News

News

• September 26, 2024 26 Sep'24

  Ransomware Task Force finds 73% attack increase in 2023

  The Institute for Security and Technology's Ransomware Task Force says a shift to big game hunting tactics led to a significant rise in attacks last year.

• September 25, 2024 25 Sep'24

  More Ivanti vulnerabilities exploited in the wild

  Three vulnerabilities in Ivanti products have come under attack by unknown threat actors in recent weeks, including two flaws in the company's Cloud Services Appliance.

• September 24, 2024 24 Sep'24

  CrowdStrike exec apologizes to Congress, shares updates

  CrowdStrike changed the way it rolls out content updates as a result of the global IT outage caused by a faulty update in July.

• September 24, 2024 24 Sep'24

  Risk & Repeat: What's next for Telegram and Pavel Durov?

  Telegram made updates to its FAQ and privacy policy following Pavel Durov's arrest. But will the changes influence cybercriminals' abuse of the platform?

• September 24, 2024 24 Sep'24

  Arkansas City water treatment facility hit by cyberattack

  While disruptions are limited, the attack on the water treatment facility highlights how the critical infrastructure sector remains a popular target for threat actors.

• September 23, 2024 23 Sep'24

  Microsoft issues first Secure Future Initiative report

  In the first progress report since the launch of its Secure Future Initiative, Microsoft said it's made key improvements to identity and supply chain security.

• September 19, 2024 19 Sep'24

  Microsoft warns of Russian election threats, disinformation

  As the 2024 U.S. presidential election nears, Microsoft detailed new influence campaigns, such as fake videos aimed at discrediting Vice President Kamala Harris.

• September 19, 2024 19 Sep'24

  FBI disrupts another Chinese state-sponsored botnet

  The FBI said the massive botnet, which included 260,000 connected devices, was developed and operated by a publicly traded Chinese company named Integrity Technology Group.

• September 18, 2024 18 Sep'24

  Huntress warns of attacks on Foundation Software accounts

  The cybersecurity company observed a brute force attack campaign targeting Foundation customers that did not change default credentials in their accounting software.

• September 18, 2024 18 Sep'24

  Orca: AI services, models falling short on security

  New research from Orca Security shows that AI services and models in cloud contain a number of risks and security shortcomings that could be exploited by threat actors.

• September 17, 2024 17 Sep'24

  Infosec experts detail widespread Telegram abuse

  Cybersecurity vendors say threat activity on Telegram has grown rapidly in recent years, and they don't expect the arrest of founder and CEO Pavel Durov to change that trend.

• September 16, 2024 16 Sep'24

  Windows spoofing flaw exploited in earlier zero-day attacks

  Microsoft reveals that CVE-2024-43461, which was disclosed in September's Patch Tuesday, was previously exploited as a zero-day vulnerability in an attack chain.

• September 13, 2024 13 Sep'24

  Fortinet confirms data breach, extortion demand

  Fortinet confirmed that a threat actor stole data from a third-party cloud-based shared file drive, which affected a small number of customers, but many questions remain.

• September 12, 2024 12 Sep'24

  Mastercard to acquire Recorded Future for $2.65B

  Mastercard says the addition of threat intelligence vendor Recorded Future will bolster its cybersecurity services as threats against the financial sector continue to rise.

• September 11, 2024 11 Sep'24

  Microsoft: Zero-day vulnerability rolled back previous patches

  On Patch Tuesday, Microsoft addresses a critical zero-day vulnerability that reversed previous fixes for older vulnerabilities and put Windows 10 systems at risk.

• September 09, 2024 09 Sep'24

  Akira ransomware gang targeting SonicWall VPN accounts

  Arctic Wolf recently observed the Akira ransomware gang compromising SonicWall SSL VPN accounts, which could be connected to a critical vulnerability in SonicOS.

• September 06, 2024 06 Sep'24

  Ransomware rocked healthcare, public services in August

  Ransomware remained a highly disruptive threat last month, as notable attacks claimed victims in healthcare, technology, manufacturing and the public sector.

• September 04, 2024 04 Sep'24

  White House unveils plan to improve BGP security

  The Office of the National Cyber Director has published a roadmap for internet routing security that outlines recommendations for mitigating BGP hijacking and other threats.

• September 03, 2024 03 Sep'24

  FBI: North Korean hackers targeting cryptocurrency employees

  North Korean state-sponsored threat actors have been conducting successful social engineering campaigns against cryptocurrency employees over the last several months.

• August 29, 2024 29 Aug'24

  Russia's APT29 using spyware exploits in new campaigns

  A new report from Google TAG suggests that Russia's APT29 is using vulnerability exploits first developed from spyware vendors to target Mongolian government websites.

