is classified as critical, with a CVSS score of 9.9, indicating the severity of the threat. The vulnerability is tracked under CVE-2025-20156 and is linked to Cisco Bug ID CSCwi88558.  [caption id="attachment_100468" align="alignnone" width="920"] Cisco Meeting Management (Source: Cisco)[/caption] The problem stems from improper authorization enforcement on the REST API in Cisco Meeting Management. Specifically, the lack of sufficient validation means that a remote, authenticated attacker with low-level privileges can exploit this vulnerability by sending malicious requests to a specific endpoint.   If successful, the attacker could gain administrator-level access to the device, potentially taking full control of edge nodes managed by Cisco Meeting Management.  Affected Products  This vulnerability affects all versions of Cisco Meeting Management. Regardless of device configuration, any system running an affected version is vulnerable. For users of Cisco Meeting Management, it is crucial to check whether their current software release is impacted.  The issue is present in Cisco Meeting Management releases up to and including version 3.8. Cisco has provided updates to address the flaw in version 3.9.1. Notably, version 3.10 is not vulnerable to this privilege escalation issue.  Exploitation Details  Exploitation of the vulnerability occurs when a low-privileged authenticated user sends crafted API requests to certain endpoints in the REST API. These requests bypass the intended authorization checks, leading to the elevation of the attacker's privileges. A successful exploit allows the attacker to execute administrative commands, potentially compromising the device’s security and integrity.  As of the advisory's release, there have been no reports of public exploitation or malicious use of this vulnerability. However, due to its severity, Cisco strongly urges affected users to update their systems as soon as possible.  No Workarounds Available  Unfortunately, there are no workarounds for mitigating this vulnerability. Cisco has emphasized that the only way to address the issue is through a software update. Therefore, organizations using Cisco Meeting Management should prioritize updating to the fixed software versions outlined in the advisory.  Cisco’s Response  To address the vulnerability, Cisco has released software updates for affected versions of Cisco Meeting Management. The following is the guidance for upgrading:  Cisco Meeting Management 3.8 and earlier: Users should migrate to a fixed release, such as version 3.9.1.  Cisco Meeting Management 3.9: Upgrade to version 3.9.1.  Cisco Meeting Management 3.10: This version is not affected and does not require any updates.  For customers who do not have a service contract or those unable to obtain updates through normal channels, Cisco recommends contacting the Cisco Technical Assistance Center (TAC) to get assistance with obtaining the necessary software fixes.  What Affected Users Should Do  Users should check the Fixed Software section of the advisory to ensure they are using an updated, secure version. Customers with service contracts can access updates through the usual channels. However, those without service contracts should reach out directly to Cisco TAC for support.  It is essential to note that customers are only eligible for free security updates for the versions and feature sets they have purchased. To obtain these updates, customers need to have a valid license from Cisco or an authorized reseller.  Conclusion  The Privilege Escalation Vulnerability in the Cisco Meeting Management REST API is a critical security issue with potentially severe consequences. Organizations should prioritize updating their systems to the latest fixed releases to mitigate the risk of unauthorized access and control. As no workarounds are available, upgrading to a secure version remains the only solution for those affected. 

image for Why AWS S3 Buckets A ...

 Cyber Essentials

Cybersecurity threats continue to evolve, and the latest reports reveal a ransomware campaign targeting AWS S3 buckets functionality. This campaign exploits versioning and encryption features, presenting a significant risk to organizations relying on cloud storage. Below, The Cyber Express (TCE) outlines the key   show more ...  

