Oktacron - Cyber Security RSS Feeds History

Will Wiz Finally Sell? Alphabet Increases Offer to $30 Billion in Renewed Talks

cyberexpress Mar 18, 2025 Firewall Daily

Alphabet has reopened discussions to acquire cybersecurity startup Wiz in a potential Wiz acquisition deal worth $30 billion. This follows a failed attempt last year when Wiz rejected Alphabet’s $23 billion offer. Now, Alphabet is making a stronger push with an increased bid to secure the deal. The renewed talks show more ...

signal a fresh chapter in Alphabet’s pursuit of Wiz, a New York-based cloud security firm. According to sources, negotiations resumed after being paused last summer, with the latest discussions centering on the higher valuation. If finalized, the Wiz acquisition would be Alphabet’s largest deal to date, significantly strengthening its position in the competitive cloud computing market. Wiz Acquisition: Alphabet Eyes Cloud Security Expansion Alphabet’s interest in the company is clear: the acquisition would allow Google to strengthen its cloud business, which has recently seen profitable quarters after years of losses. While Google's cloud division has shown growth, it still lags behind rivals like Microsoft and Amazon, making the cybersecurity company an attractive target. According to Business Standard, with this acquisition, Alphabet Eyes an opportunity to accelerate its growth and competitiveness in the cloud computing space, which has become a key battleground among the tech giants. Last year, the company turned down Alphabet's $23 billion offer, opting instead to remain independent with plans to pursue an initial public offering (IPO). The decision was influenced by concerns over a lengthy regulatory approval process, with competition authorities in both the U.S. and Europe closely scrutinizing major acquisitions in the tech industry due to growing concerns about market dominance. In addition, Wiz’s CEO, Assaf Rappaport, described the $23 billion offer as “humbling” but emphasized the company’s ambition to grow into a cybersecurity powerhouse on its own, competing against giants in the cloud security market. Wiz Acquisition: Will Alphabet Seal the Deal? Founded by Israeli entrepreneurs and backed by investors such as Sequoia Capital, Index Ventures, Insight Partners, and Cyberstarts, the company was valued at $12 billion during a funding round last year. With the latest developments, the company’s valuation has increased, reflecting its growing popularity in the cloud security space. Investors and analysts alike are closely monitoring the situation as both Alphabet and Wiz move forward with their negotiations. If the Wiz acquisition deal is finalized, it could have a profound impact on the cybersecurity landscape, further solidifying Google’s presence in the cloud sector. While the terms of the deal are still being finalized, industry insiders expect an announcement to come soon. As always, the deal remains subject to change, and there is still a possibility that discussions could fall apart without an agreement. For now, all eyes are on Alphabet as it seeks to close one of its biggest acquisitions in recent history.

Google Expands OSV-Scanner with New Features for Open-Source Security

cyberexpress Mar 18, 2025 Firewall Daily

Google has introduced the OSV-Scanner tool, a crucial addition to the open-source security ecosystem. Alongside it, Google also released OSV-SCALIBR, a library designed to streamline vulnerability management across multiple software ecosystems. Together, these solutions, in combination with OSV.dev, form an show more ...

