Oktacron - Cyber Security RSS Feeds History

MITRE CVE Contract Extended Just Before Expiration

cyberexpress Apr 16, 2025 Cyber News

The Common Vulnerabilities and Exposures (CVE) Program is one of the most central programs in cybersecurity, so news that MITRE’s contract to run the program was expiring sent shock waves through the cybersecurity community on April 15. But fears for the future of the globally recognized program underpinning show more ...

vulnerability management were assuaged when CISA announced today that it was extending the MITRE CVE contract. The extension apparently is for 11 months, sources told The Cyber Express. In a statement today to The Cyber Express, a spokesperson for the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said: “The CVE Program is invaluable to cyber community and a priority of CISA. Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We appreciate our partners’ and stakeholders’ patience.” It’s not clear what the long-term future of the CVE program will be – CISA had floated the idea of bringing it in-house despite its own budget and staffing cuts – but at least for now, the program will continue as is. MITRE CVE Contract Raises Cybersecurity Concerns The panic started on April 15 with news of a letter to the CVE Board from Yosry Barsoum, Vice President and Director of MITRE’s Center for Securing the Homeland, warning of the contract’s imminent expiration. “If a break in service were to occur, we anticipate multiple impacts to CVE, including deterioration of national vulnerability databases and advisories, tool vendors, incident response operations, and all manner of critical infrastructure,” Barsoum wrote (image below). [caption id="attachment_102101" align="aligncenter" width="800"] MITRE CVE contract letter[/caption] MITRE released this statement in response to media inquiries: “On Wednesday, April 16, 2025, funding for MITRE to develop, operate, and modernize the Common Vulnerabilities and Exposures (CVE) Program and related programs, such as the Common Weakness Enumeration (CWE) Program, will expire. The government continues to make considerable efforts to support MITRE’s role in the program and MITRE remains committed to CVE as a global resource.” MITRE noted how valuable the program is to a wide range of cybersecurity services: “The CVE Program anchors a growing cybersecurity vendor market worth more than $37 billion, providing foundational data to vendor products across vulnerability management, cyber threat intelligence, security information and event management, and endpoint detection and response.” MITRE said historical CVE records will be available on GitHub at https://github.com/CVEProject, and also directed those seeking more information to visit the official CVE.org website. In response to news of the 11-month contract extension, Barsoum released the following statement today: "Thanks to actions taken by the government, a break in service for the Common Vulnerabilities and Exposures (CVE) Program and the Common Weakness Enumeration (CWE) Program has been avoided. As of Wednesday morning, April 16, 2025, CISA identified incremental funding to keep the Programs operational. We appreciate the overwhelming support for these programs that have been expressed by the global cyber community, industry, and government over the last 24 hours. The government continues to make considerable efforts to support MITRE’s role in the program and MITRE remains committed to CVE and CWE as global resources." CVE Foundation, EU Vulnerability Database Launched Amid the uncertainty, a non-profit CVE Foundation has been launched by several CVE Board members "to ensure the long-term viability, stability, and independence of the Common Vulnerabilities and Exposures (CVE) Program." The new CVE Foundation will focus solely on continuing the mission of delivering high-quality vulnerability identification and maintaining the integrity and availability of CVE data for defenders worldwide," the group stated. “CVE, as a cornerstone of the global cybersecurity ecosystem, is too important to be vulnerable itself,” stated Kent Landfield, an officer of the Foundation. “Cybersecurity professionals around the globe rely on CVE identifiers and data as part of their daily work—from security tools and advisories to threat intelligence and response. Without CVE, defenders are at a massive disadvantage against global cyber threats.” The EU also launched its own vulnerability database in response to the uncertainty. Easterly: Serious Implications for Business Risk In an April 15 post on LinkedIn, former CISA Director Jen Easterly said news of the MITRE contract expiration was “rightly raising alarms across the cybersecurity community. While this may sound like a technical issue, it has SERIOUS implications for business risk, operational resilience, and national security.” “The CVE system may not make headlines, but it is one of the most important pillars of modern cybersecurity,” she added. Any disruption would also come amid an enduring backlog in processing CVEs in the National Vulnerability Database (NVD) at the National Institute of Standards and Technology (NIST). With more than 40,000 new vulnerabilities discovered last year, NIST continues to struggle with the volume of new vulnerabilities.