details of this attack and provides actionable steps to safeguard your systems. AWS S3 Buckets: Overview of the Ransomware Campaign The campaign exploits Amazon Web Services (AWS) S3 bucket functionality by abusing versioning and encryption. Attackers gain unauthorized access by compromising Identity and Access Management (IAM) credentials or exploiting overly permissive IAM roles. Once access is achieved, they manipulate AWS features to encrypt or restrict access to the original data, rendering it inaccessible unless a ransom is paid or S3 versioning is enabled for recovery. This attack method capitalizes on the widespread use of AWS in enterprises, complicating recovery efforts and amplifying the consequences of weak security configurations. How Attackers Gain Access Attackers typically gain initial access through: Compromised IAM credentials: Obtained via phishing emails or social engineering. Overly permissive IAM roles: Exploited misconfigurations that provide broad access to AWS resources. Once inside, attackers leverage AWS-native features to execute their attacks, making detection and response more difficult. Impact of the Attack Organizations affected by this campaign face severe consequences, including: Operational Disruption: Data stored in S3 buckets becomes inaccessible, halting operations. Financial Losses: Costs include potential ransom payments, extended recovery times, and revenue losses. Reputational Damage: Breaches erode customer trust and brand credibility. For organizations without backup and recovery strategies, the reliance on cloud storage further magnifies the impact. Steps to Protect Your Systems To defend against this ransomware campaign, organizations should implement the following measures: 1. Review and Strengthen IAM Policies Apply the principle of least privilege to limit access rights to only what is necessary. Conduct regular audits of IAM permissions and revoke excessive privileges. 2. Enable Multi-Factor Authentication (MFA) Enforce MFA for all user and root accounts to provide an additional layer of security. 3. Monitor AWS Environments Use AWS CloudTrail to log and monitor all account activity. Activate AWS GuardDuty to detect suspicious behavior and potential threats. 4. Ensure Data Backup and Recovery Maintain immutable backups of critical S3 data using S3 Object Lock to prevent unauthorized deletion or overwriting. Enable S3 versioning to keep multiple object versions within buckets, providing a recovery mechanism. Periodically test recovery procedures to ensure preparedness for real incidents. 5. Restrict Access to S3 Buckets Configure restrictive bucket policies to limit access to specific users or applications. Enforce encryption for all stored data to ensure its confidentiality. 6. Restrict SSE-C Usage Avoid relying on Server-Side Encryption with Customer-Provided Keys (SSE-C), as attackers can exploit this feature to lock victims out. As ransomware tactics increasingly target cloud infrastructures, it is essential to strengthen your organization’s cloud security posture. Regularly reviewing IAM policies, monitoring environments, and ensuring robust backups are critical steps to mitigating risk. What to Do if You Notice Unauthorized Activity If you suspect unauthorized activity in your AWS account, follow these steps: 1. Verify Unauthorized Activity Generate credential reports to determine the last use of IAM user passwords or access keys. Review recently accessed IAM roles, user groups, and policies. 2. Identify Unauthorized Access or Changes Use AWS tools like CloudTrail Event History to monitor account activity. Check Cost and Usage Reports for unexpected resource usage or charges. 3. Remediate Unauthorized Activity Rotate and delete exposed access keys: Create a new access key. Update applications to use the new key. Deactivate and, once confirmed, delete the original key. Rotate IAM user credentials: Attach updated policies to compromised IAM users. Change passwords and delete unauthorized users. Review and delete any unrecognized resources such as EC2 instances, S3 buckets, or Lambda functions. 4. Secure the Root Account with MFA Enable MFA for the root account to provide an additional authentication layer and reduce the risk of compromised passwords. Recovery Steps If backups are available, restore compromised resources to their last known clean state. Key recovery actions include: Restoring Amazon S3 object versions. Rebuilding EC2 instances or RDS databases from snapshots. Validating resource configurations to ensure they align with organizational policies. This ransomware campaign targeting AWS S3 buckets highlights the importance of proactive security measures for cloud environments. By implementing strong IAM policies, enabling MFA, maintaining immutable backups, and monitoring activity, organizations can significantly reduce their exposure to these attacks. Staying vigilant and fostering a strong incident response capability are essential in today’s evolving threat landscape. By taking these precautions, you can safeguard your AWS environments from becoming the next victim of this ransomware campaign.

image for What Makes Bulletpro ...