integrated platform for managing vulnerability metadata, offering developers and security teams a seamless way to identify and remediate known vulnerabilities. Building on the success of its previous releases, Google is now excited to announce the launch of OSV-Scanner V2.0.0, an enhanced version of the original vulnerability scanner and remediation solution. The new version adds multiple features and improvements, reinforcing OSV-Scanner’s role as an essential resource for developers striving to manage vulnerabilities in open-source projects. New Features in OSV-Scanner Tool V2 [caption id="attachment_101455" align="alignnone" width="519"] Illustration of HTML output for container image scanning (Source: Google)[/caption] Enhanced Dependency Extraction with OSV-SCALIBR A major update in OSV-Scanner V2 is the integration of OSV-SCALIBR features, making OSV-Scanner the official command-line tool for scanning code and containers with OSV-SCALIBR’s capabilities. This release expands the types of dependencies OSV-Scanner can detect and extract, improving its ability to analyze a variety of project structures and container images. With this update, OSV-Scanner now supports a wider array of source manifests and lockfiles, including: .NET: deps.json Python: uv.lock JavaScript: bun.lock Haskell: cabal.project.freeze, stack.yaml.lock In addition, OSV-Scanner now detects a broad range of artifacts, including: Node modules Python wheels Java uber jars Go binaries This extended dependency detection enhances the utility across different programming languages and environments. Comprehensive Container Scanning with Layer and Base Image Support Another upgrade in OSV-Scanner V2 is its expanded support for container scanning. Previously, OSV-Scanner was primarily focused on scanning source repositories and package manifests. The latest version introduces layer-aware scanning for Debian, Ubuntu, and Alpine container images. This enhancement enables OSV-Scanner to provide valuable insights into the following aspects: Layer introduction: Identifies which layers in a container image introduce specific packages. Layer history: Tracks the history of layers and their respective commands. Base images: Analyzes base images to uncover dependencies, leveraging a new experimental API provided by deps.dev. OS/Distro: Determines the underlying OS or distribution used in the container. This layer analysis feature adds another layer of precision when identifying vulnerabilities in containerized environments, making OSV-Scanner an even more powerful solution for developers working with container images. Interactive HTML Output for Enhanced Usability One of the biggest challenges in vulnerability scanning is presenting the findings in a way that is both actionable and understandable. OSV-Scanner V2 addresses this issue by introducing a new interactive HTML output format. This local output is more user-friendly and informative than previous terminal-only outputs, providing: Severity breakdown of detected vulnerabilities Package and ID filtering to streamline analysis Vulnerability importance filtering to focus on the most critical issues Detailed vulnerability advisory entries for in-depth analysis Layer and base image information for container scans This new format makes it easier for security teams to understand the scope and impact of vulnerabilities, empowering them to take prompt, effective action. Guided Remediation for Maven pom.xml Files OSV-Scanner’s guided remediation capabilities were previously available for npm packages, helping developers prioritize updates and minimize disruptions. Now, OSV-Scanner extends this feature to Maven pom.xml files, offering similar targeted suggestions for vulnerabilities in both direct and transitive dependencies. New features for Maven support include: Override remediation strategy: Allows for more flexible remediation options. pom.xml file integration: Supports reading, writing, and updating local Maven files. Private registry support: Allows users to fetch Maven metadata from a private registry. Experimental subcommand: Enables the updating of all dependencies to the latest version. This expansion of guided remediation solution ensures that developers using Java and Maven can now access the same efficient vulnerability management options available for other ecosystems. Conclusion Google's roadmap for OSV-Scanner V2 includes updates like better OSV-SCALIBR integration, expanded ecosystem support, and enhanced container filesystem accountability. Future features such as reachability analysis and VEX support will further improve vulnerability management. As the open-source landscape evolves, OSV-Scanner V2 provides a powerful and user-friendly solution for developers to manage vulnerabilities, with Google encouraging ongoing feedback and contributions to improve the platform.

Medusa Ransomware Surge: 60 Victims in 3 Months—Are You Next?

cyberexpress Mar 18, 2025 Firewall Daily

Federal authorities, including the FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), have issued a high-priority advisory warning about the escalating threat posed by the Medusa ransomware group. The cybercriminal organization has ramped up its attacks, increasingly targeting users of major show more ...

