News

News

• January 23, 2025 23 Jan'25

  Eclypsium finds security issues in Palo Alto Networks NGFWs

  Eclypsium researchers stressed how essential supply chain security is as threat actors increasingly target and exploit vulnerabilities in firewalls, VPNs and other edge devices.

• January 22, 2025 22 Jan'25

  Cyber Safety Review Board axed in DHS cost-cutting move

  Benjamine C. Huffman, acting secretary of the Department of Homeland Security under Trump, terminates the memberships for all DHS advisory committees, including the CSRB.

• January 21, 2025 21 Jan'25

  Risk & Repeat: What is the future of CISA?

  South Dakota Gov. Kristi Noem, who is President Donald Trump's nominee for DHS secretary, said during a recent confirmation hearing that CISA should be 'smaller.'

• January 21, 2025 21 Jan'25

  Threat actors abusing Microsoft Teams in ransomware attacks

  Sophos researchers observed two separate threat campaigns in which attackers used Microsoft Teams to pose as IT support personnel and gain access to victims' systems.

• January 17, 2025 17 Jan'25

  Treasury Department sanctions company tied to Salt Typhoon

  The sanctions were in response to significant cyberattacks by Chinese nation-state threat groups against the U.S. government and critical infrastructure in recent months.

• January 16, 2025 16 Jan'25

  Tech industry experts digest cybersecurity executive order

  IT pros assess a last-minute cybersecurity executive order with new directives on a broad swath of topics, from cybercriminal sanctions to AI and identity management.

• January 16, 2025 16 Jan'25

  Threat actor publishes data of 15K hacked FortiGate firewalls

  Although the threat actor published the alleged stolen Fortinet FortiGate firewall data this week, the data is apparently tied to older zero-day exploitation from 2022.

• January 16, 2025 16 Jan'25

  The mystery of the $75M ransom payment to Dark Angels

  The Dark Angels gang stole 100 TB of data from a Fortune 50 company last year for a record-setting ransom payment. But the victim organization still hasn't disclosed those details.

• January 16, 2025 16 Jan'25

  ESET details UEFI Secure Boot bypass vulnerability

  ESET researchers last year discovered an unsigned binary in a third-party UEFI application that could have been abused to bypass the Secure Boot process.

• January 15, 2025 15 Jan'25

  FBI removes Chinese PlugX malware from 4,258 U.S. computers

  The FBI did not inform individuals that it deleted PlugX malware from users' computers beforehand, citing the possibility of Chinese state-sponsored hackers making adjustments.

• January 14, 2025 14 Jan'25

  Attackers exploiting critical Fortinet zero-day vulnerability

  Fortinet disclosed another zero-day vulnerability in its FortiOS and FortiProxy products days after Arctic Wolf detailed a threat campaign targeting the vendor's devices.

• January 14, 2025 14 Jan'25

  CISA: BeyondTrust flaw CVE-2024-12686 exploited in the wild

  BeyondTrust discovered the flaw last month while investigating breaches of a 'limited number' of SaaS customers at the hands of Chinese state-sponsored threat actors.

• January 14, 2025 14 Jan'25

  Ivanti zero-day patching increases amid ongoing attacks

  Recent scans conducted by the Shadowserver Foundation show many organizations have patched Ivanti instances vulnerable to CVE-2025-0282 over the last week.

• January 09, 2025 09 Jan'25

  Experts optimistic on FCC's Cyber Trust Mark for IoT devices

  The launch of the FCC's U.S. Cyber Trust Mark label for IoT devices will include internet-connected home security cameras, smart home appliances, baby monitors and more.

• January 09, 2025 09 Jan'25

  Mandiant links Ivanti zero-day exploitation to Chinese hackers

  Mandiant warned users to be prepared for widespread exploitation of CVE-2025-0282 as Ivanti products have become a popular target for attackers in recent years.

• January 09, 2025 09 Jan'25

  December ransomware attacks slam healthcare, public services

  In December, one victim organization paid a $1.5 million ransom to restore services, while another continued to experience disruptions for more than one month following an attack.

