News

News

• September 02, 2021 02 Sep'21

  Accellion-related breach disclosures continue to unfold

  Beaumont Health disclosed some patient data was exposed through an attack on Accellion's FTA product, nine months after the attack on the legacy file transfer software occurred.

• September 02, 2021 02 Sep'21

  Autodesk targeted in SolarWinds hack

  Autodesk said in its 10-Q filing released Wednesday that it believes 'no customer operations or Autodesk products were disrupted' in the SolarWinds supply chain attack.

• September 01, 2021 01 Sep'21

  Atlassian Confluence flaw under active attack

  Administrators are advised to patch immediately after security experts confirmed mass scanning and exploits against a critical remote code execution vulnerability.

• September 01, 2021 01 Sep'21

  Beware of proxyware: Connection-sharing services pose risks

  Cisco Talos warns that sharing internet connections with random people via third-party app like Honeygain and Peer2Profit could lead to malware installations and other threats.

• August 31, 2021 31 Aug'21

  SEC sanctions financial firms for cybersecurity failures

  Three financial services firms were charged with failing to implement proper cybersecurity policies after cyber attacks led to the exposure of customer data.

• August 31, 2021 31 Aug'21

  College students targeted by money mule phishing techniques

  Back to fool: University students with little security training are being targeted by Nigerian scammers to move fraudulent funds with the lure of quick bucks and flexible hours.

• August 30, 2021 30 Aug'21

  New 'ProxyToken' Exchange Server vulnerability disclosed

  The Exchange Server vulnerability could allow an attacker 'to copy all emails addressed to a target and account and forward them to an account controlled by the attacker.'

• August 27, 2021 27 Aug'21

  Researchers discover critical flaw in Azure Cosmos DB

  Wiz security researchers found a new attack vector in Microsoft Azure, which if exploited could allow an attacker to gain access to customers primary keys.

• August 27, 2021 27 Aug'21

  T-Mobile offers details of data breach that affected 40M

  According to T-Mobile, the hackers who stole its customer database had knowledge of the company's network and testing setup. The hack was a carefully planned network breach.

• August 26, 2021 26 Aug'21

  Private sectors pledge big for cyberdefense

  Tech giants have invested billions to address cybersecurity threats such as supply chain security and attacks on critical infrastructures.

• August 26, 2021 26 Aug'21

  Microsoft finally issues ProxyShell security advisory

  The ProxyShell advisory includes a call to patch, as well as details on which Exchange servers are vulnerable. In short: Those without the May security update are unprotected.

• August 26, 2021 26 Aug'21

  Risk & Repeat: ProxyShell problems mount

  CISA warned threat actors have begun exploiting the dangerous ProxyLogon flaws, but tens of thousands of vulnerable Microsoft Exchange servers remain online.

• August 25, 2021 25 Aug'21

  Bugs aplenty as VMware, Cisco and F5 drop security updates

  Two critical updates from Cisco, remote code execution flaws in F5's Big-IP, and a half-dozen VMware security holes are among the more pressing issues for admins to address.

• August 25, 2021 25 Aug'21

  HackerOne launches AWS certification paths, pen testing service

  A select group of penetration testers in HackerOne's community will be able to obtain three AWS certifications, including the Security - Specialty certification.

• August 24, 2021 24 Aug'21

  4 emerging ransomware groups take center stage

  Four ransomware operations -- AvosLocker, Hive, HelloKitty and LockBit 2.0 -- have popped up on the radar of researchers with Palo Alto Network's Unit 42 team.

• August 23, 2021 23 Aug'21

  CISA: ProxyShell flaws being actively exploited, patch now

  Security researchers weighed in with evidence of ProxyShell exploitation by threat actors using malicious web shells and a new ransomware variant called 'LockFile.'

• August 19, 2021 19 Aug'21

  CISA offers ransomware response guidelines to organizations

  In its new ransomware prevention and response guide, CISA 'strongly discourages paying a ransom,' citing the potential to embolden threat actors and fund illicit activity.