email service providers like Gmail and Outlook. Medusa’s reach extends across multiple industries, with healthcare, education, legal services, insurance, technology, and manufacturing among the hardest hit. The surge in activity has prompted urgent calls for heightened cybersecurity measures to defend against the growing ransomware menace. Surge in Medusa Ransomware Attacks The ransomware advisory, released in early March 2025, reports a surge in Medusa ransomware attacks. According to Cyble, a cybersecurity threat intelligence firm, the group has seen a 45% increase in its operations in 2025 compared to the previous year. By early March, 60 new victims had already been reported, suggesting that Medusa is on track to surpass 300 incidents in 2025, a stark increase from 211 in 2024. February, in particular, saw a dramatic spike, with 33 victims reported in just one month, making it the highest month for ransomware activity across all variants. Identified in June 2021, Medusa ransomware was initially a closed system operated by a single group of cybercriminals. However, it has since evolved into a Ransomware-as-a-Service (RaaS) model. In this model, the core developers retain control over ransom negotiations while recruiting affiliates to execute the attacks. These affiliates are often cybercriminals hired through online forums and marketplaces, with payments ranging from $100 to $1 million for successful attacks. The group has primarily targeted high-profile entities in various sectors, often employing a double extortion model. This involves first encrypting the victim’s data and demanding payment for decryption. If the ransom is not paid, the group threatens to release stolen, sensitive data publicly. This technique adds intense pressure on victims to comply with ransom demands. Technical Details of Medusa Ransomware Medusa’s operation hinges on affiliates using multiple methods to gain unauthorized access to their targets. Among the most common tactics are phishing campaigns and exploiting unpatched software vulnerabilities. Phishing attacks are the primary method for stealing credentials, allowing the cybercriminals to infiltrate networks via deceptive emails or websites that trick users into revealing their login details. Medusa affiliates are also known to exploit vulnerabilities in popular software. Once access is achieved, Medusa actors deploy network enumeration tools like Advanced IP Scanner and SoftPerfect Network Scanner to identify potential targets. The group then uses legitimate Windows tools like PowerShell and the Windows Command Prompt to conduct further reconnaissance, mapping out systems and identifying files of interest. Evading Detection One of the hallmarks of Medusa ransomware is its sophisticated defense evasion techniques. The group makes use of Living Off the Land (LOTL) tactics, which involve exploiting legitimate system tools to carry out their attacks, making detection more challenging. For instance, they have been observed using the legitimate Certutil tool to hide their actions during file ingress, reducing the chances of being detected by endpoint detection systems. In addition, Medusa actors employ obfuscated PowerShell scripts, encoding commands in base64 to obscure their activities. They also split strings into smaller parts to prevent detection by traditional cybersecurity systems. Furthermore, they manipulate signed drivers to disable endpoint detection and response (EDR) tools, further evading detection and maintaining their foothold within the victim network. Lateral Movement and Data Exfiltration Medusa actors are adept at moving laterally within a compromised network. They use tools like AnyDesk, ConnectWise, and Splashtop, in conjunction with Remote Desktop Protocol (RDP) and PsExec, to navigate the system and maintain control. They also use Mimikatz to extract credentials from the Local Security Authority Subsystem Service (LSASS) memory, enabling further movement across the network. Once lateral movement is achieved, Medusa ransomware employs the Rclone tool to exfiltrate stolen data to the group’s Command and Control (C2) servers. To prevent recovery efforts, the ransomware encrypts files using AES-256 encryption and deletes backup systems and shadow copies before starting the encryption process. The affected files are given the .medusa extension, indicating they have been compromised. Double Extortion and the Ransom Demand Medusa's double extortion strategy includes not only encrypting data but also threatening to release sensitive, stolen information publicly unless the ransom is paid. Victims are contacted through encrypted messaging platforms like Tor and Tox, and a ransom note is dropped on the infected systems, outlining the steps for payment. The group has also been known to run a .onion data leak site, where they publish the names of victims along with countdown timers, signaling when the stolen data will be released. In some cases, even after victims have paid the ransom, they are contacted again by other Medusa affiliates demanding additional payments, suggesting the possibility of a triple extortion scheme. This makes it even more difficult for victims to recover from the attacks. Conclusion With the FBI and CISA identifying critical Indicators of Compromise (IoCs) linked to Medusa ransomware—including ransom notes, remote access scripts, and reverse shells—organizations must take proactive steps to bolster their cybersecurity defenses. Implementing regular software patches, enforcing strong authentication measures, maintaining secure backups, and deploying endpoint detection tools can significantly reduce the risk of falling victim to such attacks. As ransomware groups like Medusa evolve their tactics, real-time threat intelligence becomes essential. Cyble's AI-driven cybersecurity platforms offer advanced monitoring and detection capabilities, enabling organizations to stay ahead of emerging threats. By staying informed, leveraging federal cybersecurity resources, and adopting a proactive security posture, businesses and individuals can better safeguard their data against the relentless threat of ransomware.

