News

News

• April 15, 2022 15 Apr'22

  Corvus: Ransomware costs, ransom payments declining

  Cyber insurance provider Corvus examined how the cost of ransomware attacks declined over the past year and a half and what it means for different industries moving forward.

• April 14, 2022 14 Apr'22

  Critical Windows RPC vulnerability raises alarm

  Security experts warn that a newly disclosed vulnerability in a critical Windows networking component is opening the door for remote takeover attacks.

• April 14, 2022 14 Apr'22

  VMware Workspace One flaw actively exploited in the wild

  Multiple threat intelligence providers have detected threat activity related to the VMware Workspace One flaw, including cryptocurrency mining activity.

• April 14, 2022 14 Apr'22

  US government, security vendors warn of new ICS malware

  As attacks on critical infrastructure increase, experts warn that threat actors have developed new malware designed to take control of ICS and SCADA systems in the energy sector.

• April 13, 2022 13 Apr'22

  Microsoft dismantles ZLoader botnet

  Microsoft and ESET security teams explained how they were able to identify and dismantle the command and control infrastructure of the notorious ZLoader malware network.

• April 13, 2022 13 Apr'22

  Sophos: LockBit affiliates hacked regional government agency

  Sophos said attackers spent at least five months inside an unnamed regional government agency's network, remotely Googling for hacking tools before deploying LockBit ransomware.

• April 12, 2022 12 Apr'22

  Ukraine energy grid hit by Russian Industroyer2 malware

  The 2016 malware known as 'Industroyer' has resurfaced in a new series of targeted attacks against industrial controller hardware at a Ukraine power company.

• April 12, 2022 12 Apr'22

  Synopsys: Enterprises struggling with open source software

  To curb open source risk, Synopsys advises enterprises to keep a comprehensive inventory of all software within its environment and to understand that securing open source requires strong management.

• April 12, 2022 12 Apr'22

  Law enforcement takedowns continue with RaidForums seizure

  The hacker forum, which used to sell and purchase sensitive information including login credentials, has been dismantled, and its alleged founder was arrested and indicted.

• April 11, 2022 11 Apr'22

  Apple Security Bounty improves, but problems remain

  Security researchers told SearchSecurity that Apple Security Bounty improved its communication earlier this year, which had been a key issue for participants.

• April 08, 2022 08 Apr'22

  Fin7 hacker sentenced to 5 years in prison

  A Ukrainian man has been sentenced to five years in prison after being convicted as one of the primary hackers behind the notorious Fin7 financial malware ring.

• April 07, 2022 07 Apr'22

  Government officials: AI threat detection still needs humans

  At the Ai4 Cybersecurity Summit, infosec professionals from CISA and the state of Tennessee discussed the promise and potential obstacles of AI for threat detection.

• April 07, 2022 07 Apr'22

  How the FBI took down the Cyclops Blink botnet

  The FBI's operation copied and removed Cyclops Blink's malware from victims' systems that were used as command and control devices, severing Sandworm's control of the botnet.

• April 06, 2022 06 Apr'22

  US sanctions Garantex for laundering over $100M

  The latest action follows a string of sanctions imposed during the past year against cryptocurrency exchanges operating out of Russia.

• April 06, 2022 06 Apr'22

  Conti ransomware leaks show a low-tech but effective model

  The Conti ransomware gang runs largely on elbow grease, according to Akamai security researchers who analyzed the group's training materials and operating policies.

• April 05, 2022 05 Apr'22

  German authorities behead dark web Hydra Market

  Police in Germany raided facilities hosting the infamous Hydra Market site as part of an international effort to crack down on dark web forums and marketplaces.

• April 05, 2022 05 Apr'22

  March ransomware attacks strike finance, government targets

  In March, ransomware reports and disclosures showed a variety of victims, from public schools and county governments to financial services firms and large enterprises.