• August 18, 2021 18 Aug'21

  T-Mobile breach exposes data for more than 40M people

  The telecom giant confirmed reports that its network was breached by a threat actor who stole personal data on more than 40 million current, former and prospective customers.

• August 17, 2021 17 Aug'21

  Many Exchange servers still vulnerable to ProxyLogon, ProxyShell

  Tens of thousands of Exchange servers are still vulnerable to ProxyLogon and ProxyShell, and security researchers estimate honeypots represent only a small slice of those systems.

• August 17, 2021 17 Aug'21

  Palo Alto Networks: Personal VPNs pose risks to enterprises

  Researchers from Palo Alto Networks published a new report detailing the risks that personal VPNs pose to enterprise networks, including evasion tactics to bypass firewalls.

• August 16, 2021 16 Aug'21

  FBI watchlist exposed by misconfigured Elasticsearch cluster

  A terrorist watchlist was found in an exposed database, and security researcher Bob Diachenko says there is no way of knowing just how long it was open to the public.

• August 13, 2021 13 Aug'21

  New ransomware crew hammers on PrintNightmare bugs

  PrintNightmare, the Microsoft print spooler flaws patched in July, is the favorite target for a new ransomware group known as Vice Society, according to Cisco Talos.

• August 12, 2021 12 Aug'21

  Months after the Accellion breach, more victims emerge

  The Accellion breach occurred last December, but more victims have come to light in recent weeks as investigations, notifications and disclosures stretch on through the summer.

• August 12, 2021 12 Aug'21

  Microsoft discloses new print spooler flaw without patch

  The latest flaw in Windows print spooler software, which has yet to be patched, comes weeks after the PrintNightmare vulnerability and other related bugs.

• August 11, 2021 11 Aug'21

  Accenture responds to LockBit ransomware attack

  The LockBit ransomware crew claims to have stolen data from IT services and consulting giant Accenture, but the company said no customer systems were affected in the attack.

• August 11, 2021 11 Aug'21

  NortonLifeLock and Avast joining forces in $8 billion merger

  The combined company from NortonLifeLock and Avast will be dual-headquartered in Arizona and Prague, and will serve 500 million users, including 40 million direct customers.

• August 11, 2021 11 Aug'21

  Hackers selling access to breached networks for $10,000

  Network access is a closely-guarded commodity in underground hacker forums, with some sellers not even revealing the names of their victims until money has changed hands.

• August 09, 2021 09 Aug'21

  'ProxyShell' Exchange bugs resurface after presentation

  A critical vulnerability in Microsoft Exchange is once again making the rounds with attackers, following a Black Hat presentation from the researcher who found it.

• August 09, 2021 09 Aug'21

  Transparency after a cyber attack: How much is too much?

  Sharing threat intelligence and proof-of-concept exploits can often help other organizations better defend themselves, but such efforts are hampered by obstacles and restrictions.

• August 05, 2021 05 Aug'21

  Apple's M1 silicon brings new challenges for malware defenders

  Noted security researcher Patrick Wardle told Black Hat 2021 attendees that catching malware attacks on new macOS systems requires learning the subtleties of ARM64 architecture.

• August 05, 2021 05 Aug'21

  Researchers argue action bias hinders incident response

  A Black Hat 2021 session focused on the human instinct to act immediately after a cyber attack and how that can negatively impact incident response.

• August 05, 2021 05 Aug'21

  CISA director announces 'Joint Cyber Defense Collaborative'

  The Joint Cyber Defense Collaborative, or JCDC, is a partnership between the public and private sectors to create and implement comprehensive national cybersecurity plans.

• August 05, 2021 05 Aug'21

  Hackers build a better timing attack to crack encryption keys

  A new technique for cracking encryption keys can overcome the limitations of popular timing attacks by analyzing network packets, according to researchers at Black Hat 2021.

• August 05, 2021 05 Aug'21

  Mandiant: Microsoft 365 the 'Holy Grail' for nation-state hackers

  Mandiant researchers discussed mailbox compromises, app registration abuse and new extensions of the Golden SAML attack technique against Microsoft 365 at Black Hat 2021.