• January 08, 2025 08 Jan'25

  Critical Ivanti Connect Secure zero-day flaw under attack

  Although Ivanti has seen exploitation of CVE-2025-0282 in only Ivanti Connect Secure instances, Ivanti Policy Secure and ZTA gateways are also vulnerable to the flaw.

• January 07, 2025 07 Jan'25

  CISA: BeyondTrust breach affected Treasury Department only

  The government cybersecurity agency says fallout from a breach against BeyondTrust last month has not affected other federal agencies, although the investigation is ongoing.

• January 06, 2025 06 Jan'25

  Amit Yoran, Tenable CEO and cybersecurity advocate, dies at 54

  Amit Yoran was a decades-long practitioner of cybersecurity and previously held key roles at the U.S. Department of Homeland Security, RSA Security and NetWitness.

• January 02, 2025 02 Jan'25

  Dozens of Chrome extensions hacked in threat campaign

  Although data security vendor Cyberhaven disclosed that its Chrome extension was compromised on Dec. 24, additional research suggests the broader campaign could be months older.

• December 31, 2024 31 Dec'24

  Treasury Department breached through BeyondTrust service

  The Treasury Department said Chinese government hackers gained access to a key for BeyondTrust's Remote Support service and used it to breach the federal agency.

• December 30, 2024 30 Dec'24

  10 of the biggest ransomware attacks in 2024

  Ransomware attacks against U.S. organizations in 2024 disrupted healthcare systems, supply chains and government services and led to tens of millions of dollars in ransom payments.

• December 23, 2024 23 Dec'24

  Risk & Repeat: The state of ransomware in 2024

  Ransomware made major headlines in 2024, from the massive Change Healthcare attack to the creative takedown of the notorious LockBit ransomware-as-a-service gang.

• December 23, 2024 23 Dec'24

  10 of the biggest cybersecurity stories of 2024

  Some of the biggest stories of the year include a massive IT outage, a record-setting ransom payment and devastating breaches at several U.S. telecommunications companies.

• December 19, 2024 19 Dec'24

  BeyondTrust SaaS instances breached in cyberattack

  BeyondTrust, a privileged access management vendor, patched two vulnerabilities this week after attackers compromised SaaS instances for a 'limited number' of customers.

• December 18, 2024 18 Dec'24

  CISA issues mobile security guidance following China hacks

  Following the Salt Typhoon attacks, CISA offers advice to 'highly targeted' individuals, such as using end-to-end encryption and moving away from purely SMS-based MFA.

• December 16, 2024 16 Dec'24

  Blackberry sells Cylance to Arctic Wolf for $160M

  After exiting the mobile device market, Blackberry acquired Cylance for $1.4 billion in 2018 to expand its presence in enterprise security.

• December 16, 2024 16 Dec'24

  Cleo zero-day vulnerability gets CVE as attacks continue

  The new Cleo zero-day vulnerability, CVE-2024-55956, is separate from CVE-2024-50623 despite both vulnerabilities being used by threat actors to target the same endpoints.

• December 16, 2024 16 Dec'24

  ESET: RansomHub most active ransomware group in H2 2024

  The antimalware vendor says law enforcement operations against the LockBit ransomware gang were successful, but a new prolific group has emerged in its place.

• December 13, 2024 13 Dec'24

  Risk & Repeat: Attacks ramp up on Cleo MFT software

  Earlier this week, threat actors began exploiting a zero-day vulnerability in Cleo's managed file transfer products, but the details of the flaw remain unclear.

• December 12, 2024 12 Dec'24

  Cleo patches file transfer zero-day flaw under attack

  Cleo published a patch for its Harmony, VLTrader and LexiCom managed file transfer products, which addresses a 'critical vulnerability' that's separate from CVE-2024-50623.

• December 12, 2024 12 Dec'24

  Aqua Security warns of significant risks in Prometheus stack

  The cloud security vendor called on Prometheus to provide users with additional safeguards to protect against misconfigurations discovered in the open source monitoring tool.