 Cyber News

The Australian Cyber Security Centre has issued a warning about Bulletproof Hosting Providers (BPH), which play a central role in enabling cybercrime. These providers offer infrastructure that helps cybercriminals carry out attacks such as ransomware campaigns, data theft, and phishing scams, all while remaining   show more ...  

largely undetectable. The ACSC's latest warning highlights the growing challenges posed by these illicit services and their significant impact on cybersecurity in Australia and beyond.  Understanding Bulletproof Hosting Providers (BPH)  Bulletproof Hosting Providers are businesses that offer infrastructure to cybercriminals, specifically designed to evade detection and prevent law enforcement from shutting down illegal activities. BPH services are a key component of the Cybercrime-as-a-Service (CaaS) ecosystem, which gives criminals access to the tools they need to execute cyberattacks. These services include hosting malware, launching ransomware campaigns, and facilitating the theft of sensitive data, among other malicious activities.  The term "bulletproof" is somewhat misleading—while it suggests invulnerability, it’s actually more of a marketing tool. These providers may be difficult to trace and disrupt, but they are not invincible. What distinguishes BPH providers from legitimate infrastructure providers is their willingness to flout legal requests for service shutdowns. They often ignore take-down orders from victims or law enforcement, allowing cybercriminals to operate with minimal fear of interruption.  How Bulletproof Hosting Providers Facilitate Cybercrime  BPH providers offer cybercriminals the infrastructure necessary to carry out a wide range of illegal activities. Typically, these services lease virtual or physical servers and IP addresses to criminals, allowing them to mask their identities and obfuscate their locations. Many BPH providers use complex methods, such as network switching and frequent IP address changes, to make it difficult for authorities to trace activity back to its source.  Moreover, some BPH providers go as far as leasing infrastructure from legitimate data centers or Internet Service Providers (ISPs), often without the knowledge of these companies. This further complicates efforts to detect and disrupt criminal activity.  Another challenge in combating BPH providers is their geographic location. Many operate in countries with weak or unenforced cybercrime laws, making it harder for authorities to take action. This international aspect of the problem means that cybercriminals can continue their operations with little concern for local law enforcement efforts.  The Impact of BPH on Australian Cybersecurity  The ramifications of BPH’s role in cybercrime are far-reaching, particularly for Australian businesses and individuals. These illicit services have been linked to a range of damaging cybercrimes, including ransomware attacks, extortion, and the theft of sensitive customer data. The spread of BPH services has also globalized the threat, allowing cybercriminals to target victims in multiple countries from a single platform.  The ACSC has made it clear that the impact of these malicious services extends beyond Australian borders. A single BPH provider can support hundreds or even thousands of cybercriminals, giving them the tools to target victims worldwide. As cybercrime becomes increasingly global, it is essential for authorities to develop strategies that can disrupt these criminal networks and limit the damage they can cause.  Efforts to Disrupt Bulletproof Hosting Providers  In response to the growing threat posed by BPH providers, the ACSC, in collaboration with international law enforcement agencies and cybersecurity experts, is ramping up efforts to dismantle these criminal infrastructures. The key to disrupting these services lies in targeting their infrastructure, reducing the ability of cybercriminals to operate undetected.  One of the strategies being employed is the proactive blocking of internet traffic associated with known BPH services. By identifying and isolating these malicious infrastructures, authorities aim to limit the impact of cybercrime on Australian businesses and networks. Additionally, legitimate ISPs and infrastructure providers are being encouraged to adopt best practices that prevent BPH services from accessing their networks.  While BPH providers are a significant part of the Cybercrime-as-a-Service (CaaS) ecosystem, they are not the only players enabling cybercriminal activity. Other underground services offer tools for malware distribution, evasion techniques, and access to compromised networks. Dismantling this entire ecosystem is critical to reducing the frequency and scale of cyberattacks targeting Australia and other nations.  Conclusion   The Australian Cyber Security Centre’s efforts to tackle the threat posed by Bulletproof Hosting Providers highlight the importance of a coordinated, global approach to combating cybercrime. By targeting the infrastructure that supports cybercriminals, the ACSC aims to disrupt their operations and reduce attacks on Australian businesses and individuals.   Organizations must remain vigilant, implementing strong security measures such as regular software updates, multi-layered defenses, and collaboration with law enforcement and cybersecurity experts. While the fight against cybercrime continues, the ACSC’s initiatives represent a vital step toward diminishing the impact of malicious services like BPH, ultimately strengthening Australia’s cybersecurity and protecting its digital infrastructure. 