• August 04, 2021 04 Aug'21

  Researchers crack new Let's Encrypt validation feature

  Multiperspective validation can be thwarted with a traffic-throttling technique that could lead to attackers obtaining digital certificates for domains they don't own.

• August 04, 2021 04 Aug'21

  Matt Tait warns of 'stolen' zero-day vulnerabilities

  During Black Hat 2021, the COO of Corellium discussed three main threats that have ramped up: stolen zero days, zero days being exploited in the wild and supply chain attacks.

• August 04, 2021 04 Aug'21

  Supply chain attacks, IoT threats on tap for Black Hat 2021

  Industry analysts say that evolving threats, real-world impacts and supply chain attacks will be among their hot topics at this year's Black Hat 2021 conference.

• August 04, 2021 04 Aug'21

  14 flaws in NicheStack put critical infrastructure at risk

  The vulnerability disclosure process for Infra:Halt, a set of flaws impacting critical infrastructure, took nearly a year, due to the nature of supply chain vulnerabilities.

• August 02, 2021 02 Aug'21

  Hospitals at risk from security flaws in pneumatic tube systems

  Researchers at IoT security vendor Armis said the nine critical vulnerabilities affect the pneumatic tube systems used by many hospitals in North America.

• July 30, 2021 30 Jul'21

  Cybersecurity consulting, MSSPs in channel spotlight

  Channel companies have put a premium on cybersecurity services in 2021. The latest round of market activity features Deloitte and Epiphany Systems; other news.

• July 29, 2021 29 Jul'21

  Kaspersky tracks Windows zero days to 'Moses' exploit author

  In its second-quarter threat report, Kaspersky Lab found a rise in the use of exploits and zero-day vulnerabilities, several of which were traced to a single threat actor.

• July 28, 2021 28 Jul'21

  CISA unveils list of most targeted vulnerabilities in 2020

  Attackers chased the headlines in 2020, going after the most publicized vulnerabilities in Citrix, Pulse Secure and Fortinet products, according to the U.S. government.

• July 28, 2021 28 Jul'21

  New 'BlackMatter' ransomware gang has echoes of REvil

  Although connections are being made between ransomware groups REvil and BlackMatter, the jury is still out on whether they have threat actors in common.

• July 27, 2021 27 Jul'21

  Open source web app projects hailed for quickly patching bugs

  Nine vulnerabilities in three popular open source SMB tools were cleaned up within 24 hours after Rapid7 reported the flaws to their development teams.

• July 27, 2021 27 Jul'21

  Cybersecurity investments surge in 2021 as VCs go all in

  Venture capital firms have flooded the cybersecurity market this year with investment dollars for young startups and established vendors alike. What's behind this surge?

• July 26, 2021 26 Jul'21

  Coveware: Median ransomware payment down 40% in Q2 2021

  Coveware CEO Bill Siegel said that the efficacy of using data leak threats to obtain ransomware payments has gone down because 'you don't get anything in return when you pay.'

• July 26, 2021 26 Jul'21

  Gartner: 'Weaponized' operational tech poses grave danger

  New research by Gartner analyst Wam Voster warns that while attacks in the IT world can lead to loss of information, attacks in the OT world can lead to loss of life.

• July 22, 2021 22 Jul'21

  US Senate mulling bill on data breach notifications

  The Senate Intelligence Committee introduced a bill that would require federal agencies and companies providing critical infrastructure to report network breaches to DHS.

• July 22, 2021 22 Jul'21

  Risk & Repeat: Vulnerability patching still falling short

  Many organizations still fail to patch critical vulnerabilities, even when they're under exploitation in the wild. What are the best ways to improve patching rates?

• July 22, 2021 22 Jul'21

  Kaseya obtained ransomware decryptor from 'trusted third party'

  Kaseya told SearchSecurity that for 'confidentiality reasons' it could only confirm that the ransomware decryptor came from a trusted third party and that it was helping customers.

