Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Mysterious Disappear ...

 Cyber News

Xiaofeng Wang, a well-respected computer scientist and professor at Indiana University, has suddenly vanished along with his wife, Nianli Ma. The couple’s disappearance has raised a multitude of questions after their profiles were removed from the university's website and their homes were raided by the FBI.    show more ...  

Wang, a prominent figure in the field of cryptography, privacy, and cybersecurity, had a distinguished career spanning over two decades. As a professor at Indiana University’s Luddy School of Informatics, Computing, and Engineering, he held academic and research roles, including serving as associate dean for research.   The Enigmatic Disappearance of Xiaofeng Wang  Wang's work, particularly in the protection of human genomic data and systems security, earned him international recognition, and he had coauthored numerous influential papers. His academic journey included contributions to projects funded by nearly $23 million, solidifying his reputation as a leading computer scientist.  However, recent developments have cast a shadow over his career and raised serious concerns. In the last few weeks, Wang’s profile page, email account, and phone number were quietly erased from the university’s website without explanation. Similar actions were taken regarding his wife, Nianli Ma, who was a lead systems analyst at the university’s Library Technologies division. The unusual circumstances surrounding their disappearance and the removal of their digital profiles led to widespread speculation among colleagues, students, and the public, reported WIRED. The situation took a dramatic turn when FBI agents raided both of the couple’s homes in Bloomington and Carmel, Indiana. According to local news reports, several unmarked vehicles arrived at their Bloomington residence on a Friday, with agents spending hours moving boxes in and out of the property. A second raid occurred at their Carmel home, where agents conducted a search that reportedly included questioning a woman outside the property and accessing the attic. Witnesses reported seeing investigators taking photos, collecting evidence, and removing several boxes from the residence. Despite the heavy law enforcement presence, the FBI has offered little information about the raids. In a brief statement, an FBI spokeswoman confirmed that "court-authorized law enforcement activity" was conducted at both locations but declined to provide further details. No documents relating to Wang, Ma, or the searches were found in federal court dockets, leading to questions about the nature of the investigation.  The Disappearance Reaches Social Media  The situation has baffled many in the academic and cybersecurity communities. Matthew Green, a professor of cryptography at Johns Hopkins University, expressed his concern on social media, stating, "None of this is in any way normal." He noted that Wang had been missing for weeks and that his students had been unable to contact him. Fellow academic Matt Blaze, a professor at Georgetown University, also voiced his bewilderment, questioning the sudden removal of Wang’s tenure status and the university’s actions to erase his presence from its records. Local news outlet WTHR provided more details about the FBI raid in Carmel, where agents reportedly announced their presence using a megaphone, stating, "FBI, come out!" A woman, believed to be Ma, was seen leaving the house holding a phone, and agents subsequently questioned her before searching the property. The investigation continued for hours, with law enforcement leaving the scene with multiple boxes of evidence. A lawyer representing the family later stated that the purpose of the investigation remained unclear. The disappearance of Xiaofeng Wang and his wife, combined with the FBI’s involvement, has left many puzzled and concerned. Questions about their whereabouts, the nature of the investigation, and the reasons behind their sudden removal from the academic institution remain unanswered. As the FBI investigation unfolds, the academic and cybersecurity communities are closely monitoring the case, hoping for clarity and answers in what has become an increasingly mysterious and troubling situation.

image for World Backup Day: Wh ...

 Cyber Essentials

World Backup Day, observed annually on March 31, serves as a reminder of the importance of protecting data against cyber threats, accidental deletions, and technical failures. Despite growing awareness, many firms still overlook a major vulnerability that can render even the most complex backup strategies ineffective:   show more ...  