• April 05, 2022 05 Apr'22

  Conti ransomware deployed in IcedID banking Trojan attack

  The Conti ransomware gang gained recent notoriety for publicly backing Russia in its invasion of Ukraine. An anonymous researcher then leaked massive amounts of internal Conti data.

• April 04, 2022 04 Apr'22

  Cryptocurrency companies targeted in Mailchimp breach

  Cryptocurrency wallet maker Trezor revealed phishing attacks against its customers that stemmed from a breach at Mailchimp, which the email marketing firm later confirmed.

• April 01, 2022 01 Apr'22

  CrowdStrike finds 'logging inaccuracies' in Microsoft 365

  CrowdStrike says Microsoft's cloud offering may not be accurately taking logs of user sign-ins, and that could pose a threat to protecting networks and investigating attacks.

• April 01, 2022 01 Apr'22

  Zimperium acquired by Liberty Strategic Capital for $525M

  Zimperium is the latest cybersecurity investment for Liberty Strategic Capital, a private equity firm founded by former Treasury Secretary Steven Mnuchin.

• March 31, 2022 31 Mar'22

  Spring Framework vulnerabilities sow confusion, concern

  Two different remote code execution vulnerabilities in a Java developer tool caused considerable confusion after one of the flaws was leaked online as a zero-day.

• March 31, 2022 31 Mar'22

  New 'AcidRain' malware may be connected to Viasat attack

  SentinelOne did not directly attribute the malware to the Viasat attack. That said, researchers argued the "AcidRain" malware's functionality matches open source intelligence.

• March 30, 2022 30 Mar'22

  Viasat confirms cyber attack on Ukraine customers

  The U.S.-based satellite internet provider said a 'multifaceted and deliberate cyber attack' struck Viasat's KA-SAT network on the first day of Russia's invasion of Ukraine.

• March 30, 2022 30 Mar'22

  Axie Infinity hack results in $600M cryptocurrency heist

  Axie Infinity, whose developer was hacked this month, is a popular NFT-based video game in which players earn cryptocurrency by raising their pay-to-play digital pets, or 'Axies.'

• March 29, 2022 29 Mar'22

  Rapid7 finds zero-day attacks surged in 2021

  Cybercriminals are turning bugs into exploits faster than ever, according to Rapid7, which found that the average time to known exploitation dropped 71% last year.

• March 29, 2022 29 Mar'22

  Cryptocurrency cyber attacks on the rise as industry expands

  Consumers, businesses and governments are finding new ways to use cryptocurrency, but a recent string of cyber attacks has highlighted security risks and shortcomings.

• March 25, 2022 25 Mar'22

  US indicts Russian nationals for critical infrastructure attacks

  One defendant is accused of deploying the infamous Trisis or Triton malware against energy-sector companies, including a petrochemical plant in Saudi Arabia in a 2017 attack.

• March 25, 2022 25 Mar'22

  Risk & Repeat: Lapsus$ highlights poor breach disclosures

  This Risk & Repeat podcast episode examines two high-profile breaches by emerging threat group Lapsus$ and how Microsoft and Okta responded to these attacks.

• March 24, 2022 24 Mar'22

  North Korean hackers exploited Chrome zero-day for 6 weeks

  Google researchers say a Chrome zero-day bug stemming from a use-after-free error was exploited by North Korean hackers against both media and financial targets earlier this year.

• March 24, 2022 24 Mar'22

  FBI: Ransomware hit 649 critical infrastructure entities in 2021

  The FBI's Internet Crime Complaint Center found ransomware was a top threat to critical infrastructure security in 2021, hitting a wide range of organizations.

• March 24, 2022 24 Mar'22

  Okta provides new details on Lapsus$ attack

  The authentication provider shed new light on how a customer service agent at subcontractor Sitel was hacked and then used to obtain data on hundreds of Okta clients.

• March 23, 2022 23 Mar'22

  Lawsuit claims Kronos breach exposed data for 'millions'

  A class-action lawsuit was filed against Ultimate Kronos Group for alleged negligence regarding a ransomware attack and private cloud breach in December.