image for The Security Risk of ...

 Feed

While employees want to take advantage of the increased efficiency of GenAI and LLMs, CISOs and IT teams must be diligent and stay on top of the most up-to-date security regulations.

 Feed

Cisco has released software updates to address a critical security flaw impacting Meeting Management that could permit a remote, authenticated attacker to gain administrator privileges on susceptible instances. The vulnerability, tracked as CVE-2025-20156, carries a CVSS score of 9.9 out 10.0. It has been described as a privilege escalation flaw in the REST API of Cisco Meeting Management. "This

 Feed

Google on Wednesday shed light on a financially motivated threat actor named TRIPLESTRENGTH for its opportunistic targeting of cloud environments for cryptojacking and on-premise ransomware attacks. "This actor engaged in a variety of threat activity, including cryptocurrency mining operations on hijacked cloud resources and ransomware activity," the tech giant's cloud division said in its 11th

 Feed

Cybersecurity researchers have disclosed details of a new BackConnect (BC) malware that has been developed by threat actors linked to the infamous QakBot loader. "BackConnect is a common feature or module utilized by threat actors to maintain persistence and perform tasks," Walmart's Cyber Intelligence team told The Hacker News. "The BackConnect(s) in use were 'DarkVNC' alongside the IcedID

 Feed

An analysis of HellCat and Morpheus ransomware operations has revealed that affiliates associated with the respective cybercrime entities are using identical code for their ransomware payloads. The findings come from SentinelOne, which analyzed artifacts uploaded to the VirusTotal malware scanning platform by the same submitter towards the end of December 2024. "These two payload samples are

 Feed

Despite significant investments in advanced technologies and employee training programs, credential and user-based attacks remain alarmingly prevalent, accounting for 50-80% of enterprise breaches[1],[2]. While identity-based attacks continue to dominate as the leading cause of security incidents, the common approach to identity security threats is still threat reduction, implementing layers of

 Feed

SonicWall is alerting customers of a critical security flaw impacting its Secure Mobile Access (SMA) 1000 Series appliances that it said has been likely exploited in the wild as a zero-day. The vulnerability, tracked as CVE-2025-23006, is rated 9.8 out of a maximum of 10.0 on the CVSS scoring system. "Pre-authentication deserialization of untrusted data vulnerability has been identified in the

 Feed

Are your websites leaking sensitive data? New research reveals that 45% of third-party apps access user info without proper authorization, and 53% of risk exposures in Retail are due to the excessive use of tracking tools. Learn how to uncover and mitigate these hidden threats and risks—download the full report here. New research by web exposure management specialist Reflectiz reveals several

 Feed

An exhaustive evaluation of three firewall models from Palo Alto Networks has uncovered a host of known security flaws impacting the devices' firmware as well as misconfigured security features. "These weren't obscure, corner-case vulnerabilities," security vendor Eclypsium said in a report shared with The Hacker News. "Instead these were very well-known issues that we wouldn't expect to see

 Feed

Cybersecurity researchers are calling attention to a new malware campaign that leverages fake CAPTCHA verification checks to deliver the infamous Lumma information stealer. "The campaign is global, with Netskope Threat Labs tracking victims targeted in Argentina, Colombia, the United States, the Philippines, and other countries around the world," Leandro Fróes, senior threat research engineer at