human error. Employees—often unknowingly—pose risks to backup integrity through mistakes such as accidental deletions, misconfigured backup settings, and falling victim to social engineering attacks. One of the latest surveys highlights concerning trends: 55% of users rely on cloud storage as their primary backup method, yet only 33% back up their data regularly. Furthermore, 34% of respondents cited accidental deletion and lack of backup as the leading causes of data loss. These statistics show us the reality—without strong backup practices and employee awareness, businesses remain vulnerable to data breaches, ransomware attacks, and irreversible data loss. As Amit Luthra, Managing Director of Lenovo ISG India, aptly puts it: “In an era where AI adoption accelerates and IT infrastructures grow increasingly complex, ensuring seamless data availability and resilience has become paramount. Cyber threats, system failures, and stringent compliance mandates necessitate robust backup and disaster recovery strategies—not merely as safeguards, but as business imperatives. Lenovo's ThinkSystem and ThinkAgile solutions are meticulously engineered to meet these evolving demands. They provide secure, scalable, and AI-ready infrastructure that ensures continuous data protection.” This highlights a point: backup strategies must evolve alongside technological advancements. Simply having a backup is no longer enough—it must be resilient, automated, and cyber-aware to mitigate both technical and human-induced risks. This article explores the most common human errors in backup management, the risks of data loss, and effective strategies organizations can implement to safeguard their backup systems from internal mistakes and cyber threats. Common Human Errors in Backup Management Even the most advanced backup systems can fail due to simple human mistakes. Here are some of the most common errors employees make: [caption id="attachment_101755" align="aligncenter" width="1024"] Source: TCE[/caption] Accidental Deletion of Critical Files: Employees may unintentionally delete essential files or entire folders, assuming they are no longer needed. If backups are not frequent or properly structured, restoring deleted data becomes impossible. Overwriting Backup Data: When employees manually back up files, they sometimes overwrite crucial previous versions, eliminating the ability to recover older data in case of errors. Failure to Follow Backup Protocols: Organizations implement backup policies, but employees may neglect to follow them. This includes failing to run scheduled backups or disconnecting backup drives before completion. Mishandling Physical Backup Devices: External hard drives, USBs, and SD cards are prone to damage or loss. An unintentional drop or misplacement can result in irrecoverable data loss. Ignoring Security Measures: Employees often reuse weak passwords, misconfigure backup settings, or unknowingly expose backups to cyber threats. These mistakes highlight the need for a comprehensive backup strategy and employee training to prevent data loss. The Main Data Risks and the Role of Backup in Mitigation Data loss occurs due to various factors, with ransomware attacks leading the charge. Here’s an overview of the most significant threats and how backups mitigate them: [caption id="attachment_101757" align="aligncenter" width="1024"] Source: TCE[/caption] Ransomware Attacks: Ransomware encrypts files and demands a ransom for decryption. Even if organizations pay, there's no guarantee of file recovery. A strong backup strategy ensures quick restoration without paying cybercriminals. Technical Failures: Hardware crashes, software corruption, and system failures can render data inaccessible. Cloud backups provide real-time recovery, reducing downtime and ensuring business continuity. Human Error: Employees may accidentally delete, overwrite, or misplace critical files. A versioned backup system allows restoration to previous states, mitigating accidental losses. Physical Disasters: Fires, floods, and power surges can wipe out local storage. Offsite and cloud backups provide a safety net against such disasters. Organizations must implement strong backup solutions to counteract these threats effectively. Social Engineering Attacks Targeting Backups Cybercriminals exploit human psychology to infiltrate backup systems. Some common tactics include: Phishing Attacks: Attackers trick employees into clicking malicious links or downloading malware that compromises backups. Impersonation and Pretexting: Hackers pose as IT personnel, convincing employees to grant unauthorized access to backup systems. Insider Threats: Disgruntled employees with access to backups can delete, alter, or leak sensitive data. To prevent these threats, businesses must implement multi-factor authentication, access controls, and security awareness training. How to Implement a Backup Strategy for Workplace Cybersecurity A structured backup strategy ensures data integrity and swift recovery. Here’s a recommended approach: 1. Follow the 3-2-1 Backup Rule Maintain 3 copies of data: 1 primary and 2 backups. Store backups on 2 different media types (e.g., cloud and external drive). Keep 1 backup offsite for disaster recovery. 2. Automate Backups Schedule daily or real-time backups to prevent accidental data loss. Ensure versioning so previous file versions remain accessible. 3. Encrypt Backup Data Use end-to-end encryption to prevent unauthorized access. Restrict access to authorized personnel only. 4. Regularly Test Backups Conduct routine recovery drills to verify data integrity. Ensure that restoration procedures work as intended. [caption id="attachment_101758" align="aligncenter" width="1024"] Source: TCE[/caption] Training Employees to Follow Best Backup Practices Educating employees on proper backup protocols is key to reducing human errors. Consider implementing: 1. Employee Cybersecurity Awareness Programs Teach employees about phishing risks and social engineering threats. Demonstrate how to recognize suspicious backup activity. 2. Regular Backup Training Sessions Train employees on how and when to back up data. Provide guides on secure backup handling. 3. Access Control Measures Limit backup access to authorized personnel only. Implement role-based permissions to prevent accidental deletions. 4. Incident Response Drills Simulate backup recovery scenarios to ensure employees are prepared. Test their ability to restore files in real-time. By incorporating these practices, organizations can minimize human errors and strengthen their backup resilience. To Sum Up As the survey reveals, human error remains one of the biggest threats to backup integrity. Accidental deletions, overwritten files, ignored security protocols, and misplaced backup devices can wipe out important data in an instant. The reality is: that even the best technology cannot compensate for poor user practices. Organizations must stop viewing backups as a one-time solution and start treating them as an ongoing responsibility. Automating backup processes, enforcing security policies, and educating employees about their role in data protection are not optional—they are essential. Without a well-executed backup strategy, businesses risk more than just data loss; they risk their reputation, financial stability, and long-term survival. As Amit Luthra emphasizes, the modern backup strategy must “transcend mere recovery; it embodies proactive resilience.” That means integrating immutable backups, cyber resilience, and AI-driven automation into backup protocols. With ransomware and cyber threats evolving rapidly, the question isn't just whether you have a backup—it’s whether your backup strategy is resilient enough to tolerate human errors. The time to act is now. Because when disaster happens, the only thing worse than losing your data is realizing it was preventable. Image Reference: All images inserted in this article are self-designed by the author with the help of Canva.