North Korean Hackers Targeted Nearly 18,000 in Phishing Campaign During Martial Law Turmoil

cyberexpress Apr 16, 2025 Cyber News

North Korean hackers sent more than 120,000 phishing emails to nearly 18,000 individuals over a three-month campaign that impersonated South Korea’s Military Counterintelligence Command's communication during the Martial Law turmoil, the National Police Agency said Wednesday. The campaign began in November 2024 show more ...

and continued through January 2025, targeting professionals in the unification, defense, national security, and foreign affairs sectors. Police confirmed North Korea's involvement through forensic analysis of the phishing infrastructure, IP addresses, and language patterns tied to past operations. “Our investigation has confirmed that North Korea was behind the emails distributed on Dec. 11, 2024, bearing the subject line, ‘Disclosure of Defense Counterintelligence Command Martial Law Documents,’” Kim Young-woon, head of the agency’s cyber terrorism unit, said during the press briefing. “Historically, North Korea would send hand-crafted emails impersonating analysts or experts, offering geopolitical forecasts or New Year’s speech analyses,” Kim said. “Now, they’ve automated the process, enabling mass distribution.” Authorities said at least 570 individuals clicked on the phishing bait and likely exposed sensitive data, including emails and contact lists. Recycled Infrastructure and Targeted Deception The hackers used 15 overseas servers rented through foreign providers and deployed custom-built malware capable of tracking real-time metrics. Investigators said the malware that looked to be an info-stealer monitored whether emails were opened, if users clicked on embedded links, and whether they submitted account credentials. North Korea reused servers previously identified in earlier state-backed cyberattacks. The infrastructure also showed evidence of searches for North Korean defector data and South Korean military information. Browser logs included North Korean dialects, strengthening attribution. Each phishing email mimicked government alerts or official communication. Subject lines included fake military documents, New Year’s policy analyses, and even invitations to concerts by South Korean celebrities. Others posed as tax refunds, horoscope readings, or health advisories. Deceptive Links Spread Under the Guise of Martial Law Deployment The emails directed users to spoofed login portals that closely resembled major South Korean web services like Naver, Kakao, and even Google. Domains included subtle misspellings or character swaps—such as googlauth.com, naver-auth.com, or baernin.com. Many email addresses appeared to come from government domains or closely resembled personal contacts. Spoofing methods included: Adding terms like -news, -noreply, or -report to legitimate domains. Mimicking friends’ or colleagues’ addresses with subtle variations (e.g., adding a single letter). Using lookalike domain names with common misspellings (m as rn, or co.kr altered to co.kro.kr). Out of the 17,744 recipients, 120 individuals fell for the phishing attempt, entering their credentials and granting attackers access to inbox contents and stored contact information. Warnings to the Public The South Korean government urged the public to remain vigilant against phishing threats, especially those disguised as official communication. Authorities advised against opening unfamiliar emails, clicking suspicious links, or downloading unverified attachments. “Never input your ID or password without verifying the legitimacy of the request,” the police warned. “Look carefully at the email sender and website domain. Even minor differences can signal fraud.” Officials also recommended regularly reviewing account login histories and enabling multi-factor authentication wherever possible. A Coordinated, Persistent Threat The investigation showed that the phishing campaign was both well-organized and sustained, reflecting a broader pattern in North Korea’s cyber playbook. Previous incidents linked to Pyongyang include attacks on cryptocurrency platforms, espionage efforts targeting defense sectors, and global disinformation operations. South Korean authorities reiterated their readiness to respond decisively to any form of cyber aggression. The police pledged enhanced coordination with international partners and local cybersecurity agencies. “We are mobilizing our full law enforcement capability,” the Police chief said. “Cyberthreats, especially those linked to hostile nations, will be met with swift and strong responses.” Public Disclosure Justified Under South Korea’s Public Information Rules on Criminal Investigations, the case was disclosed to the media to help prevent similar attacks. The government cited two justifications: The need to prevent recurrence by informing the public of phishing tactics. The importance of limiting the spread of harm by raising awareness. This disclosure falls in line with past efforts to inform citizens of advanced cyber threats, particularly those involving national security and public institutions. Ongoing Investigations The investigation remains open as cybersecurity experts continue tracking North Korea’s infrastructure and tactics. South Korea’s Cyber Terror Response Division is working closely with the Korea Internet & Security Agency (KISA) and other international stakeholders. Police urged anyone who suspects they received a spoofed message to report it immediately to national authorities and avoid interacting with the email in any way. “Cybersecurity is a collective effort,” said the Police said. “Every report helps us build a stronger defense against these malicious campaigns.”

