Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Ransomware Attacks S ...

 Cyber News

Ransomware attacks set a single-month record in February that was well above previous highs, according to a Cyble threat intelligence report. The Cyble report measured the number of victims claimed by ransomware groups on their Tor-based data leak sites (DLS), which the groups use as part of their extortion tactics by   show more ...  

“naming and shaming” victims and threatening to release data unless ransom demands are paid. While not all ransomware victims are included on DLS sites, Cyble said it’s a useful indicator for analyzing ransomware trends. The record ransomware attacks seen in February 2025 were more than 50% higher than the previous record set two years ago, Cyble said. CL0P Sends Ransomware Attacks to Record Highs Cyble said the previous high for ransomware attacks was set in May 2023, when 544 victims were claimed by ransomware groups. February’s numbers would have eclipsed that record even without the CL0P ransomware group’s 267 victims, but with the CL0P victims, the total number of victims claimed by ransomware groups in February hit 821, far beyond previous highs (image below). [caption id="attachment_101253" align="aligncenter" width="550"] Ransomware victims by month 2021-2025 (Cyble)[/caption] CL0P has now claimed 386 victims from its exploitation of Cleo MFT vulnerabilities, Cyble said. The high number of victim claims made CL0P the most active ransomware group for the month, followed by RansomHub and Akira (chart below). [caption id="attachment_101255" align="aligncenter" width="550"] Most active ransomware groups, February 2025 (Cyble)[/caption] The U.S. far outpaced other nations in ransomware victims, with 10 times more victims than second-place Canada (chart below). [caption id="attachment_101258" align="aligncenter" width="550"] Ransomware attacks by country, February 2025 (Cyble)[/caption] Are Record Ransomware Attacks the Start of a New Trend? While February’s record ransomware victims were well above long-term trends, Cyble questioned whether that surge is the start of a new higher level of ransomware attacks. The threat intelligence company looked at the major ransomware players for clues. Looking at the last four years, LockBit has been well ahead of other ransomware groups, claiming more than 2,700 victims (chart below). However, LockBit has fallen off considerably in the last year after being hit by global law enforcement actions and is in the process of attempting a comeback with LockBit 4.0. [caption id="attachment_101259" align="aligncenter" width="550"] Top ransomware groups 2021-2025 (Cyble)[/caption] CL0P came in a distant second with 901 claimed victims over that four-year period, with Play, RansomHub, Conti and Akira (608 victims) the next most active ransomware groups. Six-year-old CL0P has largely focused on managed file transfer (MFT) vulnerabilities like Cleo and MOVEit, which has tended to make the group’s victims more clustered, with more than 40% of those victims (383) coming just in the last few months. With only 22 additional CL0P victims in the last year, “it would be reasonable to assume that CL0P victim totals will continue to fluctuate over time,” Cyble said. But with RansomHub, Akira, Play and FOG also increasing ransomware activity in recent months, “it’s possible that we’ve entered a higher range of claimed victims by ransomware groups,” the report noted. Cyble said organizations should focus on measures that improve cyber resilience and limit lateral movement, such as patching web-facing vulnerabilities, training employees to recognize phishing attempts, and implementing zero trust, network segmentation and monitoring, and ransomware-resistant backups.

image for Elastic Issues Urgen ...

 Firewall Daily

Elastic has released a critical security update to address a vulnerability in Kibana, a widely used data visualization and analysis tool for Elasticsearch. This Kibana vulnerability, identified as CVE-2025-25012, could allow attackers to execute arbitrary code on affected systems, posing a severe threat to   show more ...  