• December 10, 2024 10 Dec'24

  Citrix NetScaler devices targeted in brute force campaign

  Citrix advised NetScaler customers to ensure that their devices are fully updated and properly configured to defend against the recent spike in brute force attacks.

• December 10, 2024 10 Dec'24

  Microsoft enhanced Recall security, but will it be enough?

  Microsoft's controversial Recall feature began rolling out to certain Windows Insiders with Copilot+ PCs in November, with more expected to participate this month.

• December 09, 2024 09 Dec'24

  Attackers exploit vulnerability in Cleo file transfer software

  Cleo disclosed and patched the remote code execution vulnerability in late October, but managed file transfer products have proved to be popular targets for threat actors.

• December 06, 2024 06 Dec'24

  Ultralytics YOLO AI model compromised in supply chain attack

  While Ultralytics has not released an official security advisory, the company pulled two recent versions of its YOLO11 AI model after reports said they contained a cryptominer.

• December 05, 2024 05 Dec'24

  Police bust cybercrime marketplace, phishing network

  As part of Europol's announcement of the cybercriminal marketplace's disruption, the agency included an image of a takedown notice referencing the 'Manson Market.'

• December 04, 2024 04 Dec'24

  FBI: Criminals using AI to commit fraud 'on a larger scale'

  As AI technology becomes more widely adopted, attackers are abusing it for their scams, which the FBI says are becoming increasingly more difficult to detect.

• December 04, 2024 04 Dec'24

  FOSS security concerns increase amid widespread adoption

  A new report from the Linux Foundation, OpenSSF and Harvard University calls for transparency and standardization to address growing security risks in open source software.

• December 03, 2024 03 Dec'24

  Ransomware attacks on critical sectors ramped up in November

  Supply chain software vendor Blue Yonder and energy management giant Schneider Electric SE experienced some of the most notable ransomware incidents in November.

• December 02, 2024 02 Dec'24

  AWS launches automated service for incident response

  AWS Security Incident Response, which launched ahead of the re:Invent 2024 conference this week, can automatically triage and remediate events detected in Amazon GuardDuty.

• November 26, 2024 26 Nov'24

  New York fines Geico, Travelers $11.3M over data breaches

  The two insurance giants were fined millions by New York state regulators and are required to enhance security protocols around authentication and penetration testing.

• November 26, 2024 26 Nov'24

  Russian hackers exploit Firefox, Windows zero-days in wild

  RomCom threat actors chain two Firefox and Windows zero-day vulnerabilities together in order to execute arbitrary code in vulnerable Mozilla browsers.

• November 26, 2024 26 Nov'24

  AWS CISO details automated cybersecurity tools for customers

  Chris Betz, CISO at AWS, discusses how three internal tools are designed to automatically identify and mitigate threats for the cloud giant's customers.

• November 22, 2024 22 Nov'24

  Volexity details Russia's novel 'Nearest Neighbor Attack'

  The security company warned that the new attack style highlights the importance of securing Wi-Fi networks, implementing MFA and patching known vulnerabilities.

• November 21, 2024 21 Nov'24

  Cyber insurers address ransom reimbursement policy concerns

  In a recent op-ed for The Financial Times, U.S. Deputy National Security Advisor Anne Neuberger wrote that reimbursing ransom payments is a 'troubling practice that must end.'

• November 21, 2024 21 Nov'24

  DOJ charges 5 alleged Scattered Spider members

  The defendants, charged for conducting alleged phishing scams across the U.S., are suspected members of a prolific threat group responsible for last year's casino attacks.

• November 20, 2024 20 Nov'24

  Risk & Repeat: China hacks major telecom companies

  The FBI and CISA confirmed reports that Salt Typhoon breached several major telecom companies and accessed data related to law enforcement requests.

• November 20, 2024 20 Nov'24

  Apple warns 2 macOS zero-day vulnerabilities under attack

  The macOS Sequoia vulnerabilities are the latest to be targeted and exploited by threat actors as cybersecurity vendors report a shift in the landscape.