AI-Driven Human Hacking is a New Frontier in Cybersecurity

cyberexpress Apr 16, 2025 Cyber News

By Associate Professor Dr. Sheeba Armoogum, University of Mauritius In 2025, the paradigms of human hacking are undergoing a substantial transformation due to the influence of artificial intelligence (AI). While traditional social engineering tactics exploit the psychological vulnerabilities inherent in individuals, show more ...

AI-driven human hacking introduces a markedly more sophisticated methodology that not only manipulates human behavior but also automates and scales this manipulation to previously unimaginable extents. AI transcends simple replication of human behavior; it adapts to it, assimilates knowledge from it, and tailors its attacks to each individual in real-time, thereby rendering traditional social engineering techniques obsolete in terms of efficiency and effectiveness. The manipulation of individuals through AI goes beyond merely imitating authoritative figures or simply exploiting trust. It uses advanced AI capabilities, such as machine learning, natural language processing, and complex data analytics, to mislead, control, and influence human behavior. The rise of AI-enhanced attacks signifies a significant evolution in the strategies used by cybercriminals to exploit human vulnerabilities, thus presenting a considerable challenge to traditional cybersecurity measures that depend on human intuition and behavioral patterns. The Mechanism of AI-Driven Human Hacking Fundamentally, AI-driven human manipulation uses machine learning algorithms to analyze extensive datasets, identify patterns, and predict human behavior with exceptional precision. These systems do not rely exclusively on pre-established scripts or anticipated psychological triggers; instead, they perpetually adapt, learn, and evolve, which substantially enhances their resistance to detection and countermeasures. AI is transforming the dynamics of human hacking by: Hyper-Personalized Manipulation: Traditional social engineering tactics often rely on broad approaches, such as phishing emails or misleading phone calls, which exploit common psychological tendencies like trust and fear. However, the rise of AI significantly enhances the capability to personalize these tactics to extraordinary degrees. By utilizing data mining techniques, machine learning algorithms can analyze an individual’s online activities, preferences, social media interactions, and professional histories, crafting messages or actions that appear remarkably relevant to that person. This advanced hyper-personalization creates a strong sense of authenticity, making the attack nearly indistinguishable from a legitimate request or interaction. AI systems can collect data from social media to determine a person's hobbies, job titles, recent activities, and personal connections. With this information, cybercriminals can create highly personalized phishing emails that correspond with the individual’s circumstances, such as a message from a manager about a recently discussed project or an alert from a service provider featuring a customized offer based on recent purchases. As a result, these communications appear both credible and urgent, significantly increasing the likelihood that the scam will deceive the target. Automated Conversations and Behavioral Mimicry: AI has advanced to engage in dynamic and continuous dialogues, closely emulating human behavior with remarkable precision. By analyzing patterns in written text or spoken language, AI models can replicate an individual’s writing style, tone, and emotional cues including urgency, empathy, and informality. This advancement enables cybercriminals to exploit chatbots or voice assistants that can conduct conversations that appear both natural and credible. In voice phishing, commonly referred to as " vishing" or AI-generated voice deepfakes, AI algorithms analyze extensive audio recordings of an individual’s voice, resulting in remarkably accurate replication. Attackers can then impersonate trusted individuals, such as corporate executives or family members, using this synthesized voice to request sensitive information or execute financial transactions. These AI-driven interactions are indistinguishable from genuine human communication, presenting an unprecedented challenge to traditional verification methods. Predictive Human Behavior Modeling: Machine learning algorithms utilize static datasets and dynamic, real-time information. By analyzing individuals' actions and responses during interactions, AI systems can anticipate the likely behaviors of subjects and adapt their approaches accordingly. This predictive capability enables attackers to manipulate the trajectory of conversations or interactions based on the emotional or cognitive states of those involved. For example, suppose an attacker recognizes that an individual tends to respond positively to feelings of urgency or fear. In that case, they can continuously adjust the content of a message or the timing of a phone call to align with the victim’s emotional state. AI can even analyze social media posts, online activities, and past conversations to identify the most advantageous moment to act- either during a particularly stressful time in the victim's life or when they are more likely to feel distracted or vulnerable. Exploiting Cognitive Biases on a Massive Scale: AI's true capabilities in influencing human behavior are rooted in its ability to exploit cognitive biases- those automatic, unconscious mental shortcuts individuals use in their decision-making processes. Whether it involves the tendency to trust authority figures, the intrinsic need to reciprocate favors, or the inclination to avoid cognitive dissonance, AI systems can identify and enhance these biases in real