• August 28, 2024 28 Aug'24

  Infosec experts applaud DOJ lawsuit against Georgia Tech

  The Department of Justice joined a whistleblower lawsuit against Georgia Tech for allegedly misleading the Department of Defense about its cybersecurity posture.

• August 28, 2024 28 Aug'24

  Volt Typhoon exploiting Versa Director zero-day flaw

  Lumen Technologies researchers have observed exploitation of CVE-2024-39717 against four U.S. organizations in the ISP, MSP and IT sectors.

• August 27, 2024 27 Aug'24

  Infosec industry calls for more public sector collaboration

  As cyberattacks continue to rise, infosec professionals address the need to increase private and public sector partnerships to assist law enforcement operations.

• August 27, 2024 27 Aug'24

  Port of Seattle grappling with 'possible cyberattack'

  A possible cyberattack against Washington's Port of Seattle has caused significant service disruptions to airline travel at the Seattle-Tacoma International Airport.

• August 26, 2024 26 Aug'24

  Risk & Repeat: National Public Data breach questions remain

  The breach of National Public Data may have put billions of personal records at risk, but the scope of the attack and impact on consumers are still unclear.

• August 22, 2024 22 Aug'24

  GuidePoint talks ransomware negotiations, payment bans

  GuidePoint Security's Mark Lance discusses the current ransomware landscape and the steps that go into negotiating potential payments with cybercriminal gangs.

• August 22, 2024 22 Aug'24

  CrowdStrike exec refutes Action1 acquisition reports

  A CrowdStrike vice president said the cybersecurity giant had an exploratory group conversation with Action1 and then 'disengaged after a surface level conversation.'

• August 22, 2024 22 Aug'24

  NCC Group: Ransomware down in June, July YoY

  While ransomware activity in July increased from the previous month, NCC Group researchers found the number of attacks was much lower compared to earlier this year.

• August 21, 2024 21 Aug'24

  Microchip Technology discloses cyberattack, business delays

  The microprocessor manufacturer says it detected malicious activity in its network over the weekend, which disrupted business operations and impaired its ability to fulfill orders.

• August 20, 2024 20 Aug'24

  U.S. agencies attribute Trump campaign hack to Iran

  CISA, the FBI and the Office of the Director of National Intelligence attributed a recent hack-and-leak attack on former President Donald Trump's 2024 election campaign to Iran.

• August 19, 2024 19 Aug'24

  Microsoft to roll out mandatory MFA for Azure

  Following several high-profile attacks across the globe on MFA-less accounts, Microsoft will make the security measure mandatory for Azure sign-ins beginning in October.

• August 15, 2024 15 Aug'24

  July ransomware attacks slam public sector organizations

  The global IT outage caused by an errant CrowdStrike channel file update dominated security news last month. But there were still plenty of ransomware attacks to go around.

• August 15, 2024 15 Aug'24

  National Public Data confirms breach, scope unknown

  Reports suggest billions of personal records could have been compromised in the attack against data aggregator National Public Data, but the reality is more complicated.

• August 14, 2024 14 Aug'24

  GitHub Copilot Autofix tackles vulnerabilities with AI

  GitHub says Copilot Autofix drastically reduced the median time to remediate vulnerabilities in beta testing from 90 minutes for manual fixes to 28 minutes with the GenAI tool.

• August 13, 2024 13 Aug'24

  Law enforcement disrupts Radar/Dispossessor ransomware group

  The now-disrupted Radar/Dispossessor ransomware gang was launched in August 2023, and its members have targeted dozens of SMBs across critical sectors via dual extortion.

• August 12, 2024 12 Aug'24

  Risk & Repeat: Recapping Black Hat USA 2024

  Highlights from Black Hat USA 2024 include a keynote panel on securing election infrastructure as well as several sessions on potential threats against new AI technology.

• August 12, 2024 12 Aug'24

  Flashpoint CEO: Cyber, physical security threats converging

  Although Flashpoint is known for their cybersecurity threat intelligence services, the vendor also provides physical security intelligence to its clientele.

• August 09, 2024 09 Aug'24

  Evolving threat landscape influencing cyber insurance market

  Many aspects of cyber insurance were addressed throughout Black Hat USA 2024, including changes in the threat landscape that affect policies and coverage.

• August 08, 2024 08 Aug'24

  CrowdStrike, AI dominate conversation at Black Hat USA 2024

  Although the trend of vendors pitching AI-powered products nonstop has continued at Black Hat USA 2024, CrowdStrike and the recent IT outage was an even larger point of discussion.