 Feed

Enterprise-grade Juniper Networks routers have become the target of a custom backdoor as part of a campaign dubbed J-magic. According to the Black Lotus Labs team at Lumen Technologies, the activity is so named for the fact that the backdoor continuously monitors for a "magic packet" sent by the threat actor in TCP traffic.  "J-magic campaign marks the rare occasion of malware designed

 Law & order

An Italian hacker makes the grade and ends up in choppy waters, and hear true stories of title deed transfer scams. All this and more is discussed in the latest edition of the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault. Plus - don't miss our featured interview with Avery Pennarun of Tailscale.

 Cyber Security News

Source: www.darkreading.com – Author: Becky Bracken, Senior Editor, Dark Reading Source: Andrey Popov via Alamy Stock Photo President Donald Trump revoked former President Joe Biden’s 2023 executive order aimed at putting security guardrails around artificial intelligence (AI) systems and their potential   show more ...  

impact to national security, giving a major boost to private sector companies like OpenAI, […] La entrada Trump Overturns Biden Rules on AI Development, Security – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chinese

Source: www.darkreading.com – Author: Elizabeth Montalbano, Contributing Writer Source: BeeBright via Shutterstock A newly discovered Chinese threat group has targeted a South Korean VPN developer with a supply chain attack aimed at deploying a custom backdoor to collect data for cyber-espionage purposes. The   show more ...  

group, dubbed PlushDaemon by the researchers at ESET Research who discovered it, […] La entrada Chinese Cyberspies Target South Korean VPN in Supply Chain Attack – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Kristina Beek, Associate Editor, Dark Reading Source: White House Photo via Alamy Stock Photo NEWS BRIEF On just his second day in office, President Trump has pardoned Ross Ulbricht, the creator and owner of an underground criminal forum website known for cybercrime and   show more ...  

drug trafficking. Known as “Dread Pirate Roberts,” Ulbricht […] La entrada Trump Pardons ‘Silk Road’ Dark Web Drug Market Creator – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 attacks

Source: www.darkreading.com – Author: Itzik Alvas Itzik Alvas, Co-Founder & CEO, Entro Security January 22, 2025 3 Min Read Source: Brain light via Alamy Stock Photo COMMENTARY A look back at 2024’s top non-human identity (NHI) attacks and their year-end explosion sends a worrying signal that 2025 is   show more ...  

going to be a tough year for […] La entrada Will 2025 See a Rise of NHI Attacks? – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Robert Lemos, Contributing Writer Source: Ground Picture via Shutterstock National governments and companies in the Middle East and Africa continue to push for more widely available digital identity systems to allow citizens to connect and authenticate to digital government   show more ...  

services and commercial services. In Morocco, the government issued more than 4.6 […] La entrada Mandatory MFA, Biometrics Make Headway in Middle East, Africa – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cisco

Source: www.darkreading.com – Author: Jeffrey Schwartz Source: Andriy Popov via Alamy Stock Photo Cisco is expanding its cloud security platform with new technology that will let developers detect and mitigate vulnerabilities in artificial intelligence (AI) applications and their underlying models. The new   show more ...  

Cisco AI Defense offering, introduced Jan. 15, is also designed to prevent data […] La entrada Cisco Previews AI Defenses to Cloud Security Platform – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 advanced persistent threats

Source: www.csoonline.com – Author: News 22 Jan 20254 mins Advanced Persistent ThreatsGovernmentGovernment IT Some experts are concerned that the dismissal of the Cyber Safety Review Board removes a critical security blanket and cancels a report that could have been valuable to cybersecurity leaders. The   show more ...  