time. In a more advanced scenario, attacks driven by AI can engage in “nudging,” a concept that originates from behavioral economics. This approach involves implementing subtle yet significant modifications in the presentation of information, which can influence decision-making processes without the individual being consciously aware of such manipulation. For example, an AI system could formulate a communication that instils a sense of urgency, as exemplified by the statement, “Only 10 slots remain!” This tactic can evoke the recipient’s concern regarding potential loss, commonly referred to as the Fear Of Missing Out (FOMO), thereby compelling them to act impulsively without adequate consideration of the consequences. The Implications of Deepfake Technology and Psychological Manipulation: AI-driven deepfake technologies represent one of the most concerning advancements in human manipulation. Utilizing sophisticated deep learning methodologies, AI systems can produce highly realistic video and audio representations of individuals, thereby enabling cybercriminals to impersonate trustworthy figures with alarming authenticity. Deepfakes technology is particularly adept at circumventing conventional methods of identity verification, as it exploits the inherent trust individuals place in visual and auditory stimuli. Consider a scenario in which a cybercriminal uses a deepfake technology to impersonate a high-ranking company official, sending an employee a message that appears to come directly from the Chief Executive Officer. This deepfake may direct the employee to facilitate the transfer of funds or to grant access to sensitive company information. Given the seemingly genuine nature of the message, the recipient is considerably more inclined to comply, particularly if they have an inherent trust in the individual who appears to be issuing the request. Scalable Attacks: One of the most alarming aspects of AI in the context of human hacking is its capacity for scalability. Traditional social engineering attacks require a significant amount of manual effort to craft individual messages, initiate phone calls, or conduct research on each victim. In contrast, AI has the potential to automate and enhance these activities. By utilizing machine learning algorithms, AI systems can perform thousands, or even millions, of personalized attacks concurrently, effectively targeting individuals across a diverse range of platforms and communication channels, including electronic mail, social media, and voice communication. The substantial magnitude of these AI-driven attacks significantly amplifies the threat. A single attack has the capacity to target a wide range of victims with minimal effort, and the speed at which AI can adapt and enhance its tactics makes it challenging for victims to identify and react to the attack in time. Ethical Implications of AI-Driven Human Hacking The emergence of AI-driven human manipulation prompts significant ethical considerations. While traditional social engineering techniques depend on deception and manipulation, AI introduces a new dimension of complexity and moral ambiguity. The following are some principal ethical concerns: Invasion of Privacy: AI-driven techniques for human manipulation frequently involve the acquisition of extensive personal data from both public and private sources. This situation prompts significant concerns regarding consent, privacy, and the ethical application of personal information. Through the utilization of AI to gather and analyze personal data, attackers can infringe upon an individual's privacy on an unprecedented scale, often without their knowledge or authorization. Psychological Manipulation: AI can influence over emotions and decision-making processes in ways that are both subtle and powerful. By predicting the responses of individuals to various stimuli, AI systems can guide human behavior without conscious awareness. This situation engenders significant concerns regarding the ethical implications of using AI to exploit human vulnerabilities for harmful purposes. Accountability: As AI becomes more involved in human hacking, the issue of accountability becomes increasingly complex. Who bears the responsibility when an AI system is exploited for malicious purposes? Is it the developers of the AI, the users, or the system itself? As AI systems gain more autonomy, determining liability in cases of AI-driven human hacking could present a considerable legal challenge. Security versus Privacy: An ongoing debate exists regarding the balance between enhancing security measures and safeguarding privacy rights. Techniques associated with AI in human hacking exploit personal data, which can potentially lead to the erosion of privacy rights. However, AI’s ability to strengthen security frameworks and identify vulnerabilities also makes it a valuable tool in cybersecurity. The ethical dilemma lies in using AI responsibly, ensuring it enhances security without compromising individual privacy rights. AI-driven human hacking represents a transformative era in the persistent conflict between cybersecurity and cybercrime. By employing advanced technologies, including machine learning, predictive modeling, and the generation of deepfake content, attackers are capable of manipulating individuals with unprecedented scale and precision. As these threats continue to evolve, it is essential for our understanding of cybersecurity defenses to progress accordingly. We must move beyond traditional tactics and embrace innovative, AI-driven solutions to effectively counter these sophisticated assaults. Simultaneously, it is crucial to address the ethical implications of AI in human hacking, ensuring that privacy, accountability, and human dignity remain paramount in our cybersecurity strategies.