• March 22, 2022 22 Mar'22

  Lapsus$ hacking group hit authentication vendor Okta

  Authentication vendor Okta is the latest tech giant to be named as a victim of the prolific Lapsus$ crew, through key details about the attack remain in dispute.

• March 22, 2022 22 Mar'22

  F-Secure splits in two as WithSecure launches

  The Finnish security vendor's enterprise business sets off on its own as a new brand called WithSecure, while F-Secure will continue to operate the consumer side of the business.

• March 22, 2022 22 Mar'22

  Biden: Russia exploring cyber attacks against US

  President Joe Biden's warning of potential Russian attacks against U.S. critical infrastructure is the latest call to action for the private sector to fortify its cyberdefenses.

• March 22, 2022 22 Mar'22

  STG launches Skyhigh Security from McAfee cloud assets

  The new company combines the McAfee Enterprise Security Service Edge portfolio with a name reminiscent of a previous McAfee acquisition: Skyhigh Networks.

• March 21, 2022 21 Mar'22

  Cryptocurrency companies impacted by HubSpot breach

  A compromised employee account at HubSpot led to the breach of several companies' customers in the cryptocurrency industry.

• March 17, 2022 17 Mar'22

  JavaScript apps hit with pro-Ukraine supply chain attack

  A popular JavaScript package was sabotaged by its developer and seeded with messages in support of Ukraine in what has become a supply chain attack.

• March 17, 2022 17 Mar'22

  Sandworm APT ramps up Cyclops Blink botnet with Asus routers

  Trend Micro discovered that the Cyclops Blink botnet, which had originally targeted WatchGuard devices, is now spreading to Asus and 'at least one other vendor.'

• March 16, 2022 16 Mar'22

  LokiLocker ransomware crew bursts onto the scene

  The mysterious LokiLocker ransomware group caught the attention of BlackBerry researchers, who say the outfit could become the next cybercrime group to menace enterprises.

• March 16, 2022 16 Mar'22

  FTC accuses CafePress of covering up 2019 data breach

  The proposed FTC settlement would require CafePress' former owner to pay $500,000 in compensation to customers who were victimized in the company's 2019 data breach.

• March 16, 2022 16 Mar'22

  Biden signs law on reporting critical infrastructure cyber attacks

  President Joe Biden signed a law that requires critical infrastructure entities to report cyber attacks within 72 hours and report ransom payments in 24 hours.

• March 15, 2022 15 Mar'22

  Container vulnerability opens door for supply chain attacks

  A CRI-O container engine vulnerability could allow attackers to bypass security controls and take over a host system, according to CrowdStrike researchers.

• March 15, 2022 15 Mar'22

  SentinelOne acquires Attivo Networks for $617M

  SentinelOne is acquiring Attivo Networks for a $616.5 million price tag and plans to merge the company's identity threat detection services with its XDR offering.

• March 15, 2022 15 Mar'22

  Infosec news cycles: How quickly do they fade?

  Google Trends spikes, on average, lasted a few weeks for major infosec news events like SolarWinds, Log4Shell and the Colonial Pipeline ransomware attack.

• March 14, 2022 14 Mar'22

  Cyber insurance war exclusions loom amid Ukraine crisis

  Changes in insurance exemptions for acts of war reflect an increase in damages caused to enterprises related to state-sponsored cyber attacks.

• March 10, 2022 10 Mar'22

  Log4Shell vulnerability continues to menace developers

  Months after it was first disclosed, the Log4j RCE vulnerability remains widespread on code-sharing sites and open source repositories, according to security researchers.

• March 09, 2022 09 Mar'22

  Researchers disclose new Spectre V2 vulnerabilities

  The Spectre class of data disclosure vulnerabilities is once again at the security forefront after researchers discovered a new variant of the side-channel attack.

• March 09, 2022 09 Mar'22

  Immersive Labs: Average cyberthreat response takes 96 days

  Immersive Labs' Cyber Workforce Benchmark found that some critical threats, including a zero-day vulnerability, took an average of six months to fully address.