image for Moscow Metro Digital ...

 Firewall Daily

The Moscow Metro website and mobile application experienced disruptions on March 31, 2023. The Moscow subway app users reported various malfunctions, including issues loading personal accounts and difficulties in accessing key features like ticket purchasing and account management. The metro website, which is an   show more ...  

essential tool for navigating the city’s vast metro system, became unavailable on the same day, displaying a peculiar message that hinted at an alleged cyberattack.  The message, which was a technical failure banner, mimicked a similar notification that had appeared on the Ukrainian Railways website a few days prior. Ukrainian Railways, known locally as Ukrzaliznytsia, had fallen victim to a large-scale cyberattack on March 23, 2023. As a result, its website and mobile application were rendered inoperable, preventing travelers from purchasing tickets online. The state-owned railway company attributed the attack to "the enemy" but did not provide further details on the perpetrators.  The Moscow Metro and Ukrainian Railways Incident  The disruption of the Moscow Metro’s digital services comes amid a broader wave of cyberattacks targeting transportation infrastructure in the region. On March 31, Russian users flocked to the crash detection service Downdetector.su to report issues with both the app and its website, mosmetro.ru. Affected users complained about an inability to access personal accounts, problems with payment sections, and complete failures in app functionality. The crash detection service noted that up to 40,000 users had reported issues on that day alone, reported The Kyiv Independent. Interestingly, the website displayed a banner featuring a message in Ukrainian, along with a reference to Ukrainian Railways. This sparked widespread speculation that the Moscow Metro's website had been compromised in a manner similar to the earlier attack on Ukrzaliznytsia. While Russian authorities have not confirmed this, experts suspect that hackers could be behind the disruption, particularly since the Ukrainian Railways site had suffered a similar breach just days earlier. Moscow Metro's Response to the Outage  [caption id="attachment_101741" align="aligncenter" width="552"] Statement from Dept. of Transport. Operational (Source: Telegram)[/caption] The Moscow transport department quickly issued a statement via their official Telegram channel, acknowledging the technical difficulties and reassuring passengers that steps were being taken to resolve the issues. According to the department, the outages were due to "technical maintenance," and users were advised to expect temporary problems when accessing personal accounts in the app. Despite the app’s malfunctions, passengers could still replenish their “Troika” transport cards at physical ticket offices and terminals throughout metro stations.  Roskomnadzor, Russia’s federal service for surveillance of communications, also acknowledged the increase in reports about Moscow Metro’s technical issues. However, the agency refrained from commenting on the specific causes of the disruptions, which continue to be a source of concern for commuters.  The Moscow Metro’s website was temporarily down for most of the day, but the disruption raised more questions than answers. For instance, one of the key complaints from Russian users was the difficulty in paying for tickets via the metro’s payment system, as the payment section did not load properly on the app. Many users also noted that the app would not load entirely, leaving them unable to access their accounts or purchase tickets.  Conclusion   The recent cyberattack on Ukrainian Railways (Ukrzaliznytsia) and the subsequent disruptions to the Moscow Metro app and website highlight the growing vulnerability of critical infrastructure to digital threats.   While Ukrzaliznytsia has partially restored its online ticketing services after an intense recovery effort, the incident highlighted the challenges of securing essential systems against such attacks. The simultaneous issues faced by the metro suggest a potential connection, raising concerns about the broader implications for cybersecurity in politically sensitive regions. 

image for Canon CVE-2025-1268 ...