organizations using Kibana. The vulnerability, categorized under the CVSS scoring system with a dangerous rating of 9.9 out of 10, is described as a form of prototype pollution. Details of the Kibana Vulnerability The Kibana vulnerability, which has been tracked under the identifier CVE-2025-25012, can be exploited through a specially crafted file upload or malicious HTTP requests. According to an advisory issued by Elastic on March 5, 2025, this vulnerability primarily affects Kibana versions 8.15.0 and later, up until 8.17.2. The issue stems from the way Kibana handles prototype pollution, a programming flaw that occurs when untrusted data manipulates the prototype of an object in an unsafe manner, potentially leading to remote code execution (RCE). Elastic's official statement highlights the severity of the vulnerability: "Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests." Impact of CVE-2025-25012  This Kibana vulnerability is especially dangerous because it can be exploited by users with low privileges, such as those with the Viewer role in Kibana versions 8.15.0 through 8.17.0. In more recent versions (8.17.1 and 8.17.2), the vulnerability requires attackers to have more advanced privileges, including access to fleet-all, integrations-all, and actions:execute-advanced-connectors roles. However, these limitations do not reduce the overall risk posed by the flaw. The potential consequences of a successful exploitation are severe, including unauthorized access to confidential data, system compromise, and the disruption of Kibana services. Attackers could also exploit this vulnerability to take control of the affected system, potentially leading to the destruction or theft of sensitive information.  The ESA-2025-06 Update: A Critical Fix  In response to the issue, Elastic released a patch in Kibana version 8.17.3, which addresses the CVE-2025-25012 vulnerability and mitigates the risk of Remote Code Execution (RCE). Users are strongly urged to upgrade to version 8.17.3 or later to secure their environments against this critical flaw. The fix was included as part of Elastic Security Advisory ESA-2025-06, which provides comprehensive details about the vulnerability and the steps necessary for mitigation. Elastic also recommends additional precautionary measures for users who may be unable to upgrade immediately. For such users, the company suggests disabling certain features by setting the xpack.integration_assistant.enabled: false flag in Kibana's configuration file to minimize exposure to the vulnerability.  Mitigation and Recommendations  To mitigate the risk associated with CVE-2025-25012, Elastic advises organizations to implement the following security practices:  Upgrade to Kibana 8.17.3 or Later: The easiest and most effective way to resolve this vulnerability is to immediately upgrade to Kibana version 8.17.3 or any subsequent releases.  Restrict Network Access: Limit network access to Kibana instances to prevent unauthorized connections that could exploit the vulnerability.  Validate File Uploads: Organizations should implement stringent file upload validation protocols to reduce the likelihood of malicious file uploads.  Monitor for Suspicious Activity: Regularly monitor Kibana for unusual file uploads or HTTP request activity, which may indicate an attempted exploitation of the vulnerability.  Apply Principle of Least Privilege: Ensure that users are only granted the minimum necessary permissions to perform their roles. This will reduce the attack surface in case of a potential exploitation.  Conclusion   As of the latest advisory, no public exploits or proof-of-concept (PoC) attacks have been reported for the Kibana vulnerability (CVE-2025-25012), but Elastic stresses the importance of immediate action to prevent potential exploitation, which could escalate rapidly once the flaw becomes widely known.   Organizations using Kibana for Elasticsearch data visualization should prioritize upgrading to version 8.17.3 to protect their systems from this critical vulnerability, and by following Elastic's recommended security practices, they can reduce the risk and protect their data and infrastructure. 

image for FBI Issues Urgent Wa ...

 Firewall Daily

The Federal Bureau of Investigation (FBI) has alerted businesses about a disturbing new data extortion scam targeting corporate executives. The scheme, which is being orchestrated by criminals posing as the "BianLian Group," involves sending fraudulent letters to high-level professionals with threats of   show more ...  