• November 19, 2024 19 Nov'24

  Microsoft to offer hackers millions in Zero Day Quest event

  Microsoft launched Zero Day Quest on Tuesday with a preliminary event offering bug bounty researchers rewards with multipliers for select security scenarios.

• November 19, 2024 19 Nov'24

  2 Palo Alto Networks zero-day vulnerabilities under attack

  CVE-2024-9474 marks the second zero-day vulnerability in Palo Alto Networks' PAN-OS firewall management interface to come under attack in the last week.

• November 18, 2024 18 Nov'24

  Chinese APT exploited unpatched Fortinet zero-day flaw

  Volexity reported that a Chinese APT actor exploited a zero-day vulnerability in Fortinet's Windows VPN FortiClient software that enables credentials to be stolen from a system.

• November 15, 2024 15 Nov'24

  MFA required for AWS Organizations member accounts in 2025

  AWS is one of several cloud providers that will implement MFA requirements over the next year, with other relevant names including Google Cloud and Microsoft Azure.

• November 15, 2024 15 Nov'24

  Palo Alto Networks PAN-OS management interfaces under attack

  Palo Alto Networks confirmed that threat actors are exploiting a vulnerability in PAN-OS firewall management interfaces after warning customers to secure them for nearly a week.

• November 14, 2024 14 Nov'24

  Infoblox: 800,000 domains vulnerable to hijacking attack

  While the 'Sitting Ducks' attack vector continues to pose a problem, Infoblox says domain registrars, DNS providers and government bodies remain inactive.

• November 14, 2024 14 Nov'24

  CISA, FBI confirm China breached telecommunication providers

  The government agencies confirmed Wall Street Journal reports that China-backed threat actors breached telecommunication providers and access data for law enforcement requests.

• November 13, 2024 13 Nov'24

  Most widely exploited vulnerabilities in 2023 were zero days

  While zero-day exploitation surged throughout 2023, CISA said threat actors continue to exploit known vulnerabilities that were disclosed and patched as far back as 2017.

• November 12, 2024 12 Nov'24

  Amazon employee data leaked from MoveIt Transfer attack

  Although Amazon confirms that employee data was leaked, it stresses that data was stolen via a third-party vendor and that only contact information was obtained.

• November 07, 2024 07 Nov'24

  Ransomware attacks caused prolonged disruptions in October

  The Ransomhub, Rhysdia and Interlock ransomware gangs claimed responsibility for attacks that knocked victims' services offline, sometimes for several weeks.

• November 06, 2024 06 Nov'24

  CISA on 2024 election security: 'Good news' for democracy

  CISA Director Jen Easterly says that despite disruptions including bomb threats in multiple states, Election Day 2024 was a success story from a security standpoint.

• November 05, 2024 05 Nov'24

  Canadian authorities arrest alleged Snowflake hacker

  Alexander Moucka was arrested last week and is expected to appear in court Tuesday for allegedly breaching dozens of Snowflake customers.

• November 05, 2024 05 Nov'24

  Google Cloud to roll out mandatory MFA for all users

  Google's three-phase plan for mandatory MFA, which will culminate in late 2025, follows similar efforts from other cloud providers such as AWS and Microsoft.

• November 04, 2024 04 Nov'24

  CISA: U.S. election disinformation peddled at massive scale

  CISA said the U.S. cybersecurity agency has seen small-scale election incidents 'resulting in no significant impacts to election infrastructure,' such as low-level DDoS attacks.

• October 31, 2024 31 Oct'24

  China-based APTs waged 5-year campaign on Sophos firewalls

  For years, several advanced persistent threat groups tied to the Chinese government targeted Sophos firewall products with custom malware and zero-day exploits.

• October 31, 2024 31 Oct'24

  Lottie Player NPM package compromised in supply chain attack

  Threat actors published compromised versions of the Lottie Player component on NPM, and the malicious code prompted users to access their cryptocurrency wallets.

• October 30, 2024 30 Oct'24

  Play ransomware attack tied to North Korean nation-state actor

  A relationship between North Korean actor Jumpy Pisces and Play ransomware would be unprecedented, as the former has not collaborated with cybercrime gangs previously.