• March 08, 2022 08 Mar'22

  FBI finds Ragnar Locker hit 52 U.S. critical infrastructure targets

  While providing an updated list of indicators of compromise, the FBI revealed that a range of critical sectors were attacked by the ransomware group.

• March 08, 2022 08 Mar'22

  Google to acquire Mandiant for $5.4B

  Google's acquisition announcement came less than a year after Mandiant and FireEye split. FireEye was sold to Symphony Technology Group last fall for $1.2 billion.

• March 08, 2022 08 Mar'22

  Researchers uncover vulnerabilities in APC Smart-UPS devices

  Researchers with Armis found a trio of vulnerabilities in uninterruptible power supply (UPS) devices from APC that could be remotely exploited by threat actors.

• March 07, 2022 07 Mar'22

  Samsung breached, Nvidia hackers claim responsibility

  Samsung said Galaxy device source code was stolen, but no employee or customer personal information was taken by the attackers, who appear to be with the Lapsus$ ransomware group.

• March 04, 2022 04 Mar'22

  Hackers using stolen Nvidia certificates to sign malware

  The recent breach of Nvidia's corporate network has resulted in the posting of valid software certificates that are now being used to spread malware in the wild.

• March 04, 2022 04 Mar'22

  Risk & Repeat: Conti ransomware gang gets breached

  This Risk & Repeat podcast episode covers the massive Conti leaks, including the data that was published and what it reveals about the infamous ransomware gang.

• March 04, 2022 04 Mar'22

  February ransomware attacks hit major enterprises

  Enterprises, colleges and municipalities in the U.S. continued to be hit by ransomware as publicly reported attacks for February piled up.

• March 03, 2022 03 Mar'22

  Intel touts security improvements in 12th-gen Core CPUs

  Intel is courting enterprises with a new line of Core vPro CPUs that boast improved security protections ranging from firmware and OS to memory.

• March 02, 2022 02 Mar'22

  CrowdStrike cracks PartyTicket ransomware targeting Ukraine

  CrowdStrike's analysis of the new ransomware, also known as HermeticRansom, that affected Ukrainian organizations revealed that files encrypted with PartyTicket are recoverable.

• March 01, 2022 01 Mar'22

  Conti ransomware source code, documentation leaked

  The Conti ransomware gang's primary Bitcoin address, found in the leak, showed the crime outfit has taken in over $2 billion in cryptocurrency since 2017.

• March 01, 2022 01 Mar'22

  Nvidia confirms breach, proprietary data leaked online

  Nvidia has confirmed some of the claims from a little-known ransomware gang that allegedly broke into the network of the GPU giant and stole corporate data.

• March 01, 2022 01 Mar'22

  HermeticWiper poses increasing cyber risk to Ukraine

  While it has not been attributed to a specific threat group, ESET researchers observed another data-wiping malware that targeted a Ukrainian organization and warned it could extend to allies.

• February 28, 2022 28 Feb'22

  Recorded Future: Russia may retaliate with cyber attacks

  Recorded Future warned U.S. and European organizations could be hit by 'spillover attacks' or intentional retaliatory strikes from Russia following its invasion of Ukraine.

• February 28, 2022 28 Feb'22

  Conti ransomware gang backs Russia, threatens U.S.

  The Conti ransomware gang announced last week that they were in 'full support' of Russia and would retaliate if the West attacked Russian critical infrastructure.

• February 25, 2022 25 Feb'22

  (ISC)2 study finds long remediation times for Log4Shell

  An (ISC)2 survey of cybersecurity professionals found Log4Shell remediation for many organizations took several weeks or more than a month, requiring work on weekends and holidays.

• February 25, 2022 25 Feb'22

  Researchers find access brokers focused on US targets

  Security vendors studied 'access broker' advertisements on the dark web, which provide ransomware groups with the network and system access required for data thefts.