sensitive data leaks unless hefty ransom payments are made.   Details of the Data Extortion Scam  The data extortion scam, which was officially disclosed in the FBI's alert (I-030625b-PSA) on March 6, 2025, involves letters that are delivered via mail to corporate executives. The letters are stamped with the words "Time Sensitive Read Immediately" and claim to be from a group associated with ransomware attacks. These letters allege that the so-called "BianLian Group" has gained unauthorized access to the recipient’s organization’s network and stolen sensitive data files.  [caption id="attachment_101239" align="alignnone" width="973"] Mail Scam Targeting Corporate Executives (Source: CISA)[/caption] In a typical extortion tactic, the letter warns that unless the victim pays a ransom—ranging from $250,000 to $500,000 within ten days—the stolen data will be publicly released on BianLian’s data leak sites. To ensure compliance, the scam includes a QR code linked to a Bitcoin wallet, demanding payment. The criminals insist that they will not engage in negotiations and expect full payment as stipulated.  While the letter appears threatening, the FBI has stated that there is no evidence yet linking this extortion attempt to the notorious BianLian ransomware group, which has been responsible for a variety of cybercrimes. However, the criminals are using the group’s name to manipulate executives into believing they are dealing with a well-known and dangerous hacker collective. Corporate Executives at Risk The primary targets of this data extortion scam are corporate executives, who are typically responsible for making critical decisions within an organization. These individuals are often in the crosshairs of cybercriminals due to their access to highly sensitive company data. The FBI has emphasized the importance of awareness among corporate leadership regarding this threat. As part of the ongoing efforts to mitigate cyber threats, the FBI is advising businesses to take immediate action upon receiving any such extortion letters. They recommend that organizations conduct thorough reviews of their network defenses to ensure there are no signs of unauthorized access. Additionally, it is crucial for companies to educate employees about the nature of ransomware threats and what steps to take should they receive similar warnings. FBI’s Recommendations for Protection  The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) urge organizations to take proactive measures to protect their networks and executives. The following guidelines are recommended:  Educate and Inform: Corporate executives should be informed about the data extortion scam and made aware of potential phishing tactics.  Review Security Protocols: Ensure that network defenses, including firewalls and anti-virus software, are up to date and functioning properly.  Incident Response Plan: Have a clear action plan in place in case a ransom letter is received. It is critical to avoid responding to the criminal's demands without proper consultation.  Report the Incident: If your organization has fallen victim to this scam or similar threats, it is essential to report the incident to your local FBI Field Office or file a complaint with the Internet Crime Complaint Center (IC3). Conclusion  This data extortion scam highlights the growing threat of cybercrime, particularly targeting corporate executives. While the FBI’s investigation has not linked the scam to known groups like BianLian, it emphasizes the need for businesses to stay vigilant and strengthen cybersecurity measures. The financial and reputational risks are important, and corporate leaders must protect sensitive data and educate their teams. The FBI and IC3’s continued efforts are vital, and organizations are encouraged to report incidents and review the latest FBI Public Service Announcement (I-030625b-PSA) for guidance. 

image for The digital illusion ...

 Threats

Millennials have grown up alongside the rise of social media and digital communication – and in many ways appear to be the most tech-savvy generation. However, our latest research reveals a concerning reality: 70 percent of millennials rarely verify the authenticity of the people they engage with online, leaving   show more ...  