4Chan Outage Sparks Cyberattack Rumors and Data Leak Concerns

cyberexpress Apr 16, 2025 Firewall Daily

On April 14, 2025, 4Chan, the infamous anonymous image board, experienced downtime due to unexplained outages that left users frustrated and speculating about the cause. While the exact reason for the downtime remains uncertain, some users have suggested that a cyberattack or hacking incident could be responsible. show more ...

According to DownDetector, a service that monitors website disruptions, a surge in user reports highlighted the problems with 4Chan. The issues were largely related to the website itself (72%), server connections (24%), and posting (4%). These reports spiked around 10 p.m. on April 14 and continued into the next day, with many users complaining that 4Chan was intermittently down for hours. 4Chan Hacking and Leaked Data Raise Concerns [caption id="attachment_102086" align="alignnone" width="945"] Downdetector showing outage data for 4Chan (Source: Downdetector)[/caption] As the outage continued, several screenshots allegedly showing 4Chan’s backend surfaced on social media. These images appeared to display source code, templates for banning users, and a list of moderators and "janitors"—users with limited administrative rights. The leaked data even included personal information like email addresses tied to 4Chan moderators, sparking further suspicion that the site had been hacked. These leaks appeared to coincide with the downtime, leading to increased speculation about a potential cyberattack on 4Chan. 4Chan's Controversial History with Cyberattacks 4Chan has long been associated with controversy and cyberattacks. The platform, which offers complete anonymity for users to post images and text, has repeatedly been the subject of boycotts, both from users and advertisers, as well as accusations that it hosts hate speech and illegal content. It has even been linked to inspiring mass shootings and other violent events. Additionally, users on 4Chan have been involved in planning cyberattacks, including Distributed Denial-of-Service (DDoS) campaigns. On top of that, 4Chan has been home to the propagation of conspiracy theories, some of which have led to real-world consequences, such as the January 6 insurrection at the U.S. Capitol. Given its reputation, the recent downtime and the potential cyberattack on 4Chan have fueled further rumors about the platform's vulnerability. Some users have speculated that the site was breached, while others believe it could be a result of long-standing software vulnerabilities that 4Chan has yet to address. Alleged Hack and Doxxing The rumors surrounding the potential cyberattack gained traction after a previously banned 4Chan board briefly reappeared online, followed by a defacing message that read, "U GOT HACKED XD." Shortly thereafter, an online account on a rival forum, Soyjak.party, posted screenshots allegedly revealing parts of 4Chan's backend systems, including usernames and email addresses of 4Chan’s administrators and moderators. These leaks quickly escalated into a wave of doxxing, where users shared personal details of the 4Chan staff, including photos and other private information. Though the validity of these claims remains unclear, TechCrunch reported that one 4Chan moderator believed the leak and cyberattack were genuine. Despite multiple attempts, WIRED could not reach 4Chan for an official statement, further deepening the uncertainty surrounding the incident. Conclusion The recent alleged cyberattack on 4Chan highlights the platform’s ongoing struggles with outdated software, security vulnerabilities, and its controversial reputation. Despite previous reassurances from the site's founder, Christopher Poole, regarding security improvements, it appears that 4Chan's legacy of hosting questionable content and attracting extremist users has left it susceptible to breaches. Over the years, the platform's transformation from a niche space for anime fans to a hub for more nefarious activities has only deepened its notoriety. While the exact cause of the recent attack remains unclear, it is evident that 4Chan continues to face security challenges, not just in terms of securing its infrastructure but also in managing its reputation.