• July 21, 2021 21 Jul'21

  U.K. man arrested in connection with 2020 Twitter breach

  A 22-year-old U.K. resident was arrested in Spain and will face extradition on charges related to a social engineering operation that netted big-name Twitter accounts.

• July 21, 2021 21 Jul'21

  Hackers embrace 5-day workweeks, unpatched vulnerabilities

  Bad guys are taking the weekends off too, according to Barracuda Networks, and old bugs that should have been patched months ago continue to be the most-targeted vulnerabilities.

• July 20, 2021 20 Jul'21

  DHS unveils second round of new pipeline security requirements

  New requirements from DHS for oil and gas pipeline operators include the implementation of 'specific mitigation measures' against cyberthreats, specifically ransomware attacks.

• July 19, 2021 19 Jul'21

  US charges members of APT40, Chinese state-sponsored group

  The Department of Justice accused four Chinese nationals of hacking into a variety of businesses between 2011 and 2018 to steal trade secrets and other valuable data.

• July 19, 2021 19 Jul'21

  US government formally names China in Exchange Server hack

  Beyond the Exchange Server hack, the White House's statement condemned China for its malicious cyber behavior and accused the country of government-affiliated ransomware attacks.

• July 15, 2021 15 Jul'21

  US government launches 'StopRansomware' site

  In the latest initiatives to combat ransomware, the new website provides individuals and organizations with services and tools to help reduce the risk of attacks.

• July 15, 2021 15 Jul'21

  SonicWall warns of 'imminent' SMA 100/SRA ransomware attacks

  SonicWall said that those who fail to update or disconnect their vulnerable SMA 100 and SRA devices are 'at imminent risk of a targeted ransomware attack.'

• July 14, 2021 14 Jul'21

  Microsoft's 'PrintNightmare' lingers, requires new patches

  July's Patch Tuesday update includes critical fixes, but one well-known remote code execution bug might remain open for those with specific registry key settings.

• July 14, 2021 14 Jul'21

  Risk & Repeat: Breaking down the Kaseya ransomware attacks

  Nearly two weeks after REvil ransomware hit hundreds of companies, Kaseya and its managed service providers are still assessing the damage from the supply chain attack.

• July 14, 2021 14 Jul'21

  Microsoft: Chinese threat actor exploited SolarWinds zero-day

  Microsoft has observed DEV-0322, the threat actor exploiting the SolarWinds Serv-U zero-day, 'targeting entities in the U.S. Defense Industrial Base Sector and software companies.'

• July 13, 2021 13 Jul'21

  Schneider Electric PLCs vulnerable to remote takeover attacks

  The authentication bypass vulnerability is a symptom of a much larger security crisis plaguing industrial control hardware, according to researchers who found the bug.

• July 13, 2021 13 Jul'21

  Why patching vulnerabilities is still a problem, and how to fix it

  Patching is still a struggle for many organizations, and challenges include limited resources, technical debt, decentralized infrastructure and much more.

• July 12, 2021 12 Jul'21

  Microsoft to acquire RiskIQ to combat growing cyberthreats

  Microsoft has agreed to purchase threat intelligence vendor RiskIQ to bolster its cloud security offerings and help customers address global cyberthreats.

• July 12, 2021 12 Jul'21

  SolarWinds warns of zero-day vulnerability under attack

  SolarWinds says targeted attacks from a single threat actor have been reported on a previously unknown vulnerability in the Serv-U file transfer platform.

• July 08, 2021 08 Jul'21

  Dutch researchers shed new light on Kaseya vulnerabilities

  Dutch security researchers were working with Kaseya to get an authentication bypass flaw and other bugs patched when the catastrophic supply chain attack occurred.

• July 08, 2021 08 Jul'21

  Kaseya post-attack VSA deployment delayed until Sunday

  Kaseya CEO Fred Voccola said in an early Wednesday video update that the VSA deployment delay was 'probably the hardest decision I've had to make in my career.'