administration of US President Donald Trump has dismissed all members of […] La entrada Trump disbands Cyber Safety Review Board, Salt Typhoon inquiry in limbo – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: We asked 25 thought leaders in the Asia-Pacific region to share their security predictions and goals for the year. As threat actors and security teams harness the growing potential of artificial intelligence (AI), who will prevail? From generative AI (GenAI) to agentic AI, we   show more ...  

look through the lens of 25 of […] La entrada 25 on 2025: APAC security thought leaders share their predictions and aspirations – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Bei einer Cyberattacke auf einen IT-Dienstleister wurden mehrere Schulserver verschlüsselt. Elena Uve – Shutterstock.com Die Kreisverwaltung Germersheim teilte kürzlich mit, dass neun Schulen im Landkreis Opfer eines Hackerangriffs geworden sind. „Betroffen sind die   show more ...  

Server des externen IT-Dienstleisters, nicht die der Kreisverwaltung“, betont die Behörde. Demnach hätten die Täter einen Verschlüsselungs-Trojaner eingesetzt, […] La entrada 45 Schulen von Cyberangriff betroffen – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 botnets

Source: www.csoonline.com – Author: Cloudflare thwarted the largest ever reported DDoS attack on one of its ISP customers. Halloween 2024 made history with a massive spike in distributed denial of service (DDoS) attacks, with one particular assault reaching over 5 Terabits-per-second (Tbps) worth of phony   show more ...  

traffic. In its quarterly analysis of DDoS attacks, Cloudflare reported […] La entrada Spooks of the internet came alive this Halloween – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: sec.cloudapps.cisco.com – Author: . Cisco BroadWorks SIP Denial of Service Vulnerability High CVE-2025-20165 CWE-789 Download CSAF Email Summary A vulnerability in the SIP processing subsystem of Cisco BroadWorks could allow an unauthenticated, remote attacker to halt the processing of incoming SIP   show more ...  

requests, resulting in a denial of service (DoS) condition. This vulnerability is due […] La entrada Cisco BroadWorks SIP Denial of Service Vulnerability – Source:sec.cloudapps.cisco.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: John Bowers The UK National Cyber Security Centre (NCSC), the country’s technical authority for cyber security, has announced changes to its Mail Check program. The NCSC will stop providing DMARC aggregate reporting beginning March 24, 2025. Mail Check is the NCSC’s   show more ...  

platform for assessing email security compliance to help domain owners […] La entrada UK Mail Check: DMARC Reporting Changes to Know – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman Wednesday, January 22, 2025 Home » Security Bloggers Network » DEF CON 32 – The Village Peoples’ Panel What Really Goes On In A Village Authors/Presenters: Panel Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their   show more ...  

erudite DEF CON 32 content. Originating from the conference’s events […] La entrada DEF CON 32 – The Village Peoples’ Panel What Really Goes On In A Village – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Maycie Belmore Welcome to the “Life in the Swimlane” blog series. Here we will feature interviews with Swimlaners to learn more about their experience. This series will give you a preview of Swimlane, our culture, and the people who keep us going.  Hi, I’m Marian!   show more ...  

I’m originally from a small town […] La entrada Life in the Swimlane with Marian Fehrenbacher, HR Assistant & Office Manager – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Anton Chuvakin This is my completely informal, uncertified, unreviewed and otherwise completely unofficial blog inspired by my reading of our next Threat Horizons Report, #11 (full version) that we just released (the official blog for #1 report, my unofficial blogs for   show more ...  