 Firewall Daily

Canon Marketing Japan Inc. and Canon Inc. have issued an important security update regarding a vulnerability in certain printer drivers. This Canon vulnerability, identified as CVE-2025-1268, affects a range of Canon printer models, including production printers, office multifunction devices, and small office   show more ...  

multifunction devices.   The flaw was discovered in Canon printer drivers, specifically the Generic Plus series, which includes several common drivers used by both home and office users.  Overview of the Canon Vulnerability (CVE-2025-1268)  The issue stems from a buffer overflow in Canon printer drivers when a print job is processed by a specially crafted application. Under certain conditions, this flaw could allow unauthorized code to be executed on the affected systems. However, the frequency of this exploit is considered to be extremely low, and Canon has emphasized that there have been no confirmed cases of this vulnerability being actively exploited.  This flaw is a classic example of an out-of-bounds vulnerability, which can lead to unintended behavior in software. In this case, it could prevent printing or potentially allow attackers to execute arbitrary code on the system. Affected Printer Drivers  The vulnerability affects the following printer drivers:  Generic Plus PCL6 Printer Driver – Version 3.12 and earlier  Generic Plus UFR II Printer Driver – Version 3.12 and earlier  Generic Plus LIPS4 Printer Driver – Version 3.12 and earlier  Generic Plus LIPSLX Printer Driver – Version 3.12 and earlier  Generic Plus PS Printer Driver – Version 3.12 and earlier  These printer drivers are commonly used in a wide variety of Canon printer models, including production printers, office multifunction printers, small office multifunction printers, and laser printers.  The Security Impact of CVE-2025-1268  The vulnerability is particularly concerning because it has the potential to be exploited by malicious actors through a crafted application that interacts with these vulnerable Canon printer drivers.   According to the CVSS (Common Vulnerability Scoring System), the severity of this issue is rated at 9.4 (on a scale of 0 to 10), which places it in the critical category.  The CVSS 3.1 score for this vulnerability is as follows:  Base Score: 9.4  Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L  This score indicates a high impact on confidentiality and integrity, as well as a low requirement for user interaction, making it a relatively easy vulnerability for attackers to exploit if the proper conditions are met.  Canon’s Response and Recommendations  While there have been no known instances of this vulnerability being actively exploited, Canon strongly advises users to take action to mitigate potential risks. The company has recommended updating the affected printer drivers to the latest versions available. These updates, which contain fixes for the Canon printer vulnerability, can be downloaded from the official Canon websites or through local Canon sales representatives.  Conclusion   The discovery of this vulnerability by Robert Ord in collaboration with the Microsoft Offensive Research and Security Engineering (MORSE) Team highlights the critical role of security researchers in identifying and addressing potential risks in connected devices like printers.  While the immediate threat may be low, the potential for damage highlights the importance of regularly updating Canon printer drivers to maintain network security. 

image for AI, Data Protection, ...

 Cyber News

The Microsoft Fabric Community Conference, currently underway from March 31 to April 2, 2025, in Las Vegas, has already become a major event for data professionals and AI enthusiasts alike. With over 200 sessions, 13 specialized tracks, and numerous hands-on workshops, the conference is attracting industry experts and   show more ...  