Funding Expires for Key Cyber Vulnerability Database

krebsonsecurity Apr 16, 2025 A Little Sunshine

A critical resource that cybersecurity professionals worldwide rely on to identify, mitigate and fix security vulnerabilities in software and hardware is in danger of breaking down. The federally funded, non-profit research and development organization MITRE warned today that its contract to maintain the Common show more ...

Vulnerabilities and Exposures (CVE) program — which is traditionally funded each year by the Department of Homeland Security — expires on April 16. A letter from MITRE vice president Yosry Barsoum, warning that the funding for the CVE program will expire on April 16, 2025. Tens of thousands of security flaws in software are found and reported every year, and these vulnerabilities are eventually assigned their own unique CVE tracking number (e.g. CVE-2024-43573, which is a Microsoft Windows bug that Redmond patched last year). There are hundreds of organizations — known as CVE Numbering Authorities (CNAs) — that are authorized by MITRE to bestow these CVE numbers on newly reported flaws. Many of these CNAs are country and government-specific, or tied to individual software vendors or vulnerability disclosure platforms (a.k.a. bug bounty programs). Put simply, MITRE is a critical, widely-used resource for centralizing and standardizing information on software vulnerabilities. That means the pipeline of information it supplies is plugged into an array of cybersecurity tools and services that help organizations identify and patch security holes — ideally before malware or malcontents can wriggle through them. “What the CVE lists really provide is a standardized way to describe the severity of that defect, and a centralized repository listing which versions of which products are defective and need to be updated,” said Matt Tait, chief operating officer of Corellium, a cybersecurity firm that sells phone-virtualization software for finding security flaws. In a letter sent today to the CVE board, MITRE Vice President Yosry Barsoum warned that on April 16, 2025, “the current contracting pathway for MITRE to develop, operate and modernize CVE and several other related programs will expire.” “If a break in service were to occur, we anticipate multiple impacts to CVE, including deterioration of national vulnerability databases and advisories, tool vendors, incident response operations, and all manner of critical infrastructure,” Barsoum wrote. MITRE told KrebsOnSecurity the CVE website listing vulnerabilities will remain up after the funding expires, but that new CVEs won’t be added after April 16. A representation of how a vulnerability becomes a CVE, and how that information is consumed. Image: James Berthoty, Latio Tech, via LinkedIn. DHS officials did not immediately respond to a request for comment. The program is funded through DHS’s Cybersecurity & Infrastructure Security Agency (CISA), which is currently facing deep budget and staffing cuts by the Trump administration. Former CISA Director Jen Easterly said the CVE program is a bit like the Dewey Decimal System, but for cybersecurity. “It’s the global catalog that helps everyone—security teams, software vendors, researchers, governments—organize and talk about vulnerabilities using the same reference system,” Easterly said in a post on LinkedIn. “Without it, everyone is using a different catalog or no catalog at all, no one knows if they’re talking about the same problem, defenders waste precious time figuring out what’s wrong, and worst of all, threat actors take advantage of the confusion.” John Hammond, principal security researcher at the managed security firm Huntress, told Reuters he swore out loud when he heard the news that CVE’s funding was in jeopardy, and that losing the CVE program would be like losing “the language and lingo we used to address problems in cybersecurity.” “I really can’t help but think this is just going to hurt,” said Hammond, who posted a Youtube video to vent about the situation and alert others. Several people close to the matter told KrebsOnSecurity this is not the first time the CVE program’s budget has been left in funding limbo until the last minute. Barsoum’s letter, which was apparently leaked, sounded a hopeful note, saying the government is making “considerable efforts to continue MITRE’s role in support of the program.” Tait said that without the CVE program, risk managers inside companies would need to continuously monitor many other places for information about new vulnerabilities that may jeopardize the security of their IT networks. Meaning, it may become more common that software updates get mis-prioritized, with companies having hackable software deployed for longer than they otherwise would, he said. “Hopefully they will resolve this, but otherwise the list will rapidly fall out of date and stop being useful,” he said.