• February 24, 2022 24 Feb'22

  New data wiper malware hits Ukraine targets

  HermeticWiper is similar to another data-wiping malware known as WhisperGate, which was used in cyber attacks against Ukraine last month. Both used ransomware as an apparent decoy.

• February 24, 2022 24 Feb'22

  New tech, same threats for Web 3.0

  Emerging technologies are prone to old-school social engineering attacks and credential-swiping techniques, according to Cisco Talos researchers who analyzed the new platforms.

• February 23, 2022 23 Feb'22

  US, UK attribute Cyclops Blink to Sandworm

  The group known for its use of VPNFilter malware has retooled with what is being tracked as Cyclops Blink, but its impact appears limited to WatchGuard business customers for now.

• February 23, 2022 23 Feb'22

  Dragos: Ransomware topped ICS and OT threats in 2021

  Whether ICS and OT networks were intentionally targeted or not, ransomware was found to be the No. 1 compromise to industrial organizations last year.

• February 23, 2022 23 Feb'22

  IBM: REvil dominated ransomware activity in 2021

  IBM X-Force's Threat Intelligence Index report also found a 'triple extortion' ransomware tactic in 2021, where threat actors use DDoS attacks to put extra pressure on victims.

• February 17, 2022 17 Feb'22

  FBI: BEC attacks spreading to virtual meetings

  Since the start of the COVID-19 pandemic, many workplaces have shifted to virtual meeting platforms, and the FBI warned that threat actors have taken note.

• February 17, 2022 17 Feb'22

  Snyk enters cloud security market with Fugue acquisition

  Analysts say the acquisition of Fugue will give Snyk an opportunity to build a presence in the cloud security market and strengthen its infrastructure-as-code capabilities.

• February 17, 2022 17 Feb'22

  SonicWall: Ransomware attacks increased 105% in 2021

  While 2021 represented a turning point for law enforcement and government action against ransomware, SonicWall still observed massive growth in attacks.

• February 16, 2022 16 Feb'22

  Kronos attack fallout continues with data breach disclosures

  Employees at both public and private sector organizations had their data compromised during a December ransomware attack on Kronos that also took down payroll systems.

• February 16, 2022 16 Feb'22

  Apache Cassandra vulnerability puts servers at risk

  Certain non-default configurations of the Apache Cassandra database software could leave the door open for remote code execution attacks, according to JFrog researchers.

• February 16, 2022 16 Feb'22

  Trickbot has infected 140,000-plus machines since late 2020

  In October 2020, Microsoft reported that more than 90% of Trickbot's infrastructure had been disabled. The threat actor bounced back and began thriving soon after.

• February 15, 2022 15 Feb'22

  Sophos discovers new attack targeting Exchange Servers

  A new type of attack that utilizes the Squirrelwaffle malware and business email compromise may be an issue for organizations that have not patched their Exchange servers.

• February 15, 2022 15 Feb'22

  CrowdStrike: Attackers are moving faster, harder to detect

  The CrowdStrike '2022 Global Threat Report' said attackers are getting better at exploiting vulnerabilities and moving through compromised networks before defenders can spot them.

• February 15, 2022 15 Feb'22

  Ransomware tied to attacks on critical infrastructure last year

  While recent law enforcement action may be altering the ransomware landscape, BlackBerry researchers observed high-profile attacks on critical infrastructure last year.

• February 14, 2022 14 Feb'22

  CISA says 'Shields Up' as Russia-Ukraine tensions escalate

  CISA said in its advisory that 'there are not currently any specific credible threats to the U.S. homeland,' but cited past Russian cyber attacks against Ukraine and others.

• February 14, 2022 14 Feb'22

  Fallout from REvil arrests shakes up ransomware landscape

  Russian authorities recently announced more than a dozen arrests of alleged REvil members, heightening concern among ransomware affiliates on the dark web.

• February 11, 2022 11 Feb'22

  FBI seized Colonial Pipeline ransom from DarkSide affiliate

  New research from Chainalysis claims the DarkSide ransomware affiliate involved in last year's Colonial Pipeline attack also had ties to the NetWalker ransomware operation.