users who are eager to explore the evolving landscape of data security and AI governance. The annual event is a platform for sharing insights, with a focus on key topics such as data security, governance, and the rapid advancements in artificial intelligence (AI) technologies. As AI continues to revolutionize various industries, organizations are also facing growing challenges surrounding data protection, governance, and regulatory compliance. AI’s Role in Data Security and Governance AI has become deeply integrated into the daily work of many professionals. A significant 75% of knowledge workers now use some form of AI in their daily tasks, contributing to its widespread adoption. However, this widespread use of AI comes with its own set of challenges. Governments around the world are moving quickly to address the potential risks and ethical concerns associated with AI. Over 69 countries have proposed over 1,000 AI-related policy initiatives, and businesses must navigate an increasingly complex regulatory environment to ensure compliance. As companies continue to adopt AI technologies, they are also seeking comprehensive solutions to address data security, governance, and privacy issues. These solutions are essential not only for compliance with emerging regulations but also for mitigating the risks of data leaks, oversharing, and unauthorized access to sensitive information. The Growing Need for Security and Governance Solutions At the conference, Microsoft unveiled several new innovations designed to help organizations tackle these challenges as they embrace AI and new data management practices. Among the key announcements: Enhancing Data Loss Prevention for Lakehouse in Microsoft Fabric Microsoft Purview’s Data Loss Prevention (DLP) capabilities, which are already integrated with Microsoft 365, are now expanding to better protect sensitive data in lakehouse environments within Microsoft Fabric. These enhancements aim to help prevent data loss by restricting access based on data sensitivity. Data security administrators can configure policies to ensure that only internal users or authorized data owners have access to sensitive information. This functionality is especially crucial when working with guest users in Fabric, as it ensures that proprietary data remains secure. Expanding DLP Support for More Fabric Items In a bid to offer more comprehensive data protection, Microsoft is expanding DLP policy support for additional Fabric items, including KQL (Kusto Query Language) and Mirrored databases. These databases are essential for real-time analytics and contain large amounts of sensitive data. The extension of Purview DLP support to these sources helps users receive notifications when they interact with sensitive data, thus minimizing the risk of accidental data leakage. The expansion also includes databases like Azure Cosmos DB, Azure SQL, and Snowflake, which are part of a broader strategy to safeguard data across diverse environments. Integration with Copilot for Power BI AI has raised new concerns about data security, particularly when it comes to the use of tools like Copilot. Microsoft is now integrating Microsoft Purview with Copilot for Power BI, which aims to provide users with greater visibility into potential data risks associated with AI-driven prompts and responses. Through the Microsoft Purview Data Security Posture Management (DSPM) dashboard, users will receive alerts and recommended actions to mitigate risks related to sensitive data. This integration also supports monitoring AI usage, helping organizations identify potential risks of non-compliant AI practices, such as unauthorized sharing of sensitive data or misuse by departing employees. Introducing Data Observability in Microsoft Purview Unified Catalog One of the most anticipated announcements is the introduction of data observability within the Microsoft Purview Unified Catalog, now available in preview. This feature allows organizations to visually investigate data quality issues and trace their root causes through an interactive interface. Users can track the relationships between governance domains, data products, and data assets across multicloud and hybrid environments. This tool is designed to improve data quality, a critical aspect of ensuring AI systems operate effectively and comply with regulatory reporting requirements. A Unified Approach to Data Security and AI Governance As organizations continue to integrate AI into their operations, the importance of safeguarding data and ensuring compliance with evolving regulations will only increase. Microsoft’s announcements at the conference aim to help companies address these challenges by providing comprehensive, integrated tools that offer greater control over data management and security. The intersection of AI, data security, and governance is becoming increasingly complex, and it is clear that organizations must adopt more advanced and integrated solutions to navigate this evolving landscape. The ability to seamlessly manage data across multiple platforms, enforce policies around data usage, and ensure compliance with global regulatory standards will be key to safely unlocking the full potential of AI technologies.

image for Trojan.Arcanum — a ...

 Privacy

Imagine what the world would be like if tarot cards could accurately predict any and every event. Perhaps we could have nipped Operation Triangulation in the bud, and zero-day vulnerabilities wouldnt exist at all, as software developers would receive alerts in advance thanks to tarot readings. Sounds incredible? Well,   show more ...  

our experts actually looked into similar methods in their latest discovery! Read on to learn about the new Trojan we found and how we did it. The tarot trojan The new Trojan — Trojan.Arcanum — is distributed through websites dedicated to fortune-telling and esoteric practices, disguised as a magic app for predicting the future. At first glance, it looks like a harmless program offering users the chance to lay out virtual tarot cards, calculate astrological compatibility, or even charge an amulet with the energy of the universe (whatever that means). But in reality, something truly mystical is unfolding behind the scenes — in the worst possible way. Once installed on the users device, Trojan.Arcanum connects to a cloud C2 server and deploys its payload — the Autolycus.Hermes stealer, the Karma.Miner miner, and the Lysander.Scytale crypto-malware. Having collected user data (logins; passwords; time, date and place of birth; banking information; etc.), the stealer sends it to the cloud. Then the real drama begins: the Trojan starts manipulating its victim in real life using social engineering! Through pop-up notifications, Trojan.Arcanum sends pseudo-esoteric advice to the user, prompting them to take certain actions. For example, if the Trojan gains access to the victims banking apps and discovers significant funds in the account, the attackers send a command to give the victim a false prediction about the favorability of large investments. After this, the victim might receive a phishing email offering to participate in a promising startup. Or maybe they wont — depending on how the cards fall. In the meantime, the embedded Karma.Miner begins mining KARMA tokens, and the Trojan activates a paid subscription to dubious esoteric practices with monthly charges. If the user detects and terminates the KARMA mining, the crypto-malware randomly shuffles segments of the users files without any chance of recovery. How we discovered Trojan.Arcanum Typically, we hunt for cyberthreats using complex algorithms and data analysis. But what if the threat is too enigmatic? In such cases, trusting a tarot reading is the best approach. Thats exactly what our experts did. When performing divination on the signature of an unknown virus detected through KSN (Kaspersky Sacral Network), several Major Arcana cards appeared — some of them reversed: The Emperor — A symbol of power, control, and strategic foresight. Meaning: the threat is serious. The Magician — Able to spot vulnerabilities where no one else does. Clever, proactive, and decisive, the Magician skillfully manipulates people. In reverse, it warns of a loss of control. Meaning: the attackers use social engineering. The Horse — Represents a bold, decisive, adventurous individual; a symbol of activity, change… and Trojan horses. Reversed, the card indicates errors due to impulsive actions. Meaning: the threat might disguise itself as a randomly downloaded harmless app. The Wheel — Warns that insurmountable circumstances are beyond the users control, and that a favorable resolution will be delayed. Usually indicates a miner or financial scam. The Tower — Foretells a phase of change initiated not by the person but by fate — falling upon the person with relentless force. A strong predictor of a zero-click vulnerability. Death — represents transformation, a change of cycles, an ending, a transition to a new level. Indicates the presence of crypto-malware. How the reading looked on the experts table How to protect yourself from Arcanum Protecting yourself from such a virus is nearly impossible — if only because it doesnt exist. This whole story is a fabrication from start to finish. But whats stopping it from becoming a reality at any given moment? Trojans and other types of malware do often disguise themselves as legitimate apps and can steal all sorts of data. Miners have long been distributed through links under popular YouTube videos or video games. Ransomware is capable of paralyzing an entire nations healthcare insurance system. Moreover, magic themes are certainly popular enough to become a potential target of cybercriminals. Here are some tips to make your digital life safer: Trust proven security tech. A tarot reading wont detect a virus or save your smartphone or laptop from one, but Kaspersky Premium will. Check app permissions. If a fortune-telling app requests access to your text messages, geolocation, or the file system, think twice — why does it need that? Youre likely looking at disguised spyware, not some magical technology. Pay close attention to your subscriptions. Regularly check the subscriptions in your app store settings so you dont suddenly find out youve been forking out some Secret Order of Fortune Tellers every month. Dont believe everything you read online. Especially on April 1.