Google Announces $32 Billion Deal to Acquire Cloud Security Startup Wiz

cyberexpress Mar 18, 2025 Cyber News

In a blockbuster $32 billion deal, Google today announced plans to acquire cloud security startup Wiz, marking one of the most significant cybersecurity acquisitions in history. The Google-Wiz acquisition comes after many months of talks and rejected offers. Reports of renewed talks and a potential agreement surfaced show more ...

earlier today, and the official announcement came soon after. The deal, subject to any closing conditions or adjustments, showcases Google’s aggressive push to fortify its cloud security and outpace rivals like Microsoft and AWS. Google-Wiz Acquisition a Game-Changer for Cloud Security Wiz, a rising star in cloud security, specializes in cloud security posture management (CSPM), helping enterprises detect and mitigate risks with minimal friction. By integrating Wiz’s cutting-edge security capabilities into Google Cloud, Google aims to offer more robust protections against evolving cyber threats. "Together, Google Cloud and Wiz will turbocharge improved cloud security and the ability to use multiple clouds," said Sundar Pichai, CEO of Google, in the official announcement. This acquisition positions Google to compete more aggressively with Microsoft’s cloud security solutions, a market leader in enterprise cybersecurity. Assaf Rappaport, co-founder & CEO of Wiz, called this an "exciting moment." He said, "This acquisition will bolster our mission to improve security and prevent breaches by providing additional resources and deep AI expertise." Months of Negotiations and a Change of Heart The acquisition follows a dramatic negotiation process. Wiz last year declined Google’s $23 billion offer, opting instead to pursue an IPO. However, after extensive discussions and revised terms, Google and Wiz reached an agreement, securing what is now the biggest cybersecurity deal ever. Founded in 2020 by former Microsoft security engineers, Wiz quickly became a dominant player in cloud security, securing major enterprise customers and surpassing a $10 billion valuation in prior funding rounds. Its rapid growth and innovative approach made it an irresistible target for acquisition. How The Google-Wiz Deal Reshapes Cybersecurity Google’s purchase of Wiz signals an intensified race in the cloud security sector. Microsoft, which has long held a strong position in enterprise security, will now face heightened competition as Google strengthens its security portfolio. AWS has also positioned itself as a leader in cloud security, so the deal significantly strengthens Google's position among its cloud rivals. Industry analysts predict the move will prompt other tech giants to invest further in cybersecurity, fueling more mergers and acquisitions in the space. It also highlights the increasing consolidation of cybersecurity firms as major players acquire specialized startups to enhance their offerings. The Road Ahead for Wiz Wiz will continue operating under the Google Cloud umbrella while maintaining its existing products and services. "We are excited to join forces with Google to accelerate our vision for cloud security," said Assaf Rappaport, CEO and co-founder of Wiz. "This partnership will enable us to scale our solutions to protect even more organizations worldwide." The deal is expected to close later this year, pending regulatory approval. Google has assured customers that Wiz will continue its independent operations within Google Cloud, ensuring a smooth transition. Google’s acquisition of Wiz marks a pivotal moment in the cybersecurity industry. With cloud security threats growing in complexity, this deal reinforces the importance of proactive security measures and AI-driven threat detection. By bringing Wiz into its fold, Google is positioning itself as a dominant force in cloud security, setting the stage for a more competitive and rapidly evolving cybersecurity landscape.

China Names Four Hackers of Taiwan’s Cyber Army Targeting Beijing Critical Infrastructure

cyberexpress Mar 18, 2025 Cyber Warfare

China has accused four Taiwanese individuals of being hackers associated with Taiwan’s military cyber force, claiming they were responsible for cyberattacks against Beijing. The Ministry of State Security (MSS) identified them as members of Taiwan’s Information, Communications, and Electronic Force Command show more ...