them vulnerable to cyberrisks such as identity fraud, misinformation, and emotional deception. As digital friendships and online communities become increasingly central to daily life, many millennials need rethink their approach to online trust (actually, so do other generations, of course, but today we concentrate on the millennial paradox). The desire for connection and validation is driving significant behavioral shifts – from prioritizing social-media interactions over real-world relationships, to oversharing personal information in digital spaces. These trends expose users to heightened cybersecurity threats – making digital literacy and caution more important than ever. The trust paradox: digital natives, yet still vulnerable to deception Despite being the first generation to embrace the internet fully, many millennials place misplaced trust in their online interactions. While 64 percent have encountered someone misrepresenting their identity, nearly half still trust information shared within their digital communities. This contradiction highlights a gap between perceived digital expertise and actual cybersecurity awareness. Digital paradox: millennials trust gap exposed Cyber-psychologist Ruth Guest warns that this overconfidence can lead to risky behavior. When we trust our own digital savvy implicitly, we may overlook the possibility that others are not as genuine as they appear. In some cases, individuals with strong narcissistic, psychopathic or Machiavellian traits exploit this trust through catfishing and other deceptive tactics. Rethinking digital trust means applying a level of skepticism that matches real-world caution. A strong cybersecurity mindset requires more than technical skills – it demands critical thinking and vigilance. From social validation to privacy risks Social media has become the go-to space for millennials to share major life updates – often before informing close friends or family. Our research shows that nearly half of millennials post significant personal news online before discussing it in person with anyone. The instant feedback from likes, comments, and shares can create a sense of validation – but it also comes with risks. Forty-five percent of millennials are comfortable sharing personal or sensitive information online – a behavior that can increase their exposure to phishing scams, identity theft, and doxing. Cybercriminals use publicly available information to craft targeted attacks – exploiting personal details such as location check-ins, workplace updates, and relationship status. Chronic oversharers: millennials risk privacy for connection According to Marc Rivero, Lead Security Researcher at Kaspersky, Oversharing personal information online can make individuals more vulnerable to identity theft, phishing attacks, and social engineering scams. Personal details shared online, such as location check-ins, relationship status, and daily routines, can be exploited for targeted scams or unauthorized surveillance. To mitigate these risks, its important to reconsider whats shared, strengthen privacy settings, and remain cautious about how digital footprints are being used. Digital friendships: a balance between connection and risk As loneliness rises among young adults (among other generations), online friendships have become an essential part of social life. Our study found that 29 percent of millennials report that digital friendships positively impact their mental health. Online communities provide a sense of belonging, and allow users to connect with like-minded individuals across the world. Digital escape: millennials seek solace in online communities However, not all online interactions are positive. Ten percent of millennials report negative experiences from digital interaction. Even more concerning, 14 percent admit to creating fake profiles or using false identities themselves. These statistics highlight the prevalence of digital deception and the challenges of distinguishing between genuine and fabricated relationships. Back to cyber-psychologist Ruth Guest, she emphasizes the importance of balance. Digital spaces have evolved into safe and creative havens where millennials can explore, learn and connect with like-minded individuals. When used wisely and with proper safeguards, social media can be a tremendous asset to ones mental health. It offers a platform for self-expression, a sense of belonging, and even creative inspiration. However, it is crucial to remember that the benefits of these online communities depend on maintaining a balance. How millennials can strengthen their digital defenses As key players in the digital world, millennials need to take proactive steps to protect their online presence and encourage stronger cybersecurity habits in those around them. Implementing essential security measures can help reduce exposure to online threats and foster safer digital habits. 1. Verify identities Use reverse-image searches, and cross-check profiles before engaging with new contacts. 2. Cross-check information Always verify facts from multiple sources before sharing or acting on them. Follow Kaspersky Daily for insights on emerging cyberthreats. 3. Protect personal information Adjust social-media privacy settings, and use our online privacy checker to enhance security. Be mindful of real-time location sharing to avoid tracking risks. 4. Respect others privacy Obtain consent before sharing others personal details. 5. Stay educated regarding online scams Recognize signs of phishing, fake profiles, and social-engineering scams. 6. Use strong passwords and security tools Use Kaspersky Password Manager to generate and store unique passwords securely. Never reuse passwords across multiple platforms. 7. Keep devices updated and secure Regularly update apps, software, and antivirus programs to prevent vulnerabilities being exploited. Use Kaspersky Premium for real-time protection against identity theft, malicious links, and cyberthreats. To access the full research report, visit the link.

image for Who is the DOGE and ...

 A Little Sunshine

At 49, Branden Spikes isn’t just one of the oldest technologists who has been involved in Elon Musk’s Department of Government Efficiency (DOGE). As the current director of information technology at X/Twitter and an early hire at PayPal, Zip2, Tesla and SpaceX, Spikes is also among Musk’s most loyal   show more ...  