• July 07, 2021 07 Jul'21

  Microsoft posts emergency 'PrintNightmare' patch

  The out-of-band patch release addresses a critical flaw that allowed threat actors to gain remote code execution on vulnerable Windows and Windows Server systems.

• July 06, 2021 06 Jul'21

  Kaseya ransomware attacks: What we know so far

  REvil ransomware threat actors exploited a zero-day vulnerability to issue ransomware payloads disguised as legitimate software updates from Kaseya.

• July 06, 2021 06 Jul'21

  Kaseya: 1,500 organizations affected by REvil attacks

  Approximately 50 managed service providers and up to 1,500 of their customers were compromised via a devastating supply chain attack on Kaseya by REvil ransomware actors.

• July 02, 2021 02 Jul'21

  Russia using Kubernetes cluster for brute-force attacks

  The NSA warned that Russian state-sponsored hackers launched a new container-based campaign aimed at breaching networks and stealing essential data from multiple industries.

• June 30, 2021 30 Jun'21

  European police lay siege to hacker haven DoubleVPN

  An international law enforcement operation shut down DoubleVPN, a Dutch-hosted service that had provided low-cost, underground anonymizing services to cybercriminals.

• June 30, 2021 30 Jun'21

  SentinelOne IPO raises $1.2 billion, beating estimates

  the endpoint security vendor has gone public in one of the largest IPOs in the cybersecurity industry.

• June 30, 2021 30 Jun'21

  Alleged creator of Gozi banking Trojan arrested in Colombia

  Romanian Mihai Ionut Paunescu, known as 'Virus,' was charged with two other supposed creators of the Gozi malware back in 2012, but Paunescu is the only one not to be extradited.

• June 29, 2021 29 Jun'21

  End users in the dark about latest cyberthreats, attacks

  A study from IoT security vendor Armis shows many outside the IT community are unaware of growing threats, leaving a major gap in knowledge of basic security practices.

• June 28, 2021 28 Jun'21

  SolarWinds hackers compromised Microsoft support agent

  After placing information-stealing malware on a customer support agent's system, the Nobelium threat actors gained access to three Microsoft clients.

• June 28, 2021 28 Jun'21

  DarkSide ransomware funded by cybercriminal 'investors'

  New ransomware gangs, such as DarkSide, are receiving cryptocurrency investments from their peers and are poised to make life difficult for enterprises and law enforcement alike.

• June 24, 2021 24 Jun'21

  Atlassian moves to lock down accounts from takeover bugs

  Check Point Research uncovered a set of flaws that, if chained together, would have enabled attackers to hijack accounts with single sign-on enabled.

• June 24, 2021 24 Jun'21

  Namecheap refines strategy to fight malicious domains

  Security researchers this month noted drastic improvements in the domain registrar's effort to respond to and mitigate reports of malicious and fraudulent sites.

• June 24, 2021 24 Jun'21

  HPE jumps into zero trust with Project Aurora

  Enterprise giant HPE says its new zero-trust offering, dubbed Project Aurora, will make its debut later this year with the GreenLake hybrid cloud platform.

• June 24, 2021 24 Jun'21

  Dell BIOSConnect flaws affect 30 million devices

  Eclypsium researchers discovered vulnerabilities that, if exploited, can allow remote code execution in a pre-boot environment for 128 different Dell products.

• June 23, 2021 23 Jun'21

  Risk & Repeat: US opens door for hacking back

  This episode of the Risk & Repeat podcast discusses the growing pressure on the U.S. to respond to cyber attacks and if hacking back will be part of the plan.

• June 22, 2021 22 Jun'21

  COVID, gift cards and phony acquisitions top BEC attack trends

  New research from Cisco Talos shows cybercriminals are still using the COVID-19 pandemic for BEC attacks to steal millions, but in slightly different ways.

• June 21, 2021 21 Jun'21

  Biden proposes critical infrastructure safe zones for hacking

  The U.S. wants Russia to agree to make critical infrastructure targets off limits to hacking, but some infosec experts are skeptical such an agreement can be enforced.