#2, #3, #4, #5, #6, #7, #8, #9 and #10). My […] La entrada Google Cloud Security Threat Horizons Report #11 Is Out! – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman via the comic humor & dry wit of Randall Munroe, creator of XKCD Permalink *** This is a Security Bloggers Network syndicated blog from Infosecurity.US authored by Marc Handelman. Read the original post at: https://xkcd.com/3039/ Original Post URL:   show more ...  

https://securityboulevard.com/2025/01/randall-munroes-xkcd-human-altitude/ Category & Tags: Humor,Security Bloggers Network,Randall Munroe,Sarcasm,satire,XKCD – Humor,Security Bloggers […] La entrada Randall Munroe’s XKCD ‘Human Altitude’ – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blog

Source: securityboulevard.com – Author: Votiro The Coffee-Making Process Meets Cybersecurity It’s early morning and you’re gearing up for a busy day. You grab your coffee pot, skip the filter, and pour yourself a cup. The result? A gritty, bitter mess that leaves you questioning every life choice leading up   show more ...  

to this point. It’s not exactly […] La entrada Filtered to Perfection: Votiro’s Two-Layer Approach to Cybersecurity – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 attack-path-management

Source: securityboulevard.com – Author: hotnops Now that we know how to add credentials to an on-premises user, lets pose a question: “Given access to a sync account in Domain A, can we add credentials to a user in another domain within the same Entra tenant?” This is a bit of a tall order assuming we have   show more ...  

[…] La entrada Entra Connect Attacker Tradecraft: Part 2 – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 account takeover

Source: securityboulevard.com – Author: Enzoic A Candid Conversation with Enzoic’s CTO The digital landscape is evolving, and with it comes a wave of sophisticated attacks targeting weak user credentials. From credential stuffing to account takeover (ATO) fraud, organizations face mounting pressure to secure   show more ...  

their authentication systems without compromising user experience. To tackle these challenges, we […] La entrada Rethinking Credential Security – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman Wednesday, January 22, 2025 Home » Security Bloggers Network » DEF CON 32 – UDSonCAN Attacks Discovering Safety Critical Risks By Fuzzing Author/Presenter: Seunghee Han Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their   show more ...  

erudite DEF CON 32 content. Originating from the conference’s events located at […] La entrada DEF CON 32 – UDSonCAN Attacks Discovering Safety Critical Risks By Fuzzing – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team Cybersecurity has become a leading priority for manufacturers of embedded systems and IoT devices. The rapid proliferation of these technologies, combined with their increasing integration into critical infrastructure, has made them prime targets for   show more ...  

cyberattacks. In response, the European Union created the Cyber Resilience Act (CRA) as a landmark […] La entrada The Cyber Resilience Act: How Manufacturers Can Meet New EU Standards and Strengthen Product Security – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Donald Trump has used his presidential powers to pardon convicted felon Ross Ulbricht, the founder of notorious dark web marketplace Silk Road. Ulbricht was sentenced to life in prison in 2015, on charges related to distributing narcotics, engaging in a continuing   show more ...  

criminal enterprise, conspiracy to commit computer hacking, conspiracy to traffic […] La entrada Trump Pardons Silk Road Founder Ulbricht – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A cyber espionage operation targeting South Korean VPN software was conducted in 2023 by a previously undocumented advanced persistent threat (APT) group, PlushDaemon. According to new research by ESET, the attack involved the compromise of legitimate VPN   show more ...  

installer files, embedding a malicious backdoor called SlowStepper alongside the original software. ESET reported […] La entrada PlushDaemon APT Targeted South Korean VPN Software – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A new version of the phishing kit Tycoon 2FA, which uses advanced tactics to bypass multi factor authentication (MFA) and evade detection, has been analyzed by threat researchers at Barracuda. Tycoon 2FA, which first emerged in August 2023, has undergone several   show more ...  

updates to enhance its capabilities. The latest version, observed in […] La entrada Tycoon 2FA Phishing Kit Upgraded to Bypass Security Measures – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: security.googleblog.com – Author: Edward Fernandez. Security Blog The latest news and insights from Google on security and safety on the Internet Original Post url: http://security.googleblog.com/2025/01/android-theft-protection-identity-check-expanded-features.html Category & Tags: android,android   show more ...  