employees. Here’s a closer look at this trusted Musk lieutenant, whose Russian ex-wife was once married to Elon’s cousin. The profile of Branden Spikes on X. When President Trump took office again in January, he put the world’s richest man — Elon Musk — in charge of the U.S. Digital Service, and renamed the organization as DOGE. The group is reportedly staffed by at least 50 technologists, many of whom have ties to Musk’s companies. DOGE has been enabling the president’s ongoing mass layoffs and firings of federal workers, largely by seizing control over computer systems and government data for a multitude of federal agencies, including the Social Security Administration, the Department of Homeland Security, the Office of Personnel Management, and the Treasury Department. It is difficult to find another person connected to DOGE who has stronger ties to Musk than Branden Spikes. A native of California, Spikes initially teamed up with Musk in 1997 as a lead systems engineer for the software company Zip2, the first major venture for Musk. In 1999, Spikes was hired as director of IT at PayPal, and in 2002 he became just the fourth person hired at SpaceX. In 2012, Spikes launched Spikes Security, a software product that sought to create a compartmentalized or “sandboxed” web browser that could insulate the user from malware attacks. A review of spikes.com in the Wayback Machine shows that as far back as 1998, Musk could be seen joining Spikes for team matches in the online games Quake and Quake II. In 2016, Spikes Security was merged with another security suite called Aurionpro, with the combined company renamed Cyberinc. A snapshot of spikes.com from 1998 shows Elon Musk’s profile in Spike’s clan for the games Quake and Quake II. Spikes’s LinkedIn profile says he was appointed head of IT at X in February 2025. And although his name shows up on none of the lists of DOGE employees circulated by various media outlets, multiple sources told KrebsOnSecurity that Spikes was working with DOGE and operates within Musk’s inner circle of trust. In a conversation with KrebsOnSecurity, Spikes said he is dedicated to his country and to saving it from what he sees as certain ruin. “Myself, I was raised by a southern conservative family in California and I strongly believe in America and her future,” Spikes said. “This is why I volunteered for two months in DC recently to help DOGE save us from certain bankruptcy.” Spikes told KrebsOnSecurity that he recently decided to head back home and focus on his job as director of IT at X. “I loved it, but ultimately I did not want to leave my hometown and family back in California,” Spikes said of his tenure at DOGE. “After a couple of months it became clear that to continue helping I would need to move to DC and commit a lot more time, so I politely bowed out.” Prior to founding Spikes Security, Branden Spikes was married to a native Russian woman named Natalia whom he’d met at a destination wedding in South America in 2003. Branden and Natalia’s names are both on the registration records for the domain name orangetearoom[.]com. This domain, which DomainTools.com says was originally registered by Branden in 2009, is the home of a tax-exempt charity in Los Angeles called the California Russian Association. Here is a photo from a 2011 event organized by the California Russian Association, showing Branden and Natalia at one of its “White Nights” charity fundraisers: Branden and Natalia Spikes, on left, in 2011. The man on the far right is Ivan Y. Podvalov, a board member of the Kremlin-aligned Congress of Russian Americans (CRA). The man in the center is Feodor Yakimoff, director of operations at the Transib Global Sourcing Group, and chairman of the Russian Imperial Charity Balls, which works in concert with the Russian Heritage Foundation. In 2011, the Spikes couple got divorced, and Natalia changed her last name to Haldeman. That is not her maiden name, which appears to be “Libina.” Rather, Natalia acquired the surname Haldeman in 1998, when she married Elon Musk’s cousin. Reeve Haldeman is the son of Scott Haldeman, who is the brother of Elon Musk’s mother, Maye Musk. Divorce records show Reeve and Natalia officially terminated their marriage in 2007. Reeve Haldeman did not respond to a request for comment. A review of other domain names connected to Natalia Haldeman’s email address show she has registered more than a dozen domains over the years that are tied to the California Russian Association, and an apparently related entity called the Russian Heritage Foundation, Inc.: russianamericans.org russianamericanstoday.com russianamericanstoday.org russiancalifornia.org russianheritagefoundation.com russianheritagefoundation.org russianwhitenights.com russianwhitenights.org theforafoundation.org thegoldentearoom.com therussianheritagefoundation.org tsarinahome.com Ms. Haldeman did not respond to requests for comment. Her name and contact information appears in the registration records for these domains dating back to 2010, and a document published by ProPublica show that by 2016 Natalia Haldeman was appointed CEO of the California Russian Foundation. The domain name that bears both Branden’s and Natalia’s names — orangeteamroom.com — features photos of Ms. Haldeman at fundraising events for the Russian foundation through 2014. Additional photos of her and many of the same people can be seen through 2023 at another domain she registered in 2010 — russianheritagefoundation.com. A photo from Natalia Haldeman’s Facebook page shows her mother (left) pictured with Maye Musk, Elon Musk’s mother, in 2022. The photo of Branden and Natalia above is from one such event in 2011 (tied to russianwhitenights.org, another Haldeman domain). The person on the right in that image — Ivan Y. Podvalov — appears in many fundraising event photos published by the foundation over the past decade. Podvalov is a board member of the Congress of Russian Americans (CRA), a nonprofit group that is known for vehemently opposing U.S. financial and legal sanctions against Russia. Writing for The Insider in 2022, journalist Diana Fishman described how the CRA has engaged in outright political lobbying, noting that the organization in June 2014 sent a letter to President Obama and the secretary of the United Nations, calling for an end to the “large-scale US intervention in Ukraine and the campaign to isolate Russia.” “The US military contingents must be withdrawn immediately from the Eastern European region, and NATO’s enlargement efforts and provocative actions against Russia must cease,” the message read. The Insider said the CRA director sent another two letters, this time to President Donald Trump, in 2017 and 2018. “One was a request not to sign a law expanding sanctions against Russia,” Fishman wrote. “The other regretted the expulsion of 60 Russian diplomats from the United States and urged not to jump to conclusions on Moscow’s involvement in the poisoning of Sergei Skripal.” The nonprofit tracking website CauseIQ.com reports that The Russian Heritage Foundation, Inc. is now known as Constellation of Humanity. The Russian Heritage Foundation and the California Russian Association both promote the interests of the Russian Orthodox Church. This page indexed by Archive.org from russiancalifornia.org shows The California Russian Foundation organized a community effort to establish an Orthodox church in Orange County, Calif. A press release from the Russian Orthodox Church Outside of Russia (ROCOR) shows that in 2021 the Russian Heritage Foundation donated money to organize a conference for the Russian Orthodox Church in Serbia. A review of the “Partners” listed on the Spikes’ jointly registered domain — orangetearoom.com — shows the organization worked with a marketing company called Russian American Media. Reporting by KrebsOnSecurity last year showed that Russian American Media also partners with the problematic people-search service Radaris, which was formed by two native Russian brothers in Massachusetts who have built a fleet of consumer data brokers and Russian affiliate programs. When asked about his ex-wife’s history, Spikes said she has a good heart and bears no ill-will toward anyone. “I attended several of Natalia’s social events over the years we were together and can assure you that she’s got the best intentions with those,” Spikes told KrebsOnSecurity. “There’s no funny business going on. It is just a way for those friendly immigrants to find resources amongst each other to help get settled in and chase the American dream. I mean, they’re not unlike the immigrants from other countries who come to America and try to find each other and help each other find others who speak the language and share in the building of their businesses here in America.” Spikes said his own family roots go back deeply into American history, sharing that his 6th great grandfather was Alexander Hamilton on his mom’s side, and Jessie James on his dad’s side. “My family roots are about as American as you can get,” he said. “I’ve also been entrusted with building and safeguarding Elon’s companies since 1999 and have a keen eye (as you do) for bad actors, so have enough perspective to tell you that Natalia has no bad blood and that she loves America.” Of course, this perspective comes from someone who has the utmost regard for the interests of the “special government employee” Mr. Musk, who has been bragging about tossing entire federal agencies into the “wood chipper,” and who recently wielded an actual chainsaw on stage while referring to it as the “chainsaw for bureaucracy.” “Elon’s intentions are good and you can trust him,” Spikes assured. A special note of thanks for research assistance goes to Jacqueline Sweet, an independent investigative journalist whose work has been published in The Guardian, Rolling Stone, POLITICO and The Intercept.