• February 10, 2022 10 Feb'22

  DEF CON bans social engineering expert Chris Hadnagy

  Hadnagy, an influential figure at the DEF CON security conference, was permanently banned following allegations of misconduct at the annual Las Vegas gathering.

• February 10, 2022 10 Feb'22

  Why Massachusetts' data breach reports are so high

  Massachusetts discloses breaches of companies that affect just a single resident, giving the commonwealth a much larger number of 2021 incidents than other states.

• February 09, 2022 09 Feb'22

  Google: 2-step verification led to 50% fewer account hacks

  Google auto-enrolled more than 150 million users into two-step verification last October and mandated two-step verification for 2 million-plus YouTube accounts.

• February 09, 2022 09 Feb'22

  Ransomware groups shift from big game hunting

  A joint cybersecurity advisory documented top ransomware trends for 2021 and addressed ways for organizations to improve security.

• February 08, 2022 08 Feb'22

  Russia continues cybercrime offensive with SkyFraud takedown

  Officials in Russia have knocked the SkyFraud credit card fraud operation offline in the latest of a string of police actions against cybercriminals in the region.

• February 08, 2022 08 Feb'22

  DOJ recovers $3.6B from 2016 Bitfinex hack

  A couple was arrested Tuesday morning after the DOJ traced 120,000 bitcoin to a digital wallet containing funds stolen during the 2016 hack of cryptocurrency platform Bitfinex.

• February 08, 2022 08 Feb'22

  Microsoft disables VBA macros by default

  Microsoft's change in the default settings of five Office applications aims to shut down a widely used and longstanding threat vector to enterprises.

• February 07, 2022 07 Feb'22

  Metaverse rollout brings new security risks, challenges

  When companies and users decide to adapt the technologies of the coming metaverse, they will also expose themselves to a new class of security risks and vulnerabilities.

• February 07, 2022 07 Feb'22

  Wormhole offers $10M to Ethereum thieves

  Wormhole also offered $10 million to anyone who provided 'information leading to the arrest and conviction of those responsible' for last week's heist.

• February 03, 2022 03 Feb'22

  DHS forms first-ever Cyber Safety Review Board

  The new initiative is one in a string of many by the Biden administration to push public and private collaboration in addressing cyber threats such as Log4j vulnerabilities.

• February 03, 2022 03 Feb'22

  Cryptocurrency platform Wormhole loses $320M after attack

  After a threat actor made off with 120,000 wrapped Ethereum, Wormhole said the stolen cryptocurrency had been 'restored,' but what that means remains in question.

• February 03, 2022 03 Feb'22

  Distrust, feuds building among ransomware groups

  In an industry that operates in anonymity, trust is everything -- but recent accusations of ransomware actors working with or being law enforcement is threatening that work model.

• February 02, 2022 02 Feb'22

  SolarMarker malware spread through advanced SEO poisoning

  Sophos discovered SolarMarker malware was being distributed through fake SEO-focused topics in Google Groups, as well as malicious PDF files.

• February 02, 2022 02 Feb'22

  More than 1,000 malware packages found in NPM repository

  Researchers with WhiteSource were able to find some 1,300 examples of malware hiding under the guise of legitimate JavaScript packages on the NPM repository.

• February 01, 2022 01 Feb'22

  Iranian hacking groups pick up the pace with new attacks

  Two security vendors are reporting a fresh wave of targeted attacks and malware outbreaks believed to be the work of Iranian state-sponsored threat groups.

• February 01, 2022 01 Feb'22

  Ransomware attacks continue to plague public services

  Ransomware this year has picked up right where 2021 left off, with several local governments, schools and health services across the U.S. suffering attacks.

• January 31, 2022 31 Jan'22

  Emsisoft releases DeadBolt ransomware decryption tool

  Emsisoft's DeadBolt ransomware decryption tool fixes broken decryptor keys issued by threat actors, and works only if the victim has paid the ransom and received a key.