 Feed

Apple has been hit with a fine of €150 million ($162 million) by France's competition watchdog over the implementation of its App Tracking Transparency (ATT) privacy framework. The Autorité de la concurrence said it's imposing a financial penalty against Apple for abusing its dominant position as a distributor of mobile applications for iOS and iPadOS devices between April 26, 2021 and July 25,

 Feed

Apple on Monday backported fixes for three vulnerabilities that have come under active exploitation in the wild to older models and previous versions of the operating systems. The vulnerabilities in question are listed below - CVE-2025-24085 (CVSS score: 7.3) - A use-after-free bug in the Core Media component that could permit a malicious application already installed on a device to elevate

 Feed

Cybersecurity researchers are warning of a spike in suspicious login scanning activity targeting Palo Alto Networks PAN-OS GlobalProtect gateways, with nearly 24,000 unique IP addresses attempting to access these portals. "This pattern suggests a coordinated effort to probe network defenses and identify exposed or vulnerable systems, potentially as a precursor to targeted exploitation," threat

 Feed

Cybersecurity researchers have shed light on a new China-linked threat actor called Earth Alux that has targeted various key sectors such as government, technology, logistics, manufacturing, telecommunications, IT services, and retail in the Asia-Pacific (APAC) and Latin American (LATAM) regions. "The first sighting of its activity was in the second quarter of 2023; back then, it was

 Feed

Are your security tokens truly secure? Explore how Reflectiz helped a giant retailer to expose a Facebook pixel that was covertly tracking sensitive CSRF tokens due to human error misconfigurations. Learn about the detection process, response strategies, and steps taken to mitigate this critical issue. Download the full case study here.  By implementing Reflectiz's recommendations, the

 Feed

Exposed PostgreSQL instances are the target of an ongoing campaign designed to gain unauthorized access and deploy cryptocurrency miners. Cloud security firm Wiz said the activity is a variant of an intrusion set that was first flagged by Aqua Security in August 2024 that involved the use of a malware strain dubbed PG_MEM. The campaign has been attributed to a threat actor Wiz tracks as

 Feed

On the 21st birthday of Gmail, Google has announced a major update that allows enterprise users to send end-to-end encrypted (E2EE) to any user in any email inbox in a few clicks. The feature is rolling out starting today in beta, allowing users to send E2EE emails to Gmail users within an organization, with plans to send E2EE emails to any Gmail inbox in the coming weeks and to any email inbox

 Feed

A new sophisticated phishing-as-a-service (PhaaS) platform called Lucid has targeted 169 entities in 88 countries using smishing messages propagated via Apple iMessage and Rich Communication Services (RCS) for Android. Lucid's unique selling point lies in its weaponizing of legitimate communication platforms to sidestep traditional SMS-based detection mechanisms. "Its scalable,

 AI

In episode 44 of The AI Fix, ChatGPT won’t build a crystal meth lab, GPT-4o improves the show’s podcast art, some students manage to screw in a lightbulb, Google releases Gemini 2.5 Pro Experimental and nobody notices, and Mark invents a clock for measuring AI time. Graham explains how ChatGPT’s love for Young   show more ...  