image for How Cyberattacks Aff ...

 Feed

Businesses have a responsibility to safeguard their workforce, which is best achieved by preparing and equipping the whole organization to better face these worst-case cyber scenarios.

 Feed

Safe{Wallet} has revealed that the cybersecurity incident that led to the Bybit $1.5 billion crypto heist is a "highly sophisticated, state-sponsored attack," stating the North Korean threat actors behind the hack took steps to erase traces of the malicious activity in an effort to hamper investigation efforts. The multi-signature (multisig) platform, which has roped in Google Cloud Mandiant to

 Feed

Threat actors of unknown provenance have been attributed to a malicious campaign predominantly targeting organizations in Japan since January 2025. "The attacker has exploited the vulnerability CVE-2024-4577, a remote code execution (RCE) flaw in the PHP-CGI implementation of PHP on Windows, to gain initial access to victim machines," Cisco Talos researcher Chetan Raghuprasad said in a technical

 Feed

Cybersecurity researchers have discovered a malicious Python package on the Python Package Index (PyPI) repository that's equipped to steal a victim's Ethereum private keys by impersonating popular libraries. The package in question is set-utils, which has received 1,077 downloads to date. It's no longer available for download from the official registry. "Disguised as a simple utility for Python

 Feed

A coalition of international law enforcement agencies has seized the website associated with the cryptocurrency exchange Garantex ("garantex[.]org"), nearly three years after the service was sanctioned by the U.S. Treasury Department in April 2022. "The domain for Garantex has been seized by the United States Secret Service pursuant to a seizure warrant obtained by the United States Attorney's