(ICEFCOM), publishing their names, photographs, birthdates, and job titles. The accusations add another layer of tension between the two nations as tensions between the two nations continue to remain hostile. China’s Allegations Against Taiwan’s ICEFCOM According to China’s MSS, ICEFCOM has been involved in cyberattacks targeting China’s critical infrastructure. The ministry stated that Taiwan’s cyber force, also known as the "Internet Army" has been working with external hackers and cybersecurity firms to launch cyber espionage and infiltration campaigns. "Their activities include espionage, sabotage, and propaganda," the MSS said. Since its establishment, ICEFCOM has conducted targeted cyberattacks and infiltration operations against critical Chinese infrastructure, the MSS stated in an official release. China claimed that the attacks focused on systems controlling waterworks, power grids, telecommunications networks, and surveillance cameras, aiming to disrupt national stability. The MSS also accused ICEFCOM of attempting to breach databases containing sensitive information on Chinese citizens, government officials, and military operations. Beijing labeled these activities as part of Taiwan’s broader intelligence-gathering efforts, allegedly backed by foreign entities. Taiwan Rejects Claims, Calls China the Real Cyber Aggressor Taiwan’s Ministry of National Defense swiftly rejected China’s accusations, calling them an attempt to shift blame. Taiwan has repeatedly stated that its cyber units focus on defensive measures rather than offensive operations. The military’s cybersecurity forces do not engage in cyberattacks, Taiwan’s defense ministry said in a statement. Taipei accused Beijing of fabricating claims to justify its own cyber activities against Taiwan. Taiwan recently released its own report detailing Beijing’s cyber tactics over the past year. Taiwan’s National Security Bureau (NSB) stated that cyberattacks against Taiwan’s government departments averaged 2.4 million per day in 2024. The report suggested that China’s state-sponsored hackers have been refining their cyber warfare techniques to exert political and economic pressure on Taipei. China’s Cyberattack Techniques in 2024 Taiwan’s NSB report outlined the key methods China used in its cyber operations throughout 2024. The tactics ranged from phishing campaigns to large-scale data breaches designed to compromise government and military networks. One of the primary strategies involved Advanced Persistent Threat (APT) groups linked to the Chinese government. These groups infiltrated Taiwanese organizations using malware-laced emails and trojanized software updates. Some of the most sophisticated attacks targeted supply chain vendors, allowing hackers to bypass traditional security measures and infiltrate government networks undetected. China also leveraged artificial intelligence (AI)-driven cyber tools to automate large-scale attacks. AI-enhanced malware adapted in real time, making it harder for cybersecurity teams to detect and neutralize threats. The NSB report noted that China’s hackers used generative AI models to craft realistic phishing emails that closely mimicked official government communications, deceiving even experienced professionals. Another concerning development was China’s increasing use of zero-day exploits—previously unknown software vulnerabilities that hackers used before they could be patched. Beijing’s cyber units deployed these exploits against Taiwan’s critical infrastructure, targeting national defense systems, financial institutions, and telecom providers. Growing Cyber Conflict Between Beijing and Taipei Taiwan has long been a focal point of Chinese cyber operations, but the scale and sophistication of attacks in 2024 marked a significant escalation following the physical tensions between the two nations. Chinese hackers reportedly infiltrated multiple Taiwanese defense contractors, attempting to extract classified military research and technology blueprints. The growing cyber conflict has also impacted Taiwan’s private sector. The NSB noted that Chinese threat actors carried out ransomware attacks against Taiwanese semiconductor firms, aiming to disrupt one of the world’s most crucial industries. Additionally, Beijing allegedly sought to manipulate Taiwanese social media platforms, spreading disinformation to sway public opinion ahead of key political events. With China publicly accusing Taiwan of cyberattacks and Taiwan providing detailed evidence of Beijing’s own operations, tensions in cyberspace continue to rise. Both nations remain locked in a digital conflict where information warfare plays a crucial role in their broader geopolitical struggle. China’s allegations against Taiwan come amid an increasingly hostile landscape in the Asia-Pacific region. While Beijing has labeled Taiwan’s ICEFCOM as a cyber threat, Taipei maintains that China is the real aggressor, orchestrating millions of daily attacks. Taiwan’s latest findings reveal that China’s cyber capabilities are evolving rapidly, incorporating AI, zero-day exploits, and supply chain attacks to gain strategic advantages. As cyberwarfare becomes a critical battleground, both nations are likely to continue investing in offensive and defensive cyber capabilities, experts suggest.