Adult fiction can be used to turn it into an evil malware developer, and Mark looks at the ARC-AGI-2 benchmark and a staggering leap forward in AI intelligence. All this and much more is discussed in the latest edition of "The AI Fix" podcast by Graham Cluley and Mark Stockley.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team Most people think of the internet as a globally connected resource. However, user experiences are not necessarily as consistent as they believe. Factors such as politics, regulations and censorship have made the internet a fragmented “splinternet” for   show more ...  

some users. What are the potential implications for cybersecurity? Changes in Social […] La entrada How Will the Splinternet Impact Cybersecurity – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team The average cost of a data breach surged to $4.88 million from $4.45 million in 2023, a 10% surge and the biggest increase since the pandemic, as per a report by IBM (Cost of a Data Breach Report 2024). To counter the rising impact, 2 out of 3   show more ...  

organizations are massively […] La entrada How AI is Transforming the Fight Against Data Breaches – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.exponential-e.com – Author: Graham Cluley A UK firm has been hit by a £3.07 million fine after being hit by a ransomware attack that exposed sensitive data related to almost 80,000 people, and disrupted NHS services. The fine imposed by the Information Commissioner’s Office (ICO) confirms   show more ...  

that managed service provider Advanced Computer Software Group […] La entrada £3 million fine for healthcare MSP with sloppy security after it was hit by ransomware attack – Source: www.exponential-e.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Smart Licensing Utility flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Smart Licensing Utility   show more ...  

vulnerability, tracked as CVE-2024-20439, to its Known Exploited Vulnerabilities (KEV) catalog. Last week, Cisco disclosed two vulnerabilities […] La entrada U.S. CISA adds Cisco Smart Licensing Utility flaw to its Known Exploited Vulnerabilities catalog – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini Russia-linked Gamaredon targets Ukraine with a phishing campaign using troop-related lures to deploy the Remcos RAT via PowerShell downloader. Talos researchers warn that Russia-linked APT group Gamaredon (a.k.a. Armageddon, Primitive Bear, ACTINIUM,   show more ...  

Callisto) targets Ukraine with a phishing campaign. The cyberespionage group is behind a long series of spear-phishing attacks […] La entrada Russia-linked Gamaredon targets Ukraine with Remcos RAT – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini CoffeeLoader is a sophisticated malware that uses numerous techniques to bypass security solutions, Zscaler ThreatLabz warns. Zscaler ThreatLabz discovered CoffeeLoader, a malware family active since September 2024, that uses multiple techniques to evade   show more ...  

endpoint security while downloading second-stage payloads. The advanced techniques used by the malware include GPU-based packing, […] La entrada CoffeeLoader uses a GPU-based packer to evade detection – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: securityaffairs.com – Author: Pierluigi Paganini Morphing Meerkat phishing kits exploit DNS MX records to deliver spoofed login pages, targeting over 100 brands. Infoblox researchers discovered a new phishing-as-a-service (PhaaS) platform that generated multiple phishing kits, called Morphing Meerkat,   show more ...  

using DNS mail exchange (MX) records to deliver fake login pages and targeting over 100 brands. […] La entrada Morphing Meerkat phishing kits exploit DNS MX records – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Ionut Arghire Malicious hackers have been caught hiding their WordPress malware in the ‘mu-plugins’ directory to evade routine security checks, according to a warning issued by Sucuri. The mu-plugins, short for Must-Use plugins, are automatically loaded on every page,   show more ...  

do not require activation, and do not appear in the standard WordPress […] La entrada Threat Actors Deploy WordPress Malware in ‘mu-plugins’ Directory – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Trevin Edgeworth Measure twice, cut once. I’m sure this timeless mantra has not only been used, but proven frustratingly true on multiple occasions for everyone reading this column. In today’s data-rich world, it’s also advice that is more broadly applicable in   show more ...  

business than ever before. However, in security the equation is […] La entrada Zero to Hero – A “Measured” Approach to Building a World-Class Offensive Security Program – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Ionut Arghire A threat actor has published approximately 270,000 customer records allegedly stolen from Samsung Germany’s ticketing system, cybersecurity firm Hudson Rock reports. The threat actor behind the leak, who uses the name ‘GHNA’, apparently gained access to   show more ...  