 Feed

Microsoft has disclosed details of a large-scale malvertising campaign that's estimated to have impacted over one million devices globally as part of what it said is an opportunistic attack designed to steal sensitive information. The tech giant, which detected the activity in early December 2024, is tracking it under the broader umbrella Storm-0408, a moniker used for a set of threat actors

 Feed

Are you tired of dealing with outdated security tools that never seem to give you the full picture? You’re not alone. Many organizations struggle with piecing together scattered information, leaving your apps vulnerable to modern threats. That’s why we’re excited to introduce a smarter, unified approach: Application Security Posture Management (ASPM). ASPM brings together the best of both

 Feed

Access on-demand webinar here Avoid a $100,000/month Compliance Disaster March 31, 2025: The Clock is Ticking. What if a single overlooked script could cost your business $100,000 per month in non-compliance fines? PCI DSS v4 is coming, and businesses handling payment card data must be prepared. Beyond fines, non-compliance exposes businesses to web skimming, third-party script attacks, and

 Feed

Threat hunters have shed light on a "sophisticated and evolving malware toolkit" called Ragnar Loader that's used by various cybercrime and ransomware groups like Ragnar Locker (aka Monstrous Mantis), FIN7, FIN8, and Ruthless Mantis (ex-REvil). "Ragnar Loader plays a key role in keeping access to compromised systems, helping attackers stay in networks for long-term operations," Swiss

 Cyber Security News

Source: grahamcluley.com – Author: Graham Cluley Skip to content Journey with us to Myanmar’s shadowy scam factories, where trafficked workers are forced to run romance-baiting and fake tech support scams, and find out why a company’s mandatory hold time for tech support could lead to innocent users having   show more ...  

their computers compromised. All this and more […] La entrada Smashing Security podcast #407: HP’s hold music, and human trafficking – Source: grahamcluley.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: news.sophos.com – Author: Chris McCormack PRODUCTS & SERVICES Sophos DNS Protection is now available for Sophos Firewall customers with Sophos Central accounts outside of the standard US and EU regions, adding five new management regions: Australia, Brazil, India, Japan, and Canada. This matches   show more ...  

similar regional expansions for other Sophos Central managed products including ZTNA, […] La entrada Expanded management regions for Sophos DNS Protection – Source: news.sophos.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: securityaffairs.com – Author: Pierluigi Paganini Qilin Ransomware group claims to have breached the Ministry of Foreign Affairs of Ukraine, marking a significant cybersecurity attack. The Russian-speaking Qilin Ransomware group claims responsibility for an attack on the Ministry of Foreign Affairs of   show more ...  

Ukraine. The group stated that it stole sensitive data such as private correspondence, […] La entrada Qilin Ransomware gang claims the hack of the Ministry of Foreign Affairs of Ukraine – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini Elastic fixed a critical flaw in the Kibana data visualization dashboard software for Elasticsearch that could lead to arbitrary code execution. Elastic released security updates to address a critical vulnerability, tracked as CVE-2025-25012 (CVSS   show more ...  

score of 9.9), impacting the Kibana data visualization dashboard software for Elasticsearch. Kibana provides visualization capabilities on top of the content indexed on an Elasticsearch […] La entrada Elastic patches critical Kibana flaw allowing code execution – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini The U.S. Department of Justice (DoJ) charges 12 Chinese nationals for their alleged involvement in state-linked cyber operations. The U.S. DoJ charged 12 Chinese nationals, including PRC security officers, employees of the hacking firm i-Soon, and members   show more ...  

of the APT27 group (aka Emissary Panda, TG-3390, Bronze Union, and Lucky Mouse), for data theft […] La entrada The U.S. DoJ charges 12 Chinese nationals for state-linked cyber operations – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 APT

Source: securityaffairs.com – Author: Pierluigi Paganini China-linked Lotus Blossom APT targets governments and industries in Asian countries with new Sagerunex backdoor variants. Talos researchers linked China-backed Lotus Blossom APT (also known as Elise and Esile) to multiple campaigns targeting   show more ...  