Ransomware gang 'CrazyHunter' Targets Critical Taiwanese Orgs

darkreading Apr 16, 2025 Feed

Trend Micro researchers detailed an emerging ransomware campaign by a new group known as "CrazyHunter" that is targeting critical sectors in Taiwan.

Accounting Firms Can't Skimp on Cybersecurity

darkreading Apr 16, 2025 Feed

Cybercriminals capitalize on tax preparation stress, technology sprawl, and lax communications. Accounting teams can't afford to treat cybersecurity as an afterthought.

Multiple Groups Exploit NTLM Flaw in Microsoft Windows

darkreading Apr 16, 2025 Feed

The attacks have been going on since shortly after Microsoft patched the vulnerability in March.

Active Directory Recovery Can't Be an Afterthought

darkreading Apr 16, 2025 Feed

Active Directory is one of the most vulnerable access points in an organization's IT environment. Companies cannot wait for a real attack to pressure-test their AD recovery strategy.

Cloud, Cryptography Flaws in Mobile Apps Leak Enterprise Data

darkreading Apr 16, 2025 Feed

Cloud misconfigurations and cryptography flaws plague some of the top apps used in work environments, exposing organizations to risk and intrusion.

NIST Updates Privacy Framework With AI and Governance Revisions

darkreading Apr 16, 2025 Feed

The U.S. National Institute of Standards and Technology (NIST) updated its Privacy Framework to work cohesively with its Cybersecurity Framework and guide organizations to develop stronger postures to handle privacy risks..

China-Linked Hackers Lay Brickstorm Backdoors on Euro Networks

darkreading Apr 16, 2025 Feed

Researchers discovered new variants of the malware, which is tied to a China-nexus threat group, targeting Windows environments of critical infrastructure networks in Europe.

Patch Now: NVDIA Flaws Expose AI Models, Critical Infrastructure

darkreading Apr 16, 2025 Feed

A fix for a critical flaw in a tool allowing organizations to run GPU-accelerated containers released last year did not fully mitigate the issue, spurring the need to patch a secondary flaw to protect organizations that rely on NVIDIA processors for AI workloads.

MITRE warns of lapse with CVE program as contract with US set to expire

cyware Apr 16, 2025 Cybercrime

The MITRE Corporation said on Tuesday that its stewardship of the CVE program may be ending this week because the federal government has decided not to renew its contract with the nonprofit.

More than 100,000 had information stolen from Hertz through Cleo file share tool

cyware Apr 16, 2025 Cybercrime

Car rental giant Hertz has been notifying state regulators of a data breach that occurred through third-party file sharing software. Tens of thousands of people are affected, but the company hasn't specified a total number.

CISA extends CVE program contract with MITRE for 11 months amid alarm over potential lapse

cyware Apr 16, 2025 Cybercrime

“The CVE Program is invaluable to the cyber community and a priority of CISA,” a CISA spokesperson said. “We appreciate our partners’ and stakeholders’ patience.”

Chinese firm tied to Uyghur rights abuses now training Tibet police on hacking techniques

cyware Apr 16, 2025 Government

The digital forensics company known as Meiya Pico won a contract in mid-2023 to build two labs at the Tibet Police College: one on offensive and defensive cyber techniques and the other on electronic evidence collection and analysis.

British law firm fined after ransomware group publishes confidential client data

cyware Apr 16, 2025 Cybercrime

A U.K. law firm specializing in crime, family fraud, sexual offenses and other sensitive matters has been fined after a hack that led to a data leak on the dark web — something the company only learned about after authorities contacted it.

Sweden concludes that it cannot rule out sabotage over subsea cable break

cyware Apr 16, 2025 News

The Swedish Accident Investigation Authority said it was unable to determine whether the Yi Peng 3 had accidentally or purposefully damaged a submarine cable in the Baltic Sea.

CISA warns of potential data breaches caused by legacy Oracle Cloud leak

cyware Apr 16, 2025 Cybercrime

The Cybersecurity and Infrastructure Security Agency on Wednesday said that while the scope of the reported Oracle issue remains unconfirmed, it "presents potential risk to organizations and individuals."