• June 17, 2021 17 Jun'21

  SolarWinds response team recounts early days of attack

  During a webcast, members of the SolarWinds incident response team explained how a lucky break with a virtual machine aided their investigation into the historic breach.

• June 16, 2021 16 Jun'21

  6 suspected Clop ransomware gang members arrested in Ukraine

  The impact of the arrests is unknown, as Clop's ransomware leak site remains online after the arrests. The scale of the gang's current operation is also unknown.

• June 16, 2021 16 Jun'21

  Zscaler: Exposed servers, open ports jeopardizing enterprises

  Zscaler analyzed 1,500 networks and found administrators are leaving basic points of entry wide open for attackers as neglected servers are falling by the wayside.

• June 16, 2021 16 Jun'21

  Repeat ransomware attacks hit 80% of victims who paid ransoms

  New research from Cybereason offers troubling findings for organizations that pay ransoms, from repeat attacks to corrupted data and faulty decryption tools.

• June 15, 2021 15 Jun'21

  Apple issues patches for two more WebKit zero-days

  Apple said both WebKit zero-days, which affect older iOS devices, have reportedly been exploited in the wild, but further details about the threat activity are unknown.

• June 14, 2021 14 Jun'21

  Accellion breach raises notification concerns

  Victims of the breach continue to emerge, and one customer said it could have acted sooner, but a critical alert about a zero-day never left Accellion's email system.

• June 11, 2021 11 Jun'21

  Slilpp marketplace goes dark following government takedown

  Slilpp, a massive dark web emporium for buying and selling stolen credentials, has been pulled offline by an international law enforcement takedown.

• June 11, 2021 11 Jun'21

  Securolytics COO charged in Georgia hospital cyber attack

  Details on the cyber attack are scarce, but according to the indictment, Vikas Singla allegedly attempted to steal data and disrupt the hospital's phone system.

• June 11, 2021 11 Jun'21

  Cisco Talos: Exchange Server flaws accounted for 35% of attacks

  More than one third of incidents recorded by Cisco Talos in the past three months were related to four Microsoft Exchange Server zero-days first revealed in March.

• June 10, 2021 10 Jun'21

  JBS USA paid $11M ransom to REvil hackers

  Last week JBS USA said the ransomware attack was resolved and all facilities were fully operational, but now the company confirmed it paid a huge ransom.

• June 10, 2021 10 Jun'21

  Risk & Repeat: Colonial Pipeline CEO grilled by Congress

  Colonial Pipeline Co. CEO Joseph Blount faced criticism from several members of Congress this week during two different hearings on the recent ransomware attack.

• June 09, 2021 09 Jun'21

  Mandiant: Compromised Colonial Pipeline password was reused

  The Colonial Pipeline VPN password was relatively complex, according to Mandiant CTO Charles Carmakal, and likely would have been difficult for DarkSide threat actors to guess.

• June 08, 2021 08 Jun'21

  FBI used encrypted Anom app in international crime bust

  The FBI secretly ran an encrypted chat network that included 12,000 devices and was widely used by criminal organizations across the globe for various illegal dealings.

• June 08, 2021 08 Jun'21

  FBI seized Colonial Pipeline ransom using private key

  After Colonial Pipeline paid a $4.4 million ransom demand in last month's attack, the DOJ announced the majority of the funds have been retrieved by the FBI.

• June 08, 2021 08 Jun'21

  CISA taps Bugcrowd for federal vulnerability disclosure program

  The new program follows a CISA directive from September that requires executive branch agencies to create and publish vulnerability disclosure policies.

• June 07, 2021 07 Jun'21

  DOJ charges alleged Trickbot developer

  Several of the 19 charges brought against the alleged Trickbot Group developer Alla Witte include bank fraud and aggravated identity theft.

• June 07, 2021 07 Jun'21

  Hackers vs. lawyers: Security research stifled in key situations

  The age-old debate between sharing information or covering legal liability is a growing issue in everything from bug bounties to disclosing ransomware attacks.