• October 30, 2024 30 Oct'24

  Microsoft warns of Midnight Blizzard spear phishing campaign

  The tech giant is notifying users affected by a recently observed campaign, which has targeted more than 100 victim organizations globally so far.

• October 29, 2024 29 Oct'24

  Risk & Repeat: SEC cracks down on cybersecurity disclosures

  The SEC's charges against Unisys, Avaya, Check Point Software Technologies and Mimecast have raised questions about expectations for transparency in cybersecurity.

• October 29, 2024 29 Oct'24

  REvil convictions unlikely to curb Russian cybercrime

  In a rare action against cybercrime, a court in Russia sentenced four individuals tied to the Revil ransomware gang for money laundering and malware distribution charges.

• October 28, 2024 28 Oct'24

  Delta sues CrowdStrike over IT outage fallout

  Delta said it suffered $500 million in damages. CrowdStrike said the airline company's claims 'demonstrate a lack of understanding of how modern cybersecurity works.'

• October 24, 2024 24 Oct'24

  Cisco ASA and FTD zero day used in password spraying attacks

  One day after Cisco disclosed a zero-day vulnerability discovered in its VPN software, CISA added the flaw to its Known Exploited Vulnerabilities catalog.

• October 24, 2024 24 Oct'24

  Fortinet FortiManager zero-day flaw exploited since June

  Mandiant researchers first observed exploitation activity against CVE-2024-47575 on June 27, with more than 50 FortiManager devices compromised since.

• October 24, 2024 24 Oct'24

  AWS CDK security issue could lead to account takeovers

  Aqua Security researchers discovered AWS Cloud Development Kit is susceptible to an attack vector the vendor refers to as 'shadows resources,' which can put accounts at risk.

• October 24, 2024 24 Oct'24

  SolarWinds breach news center

  The massive SolarWinds supply chain attack continues to invade networks. Here's the latest news on the breach, how the malware infiltrates systems and the IT industry response.

• October 23, 2024 23 Oct'24

  Fortinet discloses critical zero-day flaw in FortiManager

  According to Fortinet, the FortiManager vulnerability 'may allow a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.'

• October 22, 2024 22 Oct'24

  SEC charges 4 companies for downplaying SolarWinds attacks

  The U.S. Securities and Exchange Commission fined the companies for misleading investors about intrusions stemming from the SolarWinds supply chain attack.

• October 22, 2024 22 Oct'24

  Thoma Bravo-owned Sophos to acquire Secureworks for $859M

  Sophos said it plans to integrate Secureworks' products into a broader portfolio that serves both large enterprises and small and medium-sized businesses.

• October 21, 2024 21 Oct'24

  Cisco confirms attackers stole data from DevHub environment

  While Cisco said its systems were not breached, the vendor did confirm that attackers stole sensitive information from the public-facing portal.

• October 21, 2024 21 Oct'24

  Study outlines 'severe' security issues in cloud providers

  Possible security issues involving cloud systems should be taken seriously, as the paper noted the five vendors outlined are responsible for more than 22 million users.

• October 17, 2024 17 Oct'24

  Joe Sullivan: CEOs must be held accountable for security too

  The former CSO at Uber was found guilty in 2022 of obstruction of justice relating to a breach. Now he's calling for clearer regulatory frameworks for security.

• October 17, 2024 17 Oct'24

  DOJ charges alleged Anonymous Sudan ringleaders

  Two Sudanese brothers are accused of leading the cybercriminal group that caused significant damage to healthcare organizations as well as other high-profile victims.

• October 17, 2024 17 Oct'24

  September a quiet month for ransomware attacks

  Notable ransomware attacks in September involved a Rhode Island public school district, a Texas hospital system, and Kawasaki Motors' European branch.

• October 16, 2024 16 Oct'24

  Microsoft sees drop in ransomware reaching encryption phase

  In its Digital Defense Report 2024, Microsoft observed a significant increase in the number of human-operated ransomware attacks, which often originated from unmanaged devices.