Supply chain attack via GitHub Action | Kaspersky official blog

kaspersky Mar 18, 2025 Business

Attacks on open-source mostly start with publishing new malicious packages in repositories. But the attack that occurred on March 14 is in a different league — attackers compromised the popular GitHub Action tj-actions/changed-files, which is used in more than 23,000 repositories. The incident was assigned show more ...

CVE-2025-30066. All repositories that used the infected changed-files Action are susceptible to this vulnerability. Although the GitHub administration blocked changed-files Action and then rolled it back to a safe version, everyone who used it should conduct an incident response, and the developer community should draw more general lessons from this incident. What are GitHub Actions? GitHub Actions are workflow patterns that simplify software development by automating common DevOps tasks. They can be triggered when certain events (such as commits) occur at GitHub. GitHub has a kind of app-store where developers can take a ready-made workflow process and apply it to their repository. To integrate such a ready-made GitHub process into your CI/CD development pipeline, you only need one line of code. changed-files compromise incident On March 14, the popular tj-actions/changed-files GitHub Action — used to get any changed files from a project — was infected with malicious code. The attackers modified the process code and updated the version tags to include a malicious commit in all versions of changed-files GitHub Action. This was done on behalf of the Renovate Bot user, but according to current information the bot itself wasnt compromised; it was just a disguise for an anonymous commit. The malicious code in changed-files is disguised as the updateFeatures function, which actually runs a malicious Python script and dumps the Runner Worker process memory, then searches it for data that looks like secrets (AWS, Azure and GCP keys, GitHub PAT and NPM tokens, DB accounts, RSA private keys). If something similar is found, its written to the repository logs. Both the malicious code and the stolen secrets are written with simple obfuscation — double base64 encoding. If the logs are publicly available, attackers (and not only the operators of the attack, but anyone!) can freely download and decrypt this data. On March 15, a day after the incident was discovered, GitHub deleted the changed-files process, and the CI/CD processes based on it may have not functioned. After another eight hours, the process repository was restored in a clean version, and now changed-files is working again without surprises. Incident Response Since logs in public repositories are accessible to outsiders, theyre the most likely to have been affected by the leak. However, in an enterprise environment, relying solely on the assumption that all our repositories are private is also not a good idea. Companies often have both public and private repositories, and if their CI/CD pipelines use overlapping secrets, attackers can still use this data to compromise container registries or other resources. Containers or packages built by popular open-source projects can also be compromised in this scenario. The authors of the ill-fated changed-files recommend analyzing GitHub logs for March 14 and 15. If unusual data is found in the changed-files subsection, it should be decoded to understand what information may have been leaked. Additionally, its worth examining GitHub logs for this period for suspicious IP addresses. All changed-files users are advised to replace secrets that could have been used in the build and leaked during this period. First of all, you should pay attention to repositories with public CI logs, and secondly, to private repositories. In addition to replacing potentially compromised secrets, its recommended to download the logs for subsequent analysis, and then clear their public versions. Lessons from the incident The complexity and variety of attacks on the supply chain in software development are growing: weve already become accustomed to attacks in the form of malicious repositories, infected packages and container images, and weve encountered malicious code in test cases — and now in CI/CD processes. Strict information-security hygiene requirements should extend to the entire life-cycle of an IT project. In addition to the requirement to strictly select the source code base of your project (open source packages, container images, automation tools), a comprehensive container security solution and a secrets management system are necessary. Importantly, the requirements for special handling of secrets apply not only to the projects source code, but also to the development processes. GitHub has a detailed guide on securely configuring GitHub Actions — the largest section of which is devoted specifically to handling secrets.