• August 08, 2024 08 Aug'24

  Zenity CTO on dangers of Microsoft Copilot prompt injections

  Zenity's CTO describes how hidden email code can be used to feed malicious prompts to a victim's Copilot instance, leading to false outputs and even credential harvesting.

• August 08, 2024 08 Aug'24

  Wiz researchers hacked into leading AI infrastructure providers

  During Black Hat USA 2024, Wiz researchers discussed how they were able to infiltrate leading AI service providers and access confidential data and models across the platforms.

• August 07, 2024 07 Aug'24

  Akamai warns enterprises that VPN attacks will only increase

  During Black Hat USA 2024, Akamai's Ori David revealed new VPN post-exploitation techniques that open the attack vector to threat actors of all skill levels.

• August 07, 2024 07 Aug'24

  CISA: Election infrastructure has never been more secure

  CISA Director Jen Easterly emphasized at Black Hat 2024 that election stakeholders cannot be complacent because 'the threat environment has never been so complex.'

• August 07, 2024 07 Aug'24

  Veracode highlights security risks of GenAI coding tools

  At Black Hat USA 2024, Veracode's Chris Wysopal warned of the downstream effects of how generative AI tools are helping developers write code faster.

• August 07, 2024 07 Aug'24

  Nvidia AI security architect discusses top threats to LLMs

  Richard Harang, Nvidia's principal AI and ML security architect, said two of the biggest pain points for LLMs right now are insecure plugins and indirect prompt injections.

• August 07, 2024 07 Aug'24

  Researchers unveil AWS vulnerabilities, 'shadow resource' vector

  During a Black Hat USA 2024 session, Aqua Security researchers demonstrated how they discovered six cloud vulnerabilities in AWS services and a new attack vector.

• August 07, 2024 07 Aug'24

  CrowdStrike details errors that led to mass IT outage

  CrowdStrike's investigation into the recent defective update found that a 'confluence' of issues led to the release of the channel file last month, causing a mass IT outage.

• August 06, 2024 06 Aug'24

  Security framework to determine whether defenders are winning

  Columbia University researcher and longtime security practitioner Jason Healey will present at Black Hat USA a new framework to determine defensive advantage.

• August 05, 2024 05 Aug'24

  CrowdStrike fires back at Delta over outage allegations

  After Delta Air Lines said it would seek damages against CrowdStrike over last month's IT outage, the cybersecurity vendor's legal counsel warned it would 'respond aggressively.'

• August 01, 2024 01 Aug'24

  InfoSec community sounds off on CrowdStrike outage, next steps

  Security experts offered their thoughts on the recent IT outage, praising CrowdStrike's response time but saying the outage highlights issues in the software updating process.

• July 31, 2024 31 Jul'24

  Microsoft confirms DDoS attack disrupted cloud services

  Microsoft suffered a DDoS attack on Tuesday that caused massive outages for customers around the world.

• July 30, 2024 30 Jul'24

  Microsoft: Ransomware gangs exploiting VMware ESXi flaw

  VMware ESXi has proven to be a popular target for ransomware threat actors and a challenge for enterprises to patch.

• July 29, 2024 29 Jul'24

  How the Change Healthcare attack may affect cyber insurance

  UnitedHealth's Change Healthcare attack continued to show the devastating aftermath of supply chain attacks. Experts say it could change contingent language for future policies.

• July 26, 2024 26 Jul'24

  Researcher says deleted GitHub data can be accessed 'forever'

  Truffle Security researcher Joe Leon warned GitHub users that deleted repository data is never actually deleted, which creates an "enormous attack vector" for threat actors.

• July 26, 2024 26 Jul'24

  BitLocker workaround may offer aid for CrowdStrike customers

  CrowdStrike customers grappling with blue screens of death from the recent IT outage may be able to sidestep BitLocker encryption schemes and recover their Windows systems.

• July 26, 2024 26 Jul'24

  CrowdStrike: 97% of Windows sensors back online after outage

  While most Windows systems are back online after last week's outage, CrowdStrike CEO George Kurtz said the vendor remains 'committed to restoring every impacted system.'

• July 24, 2024 24 Jul'24

  KnowBe4 catches North Korean hacker posing as IT employee

  KnowBe4 says it hired a new principal security engineer for its internal AI team, but quickly detected suspicious activity originating from the employee's workstation.

• July 24, 2024 24 Jul'24

  CrowdStrike: Content validation bug led to global outage

  CrowdStrike said last week's global outage was caused by a bug in the Falcon platform's content validator, which missed a defective configuration update for its Windows sensor.