organizations in sectors such as government, manufacturing, telecommunications and media with the Sagerunex backdoor. The victims […] La entrada Chinese Lotus Blossom APT targets multiple sectors with Sagerunex backdoor – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Highlights from campus to corporate tech program with Vishwakarma Institute of Technology Source Views: 0 La entrada SWE Pune Affiliate Empowering Tomorrow’s Tech Leaders se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Each month, SWE spotlights one of our affinity groups. As part of their spotlight month, the Late Career and Retiree Affinity Group explores caring for elders with this conversation between Hang Loi and Mary Zeis. Source Views: 0 La entrada Caring for Elders With Mary Zeis se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Armis

Source: www.securityweek.com – Author: SecurityWeek News California cyber exposure management firm Armis on Thursday announced the acquisition of Otorio, a deal that adds technology for operational technology (OT) and cyber-physical systems (CPS) security to its product lines. The transaction, valued in the   show more ...  

range of $120 million, gives Armis a path to market an on-prem CPS […] La entrada Armis Acquires Otorio to Expand OT and CPS Security Suite – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Bybit

Source: www.securityweek.com – Author: Ryan Naraine Last week’s $1.4 billion cryptocurrency heist was the result of a multi-pronged attack that combined social engineering, stolen AWS session tokens, MFA bypasses, and a seemingly benign JavaScript file. That’s the conclusion from forensics experts at   show more ...  

Mandiant called in to figure out how North Korea’s Lazarus hacking crew was […] La entrada How Social Engineering Sparked a Billion-Dollar Supply Chain Cryptocurrency Heist – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 bill

Source: www.securityweek.com – Author: Eduard Kovacs The House of Representatives has passed a bill aimed at requiring federal contractors to have a vulnerability disclosure policy (VDP). The Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025 instructs the Office of Management and Budget (OMB)   show more ...  

to consult with CISA, the Office of the National Cyber Director, NIST, […] La entrada House Passes Bill Requiring Federal Contractors to Implement Vulnerability Disclosure Policies – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Ionut Arghire A Nigerian national appeared in a US court on Wednesday facing computer intrusion, wire fraud, government money theft, identity theft, and money laundering charges related to the hacking into the networks of US tax preparation companies. The man, Matthew   show more ...  

Akande, 36, a resident of Mexico, was arrested in the […] La entrada Nigerian Accused of Hacking Tax Preparation Firms Extradited to US – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 cyber security

Source: www.techrepublic.com – Author: Fiona Jackson In 2024, women accounted for 22% of global security teams on average, compared to 17% in 2023, according to ISC2. Gender diversity in cybersecurity is slowly improving but inequities continue—a new report finds that the field has 5% more women than in 2023,   show more ...  

but that they’re more exposed to […] La entrada Women in Cyber Security on the Rise, But Facing More Layoffs and Budget Cuts Than Men – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Alleged

Source: go.theregister.com – Author: Connor Jones Police have made two arrests in their quest to start a cybercrime crew’s prison eras, alleging the pair stole hundreds of Taylor Swift tickets and sold them for huge profit.  Tyrone Rose, 20, of Kingston, Jamaica, and Shamara Simmons, 31, of Queens, New   show more ...  

York City, were arrested on Thursday […] La entrada Alleged cyber scalpers Swiftly cuffed over $635K Taylor ticket heist – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Jessica Lyons Interview There’s a handful of cybercriminal gangs that Jason Baker, a ransomware negotiator with GuidePoint Security, regularly gets called in to respond to these days, and a year ago only one of these crews — Akira — was on threat hunters’   show more ...  

radars and infecting organizations with the same ferocity […] La entrada Like whitebox servers, rent-a-crew crime ‘affiliates’ have commoditized ransomware – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BadBox

Source: go.theregister.com – Author: Iain Thomson Human Security’s Satori research team says it has found a new variant of the remote-controllable Badbox malware, and as many as a million infected Android devices running it to form a massive botnet. The infosec outfit spotted the first Badbox outbreak in   show more ...  

2023, when it found off-brand Android-powered internet-connected […] La entrada The Badbox botnet is back, powered by up to a million backdoored Androids – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-03
Aggregator history
Friday, March 07
SAT
SUN
MON
TUE
WED
THU
FRI
MarchAprilMay