security – android,android security Views: 0 La entrada Android enhances theft protection with Identity Check and expanded features – Source:security.googleblog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.mcafee.com – Author: Brooke Seipel. Romance scams have surged in sophistication, preying on emotions and exploiting the trust of victims in the digital age.   The latest case involving a French woman who believed she was romantically involved with actor Brad Pitt is a stark reminder of the   show more ...  

vulnerabilities we face online. But this incident, […] La entrada Breaking Down the Brad Pitt Scam: How it Happened and What We Can Learn  – Source:www.mcafee.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Artificial Intelligence

Source: www.csoonline.com – Author: AEM can help solve persistent skills gaps, tool sprawl, and budget constraints. Beset with cybersecurity risks, compliance regimes, and digital experience challenges, enterprises need to move toward autonomous endpoint management (AEM), the next evolution in endpoint   show more ...  

management and security solutions.  CSO’s Security Priorities Study 2024 reveals that 75% of security decision-makers say that […] La entrada Automating endpoint management doesn’t mean ceding control – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Die Cyber-Bande Ransomhub erpresst die Grohe AG mit gestohlenen Daten. Die Ransomware-Bande Ransomhub will 100 Gigabyte Daten von der Grohe AG erbeutet haben. CeltStudio – Shutterstock.com Die Grohe AG zählt zu den bekanntesten deutschen Herstellern von Armaturen und   show more ...  

Sanitärprodukten. Die berüchtigte Ransomware-Bande Ransomhub listet das Unternehmen nun als Opfer auf ihrer […] La entrada Grohe AG mutmaßlich von Ransomware-Attacke betroffen – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: The flaw could allow remote attackers to shut down ClamAV scanning and compromise critical security workflows. Cisco has patched a denial-of-service (DoS) vulnerability affecting its open-source antivirus software toolkit, ClamAV, which already has a proof-of-concept (PoC)   show more ...  

exploit code available to the public. Identified as CVE-2025-20128, the vulnerability stems from a heap-based […] La entrada Cisco patches antivirus decommissioning bug as exploit code surfaces – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Extended detection and response tools provide a deeper and more automated means to identify and respond to threats. These are some of the most popular options. Little in the modern IT world lends itself to manual or siloed management, and this is doubly true in the security   show more ...  

realm. The scale of […] La entrada 10 top XDR tools and how to evaluate them – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: News Analysis 23 Jan 20255 mins The popular programming language has added a way to check for malware-laded packages. The administrators of the Python Package Index (PyPI) have begun an effort to improve the hundreds of thousands of software packages that are listed. The   show more ...  

attempt, which began earlier last year, is […] La entrada Python administrator moves to improve software security – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 2310

Source: www.csoonline.com – Author: Generative KI wird Cyberkriminellen keinen Vorteil verschaffen – im Gegenteil. Die Mär von der Cybercrime-KI-Revolution? Overearth | shutterstock.com Cybersicherheitsexperten haben in den letzten Jahren immer wieder darauf hingewiesen, dass die Rolle des CISO   show more ...  

diversifiziert werden muss, um den Anforderungen der gestiegenen Verantwortung in zahlreichen Kategorien gerecht zu werden. Im vergangenen Jahr […] La entrada Geben Sie LLM-Alarmismus keine Chance! – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Careers

Source: www.csoonline.com – Author: Sind Mitarbeiter motiviert und werden gefördert, arbeiten sie effektiver, auch in der IT-Security. Schlechte Stimmung kann an den Vorgesetzten liegen. Sind IT-Mitarbeiter unzufrieden, kann das an schlechten Führungskräften oder an einer unzureichenden IT-Strategie liegen.   show more ...  

Foto: fizkes – shutterstock.com Unternehmen können die für sie allgemein schlechte Lage am Arbeitsmarkt kaum beeinflussen. Doch […] La entrada Auswirkungen auf IT-Fachkräfte: 10 Anzeichen für einen schlechten CSO – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-01
Aggregator history
Thursday, January 23
WED
THU
FRI
SAT
SUN
MON
TUE
JanuaryFebruaryMarch