Samsung’s system using the stolen credentials of a Spectos GmbH account used for […] La entrada Hacker Leaks Samsung Customer Data – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Eduard Kovacs The European Commission announced on Friday that €1.3 billion ($1.4 billion) will be allocated for cybersecurity, artificial intelligence and digital skills. The investment, part of the Digital Europe Programme for 2025-2027, aims to drive digital   show more ...  

technology advancements in the European Union.  Part of the €1.3 billion funding will be […] La entrada Part of EU’s New €1.3 Billion Investment Going to Cybersecurity – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Android malware

Source: www.securityweek.com – Author: Ionut Arghire A newly identified mobile banking trojan targeting Android users has advanced device takeover capabilities and remote-control functionality, fraud prevention firm ThreatFabric warns. Dubbed Crocodilus, the trojan contains powerful capabilities, including   show more ...  

remote control of the infected device, advanced data harvesting, keylogging, and support for overlay attacks. It has been observed […] La entrada ‘Crocodilus’ Android Banking Trojan Allows Device Takeover, Data Theft – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CISA

Source: www.securityweek.com – Author: Ionut Arghire The US cybersecurity agency CISA on Friday published its analysis of the malware used by Chinese hackers in attacks exploiting an Ivanti Connect Secure zero-day patched in January 2025. The issue, tracked as CVE-2025-0282 (CVSS score of 9.0), is described as   show more ...  

a stack-based buffer overflow enabling attackers to execute […] La entrada CISA Analyzes Malware Used in Ivanti Zero-Day Attacks – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 borders

Source: www.schneier.com – Author: Bruce Schneier I have heard stories of more aggressive interrogation of electronic devices at US border crossings. I know a lot about securing computers, but very little about securing phones. Are there easy ways to delete data—files, photos, etc.—on phones so it can’t   show more ...  

be recovered? Does resetting a phone to factory […] La entrada Cell Phone OPSEC for Border Crossings – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Waqas. A hacker operating under the alias “CoreInjection” is claiming responsibility for the breach of Israeli cybersecurity company Check Point, alleging access to sensitive internal data and network systems. The hacker published their claims on Breach Forums on Sunday, March   show more ...  

30, 2025, and announced the sale of the stolen content for […] La entrada Hacker Claims Breach of Check Point Cybersecurity Firm, Sells Access – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

For National Arab American Heritage Month, SWE recognizes some of the Arab women engineers making their mark in the industry. Source Views: 0 La entrada Celebrating Women in Engineering in the Arab World se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Explore this new resource that helps SWE Sections select future leaders. Source Views: 0 La entrada Guiding the Future: The SWE Section Election Manual se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

After a 14-year career break, Michelle Johnston returned to the engineering workforce after meeting her employer at the WE22 Career Fair! Read her story and learn more about our reentry resources for engineers. Source Views: 0 La entrada How Mechanical Engineer Michelle Johnston Returned to Work After a Career Break se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

As a Senior Scientist in R&D at Henkel, Maxine shares her unique career journey and discusses career paths in the personal care industry for engineers. Source Views: 0 La entrada Engineering Careers in Hair Care: Meet Maxine Tomlinson se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 APT

Source: socprime.com – Author: Veronika Telychko The russia-linked Gamaredon APT notorious for a wealth of cyber-offensive operations against Ukraine resurfaces in the cyber threat arena. The ongoing Gamaredon adversary campaign against Ukraine leverages malicious LNK files disguised as war-related lures to   show more ...  

deploy the Remcos backdoor and applies sophisticated techniques, such as DLL sideloading. Detect Gamaredon […] La entrada Gamaredon Campaign Detection: russia-backed APT Group Targets Ukraine Using LNK Files to Spread Remcos Backdoor – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Exposed PostgreSQL instances are the target of an ongoing campaign designed to gain unauthorized access and deploy cryptocurrency miners. Cloud security firm Wiz said the activity is a variant of an intrusion set that was first flagged by Aqua Security in August 2024 that   show more ...  

involved the use of a malware […] La entrada Over 1,500 PostgreSQL Servers Compromised in Fileless Cryptocurrency Mining Campaign – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . On the 21st birthday of Gmail, Google has announced a major update that allows enterprise users to send end-to-end encrypted (E2EE) to any user in any email inbox in a few clicks. The feature is rolling out starting today in beta, allowing users to send E2EE emails to Gmail   show more ...  

users […] La entrada Enterprise Gmail Users Can Now Send End-to-End Encrypted Emails to Any Platform – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . A new sophisticated phishing-as-a-service (PhaaS) platform called Lucid has targeted 169 entities in 88 countries using smishing messages propagated via Apple iMessage and Rich Communication Services (RCS) for Android. Lucid’s unique selling point lies in its   show more ...  

weaponizing of legitimate communication platforms to sidestep traditional SMS-based detection mechanisms. “Its scalable, Original […] La entrada Lucid PhaaS Hits 169 Targets in 88 Countries Using iMessage and RCS Smishing – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-04
Aggregator history
Tuesday, April 01
TUE
WED
THU
FRI
SAT
SUN
MON
AprilMayJune