Extortion Reboot: Ransomware Crew Threatens Leak to Snowden

darkreading Mar 18, 2025 Feed

Though the group initially stuck to classic ransomware TTPs before demanding the ransom, it went off script when it began threatening the group and detailing potential consequences the victim would face.

Orion Security Startup Tackles Insider Threats With AI

darkreading Mar 18, 2025 Feed

The data loss prevention company emerges from stealth with an AI-powered platform to help organizations distinguish between legitimate and risky activity.

Microsoft Sounds Warning on Multifunctional 'StilachiRAT'

darkreading Mar 18, 2025 Feed

The sneaky malware packs capabilities for system reconnaissance as well as credential and cryptocurrency theft.

Actively Exploited ChatGPT Bug Puts Organizations at Risk

darkreading Mar 18, 2025 Feed

A server-side request forgery vulnerability in OpenAI's chatbot infrastructure can allow attackers to direct users to malicious URLs, leading to a range of threat activity.

Black Basta Leader in League With Russian Officials, Chat Logs Show

darkreading Mar 18, 2025 Feed

Though the chat logs were leaked a month ago, analysts are now seeing that Russian officials may have assisted Black Basta members according, to the shared messages.

Google to Acquire Wiz for $32B in Multicloud Security Play

darkreading Mar 18, 2025 Feed

The all-cash deal offers a path for Google to better support cloud customers who have assets spread across public environments, including Azure and others.

Knostic Nabs $11M to Eliminate Enterprise AI Data Leaks

darkreading Mar 18, 2025 Feed

Wireless Airspace Defense Firm Bastille Reveals Top Threats of 2025

darkreading Mar 18, 2025 Feed

Automox Demonstrates IT and Security Impact With Launch of Precision Analytics

darkreading Mar 18, 2025 Feed

Fujifilm Signs Strategic Collaboration Agreement With Amazon Web Services

darkreading Mar 18, 2025 Feed

Duke University & GCF Partner to Identify Pathways for Advancing Women's Careers in Cybersecurity

darkreading Mar 18, 2025 Feed

3 AI-Driven Roles in Cybersecurity

darkreading Mar 18, 2025 Feed

For candidates with a cybersecurity background who want to stay competitive, now is the time to invest in obtaining AI skills.

Crypto exchange OKX shuts down tool used by North Korean hackers to launder stolen funds

cyware Mar 18, 2025 News

OKX said it detected a coordinated effort by one of North Korea’s most prolific hacking outfits to misuse its decentralized finance (DeFi) services.

Municipalities in four states are struggling with cyberattacks limiting services

cyware Mar 18, 2025 News

Cyberattacks on public entities across the U.S. — from police stations to school districts and courts — are causing wide-ranging issues for residents and public employees.

Western Alliance Bank says nearly 22,000 impacted by file transfer software breach

cyware Mar 18, 2025 Cybercrime

Phoenix-based Western Alliance Bank filed data breach notices saying about 22,000 people were affected by an incident involving file transfer software.

Microsoft identifies new RAT targeting cryptocurrency wallets and more

cyware Mar 18, 2025 Malware

A previously unreported remote access trojan that Microsoft researchers dubbed StilachiRAT is designed to steal a wide range of data, including information about cryptocurrency wallet extensions for Google's Chrome browser.

China identifies Taiwanese hackers allegedly behind cyberattacks and espionage

cyware Mar 18, 2025 News

In a rare move, China's state security ministry released the names and photos of four alleged hackers within Taiwan's defense ministry.

Google buys cloud security provider Wiz for $32 billion

cyware Mar 18, 2025 Industry

The purchase is the biggest such deal in Google's history and also the largest corporate acquisition overall this year.

Poisoned Windows shortcuts found to be a favorite of Chinese, Russian, N. Korean state hackers

cyware Mar 18, 2025 Cybercrime

The Zero Day Initiative measured the prevalence of manipulated Windows shortcut files in campaigns attributed to nation-state hacking groups — finding at least 11 exploited a bug that allows malicious use of the files.