• October 16, 2024 16 Oct'24

  Microsoft: Nation-state activity blurring with cybercrime

  Microsoft's Digital Defense Report 2024 noted that Russia 'outsourced some cyberespionage operations' against Ukraine to otherwise independent cybercrime gangs.

• October 16, 2024 16 Oct'24

  Experts slam Chinese research on quantum encryption attack

  Researchers at Shanghai University claim to have cracked RSA encryption using D-Wave quantum systems, but infosec experts say the claims are overblown.

• October 15, 2024 15 Oct'24

  FIDO unveils new specifications to transfer passkeys

  The proposed FIDO Alliance specifications would enable users and organizations to securely transfer credentials from one identity provider to another.

• October 11, 2024 11 Oct'24

  Zero-day flaw behind Rackspace breach still a mystery

  More than two weeks after threat actors exploited a zero-day vulnerability in a third-party utility to breach Rackspace, the details about the flaw and the utility remain unknown.

• October 10, 2024 10 Oct'24

  FTC orders Marriott to pay $52M and enhance security practices

  The Federal Trade Commission says an investigation revealed that poor security practices led to three data breaches at Marriott and Starwood hotels between 2014 and 2020.

• October 10, 2024 10 Oct'24

  OpenAI details how threat actors are abusing ChatGPT

  While threat actors are using generative AI tools like ChatGPT to run election influence operations and develop malware, OpenAI says the efforts are rarely successful.

• October 10, 2024 10 Oct'24

  Coalition: Ransomware severity up 68% in first half of 2024

  The cyber insurance carrier examined claims trends for the first half of 2024, which showed policyholders experienced disruptive and increasingly costly ransomware attacks.

• October 08, 2024 08 Oct'24

  Risk & Repeat: Is Microsoft security back on track?

  Microsoft has made significant changes to its cybersecurity practices and policies under the Secure Future Initiative. Are they enough to right the ship?

• October 08, 2024 08 Oct'24

  High-severity Qualcomm zero-day vulnerability under attack

  Qualcomm urges customers to patch the memory corruption vulnerability as Google researchers have observed targeted exploitation in the wild against the flaw.

• October 07, 2024 07 Oct'24

  American Water discloses breach, utilities unaffected

  American Water says in its 8-K filing that it disconnected and deactivated certain systems in its incident response, though the nature of the cyberattack is unknown.

• October 03, 2024 03 Oct'24

  Microsoft SFI progress report elicits cautious optimism

  Infosec experts say the Secure Future Initiative progress report shows Microsoft has made important changes to its policies, practices and accountability structures.

• October 03, 2024 03 Oct'24

  'Defunct' DOJ ransomware task force raises questions, concerns

  A report from the Office of the Inspector General reviewed the U.S. Department of Justice's efforts against ransomware and found its task force was largely ineffective.

• October 03, 2024 03 Oct'24

  Cryptomining perfctl malware swarms Linux machines

  Aqua Security researchers believe that perfctl malware has infected thousands of Linux machines in the last three to four years and that countless more could be next.

• October 01, 2024 01 Oct'24

  Law enforcement agencies arrest 4 alleged LockBit members

  Operation Cronos' efforts to disrupt the LockBit ransomware gang continue as authorities announced the arrests of four alleged members, including one developer.

• October 01, 2024 01 Oct'24

  T-Mobile reaches $31.5M breach settlement with FCC

  After suffering several breaches, T-Mobile agreed to pay a $15.75 million civil penalty and make a $15.75 million investment to bolster its security over the next two years.

• September 30, 2024 30 Sep'24

  Risk & Repeat: Inside the Microsoft SFI progress report

  The first Secure Future Initiative progress report highlighted improvements to Microsoft's security posture. But the company still faces major SecOps challenges.

• September 27, 2024 27 Sep'24

  CUPS vulnerabilities could put Linux systems at risk

  Security researcher Simone Margaritelli discovered vulnerabilities in the Common UNIX Printing System that attackers could exploit during print jobs against Linux systems.