• July 23, 2024 23 Jul'24

  Risk & Repeat: Faulty CrowdStrike update causes global outage

  Friday's outage, which was caused by a defective CrowdStrike channel file update, resulted in significant disruptions for airlines, critical infrastructure and more.

• July 23, 2024 23 Jul'24

  Dragos: New ICS malware FrostyGoop abuses Modbus

  Dragos published research Tuesday unveiling an industrial control systems-focused malware it dubbed FrostyGoop that targets Modbus to disrupt critical infrastructure.

• July 22, 2024 22 Jul'24

  Microsoft: Faulty CrowdStrike update affected 8.5M devices

  Microsoft says less than 1% of all Windows machines were affected by a defective CrowdStrike Falcon update on Friday, but the disruption has been widespread.

• July 19, 2024 19 Jul'24

  Defective CrowdStrike update triggers mass IT outage

  A faulty update for CrowdStrike's Falcon platform crashed customers' Windows systems, causing outages at airlines, government agencies and other organizations across the globe.

• July 18, 2024 18 Jul'24

  Fin7 helps ransomware gangs with EDR bypass

  SentinelOne found the Russia-based cybercriminal group is helping other threat actors, including ransomware gangs, to evade detection with a custom tool named AvNeutralizer.

• July 18, 2024 18 Jul'24

  Judge tosses most of SEC's lawsuit against SolarWinds

  A judge dismissed many of the charges in the U.S. Securities and Exchange Commission's lawsuit against SolarWinds and its CISO, Timothy Brown, though some charges remain.

• July 18, 2024 18 Jul'24

  Amazon CISO discusses the company's cautious approach to AI

  At the recent AWS re:Inforce 2024 conference, Amazon CISO CJ Moses spoke about the risks and threats associated with new AI technology and how the cloud giant addresses them.

• July 17, 2024 17 Jul'24

  NullBulge threat actor targets software supply chain, AI tech

  SentinelOne published new research detailing NullBulge, an emerging ransomware actor that recently claimed to have stolen data from Disney's internal Slack channels.

• July 16, 2024 16 Jul'24

  Risk & Repeat: AT&T's Snowflake database breached

  AT&T disclosed a breach in which threat actors compromised the company's Snowflake instance and stole call and text records from 'nearly all' the company's cellular customers.

• July 15, 2024 15 Jul'24

  Experts weigh in on Snowflake database MFA features

  In response to a wave of recent attacks on customers, Snowflake introduces new authentication offerings that enable administrators to require MFA for all user accounts.

• July 12, 2024 12 Jul'24

  AT&T breach affects 'nearly all' customers' call, text records

  Fallout from the attacks on Snowflake customers continues as AT&T is the latest victim organization to disclose a data breach stemming from a compromised cloud instance.

• July 11, 2024 11 Jul'24

  Ransomware gangs increasingly exploiting vulnerabilities

  New research from Cisco Talos highlighted three of the most popular known vulnerabilities that were exploited by ransomware gangs for initial access during 2023 and 2024.

• July 10, 2024 10 Jul'24

  Check Point sheds light on Windows MSHTML zero-day flaw

  A Check Point Software Technologies researcher who discovered CVE-2024-38112 said the Windows spoofing vulnerability may have been exploited as far back at January 2023.

• July 09, 2024 09 Jul'24

  Microsoft fixes 2 zero-days in massive July Patch Tuesday

  Microsoft disclosed and patched a whopping 142 vulnerabilities in a busy Patch Tuesday that included two zero-day flaws under active exploitation in the wild.

• July 09, 2024 09 Jul'24

  Governments issue warning on China's APT40 attacks

  Government agencies say APT40 continues to pose significant risk to organizations across the globe by exploiting vulnerabilities in public-facing applications.

• July 09, 2024 09 Jul'24

  Risk & Repeat: Hacks, lies and LockBit

  Months after an international law enforcement effort disrupted the notorious ransomware-as-a-service operation, LockBit falsely claimed that it breached the U.S. Federal Reserve.

• July 08, 2024 08 Jul'24

  Ransomware hits CDK Global, public sector targets in June

  The prevalent threat continued to cause disruptions last month as city halls were forced to close and auto dealerships faced downstream effects after an attack against CDK Global.

• July 01, 2024 01 Jul'24

  Critical OpenSSH vulnerability could affect millions of servers

  Exploitation against CVE-2024-6387, which Qualys nicknamed 'regreSSHion,' could let attackers bypass security measures and gain root access to vulnerable servers.

• June 28, 2024 28 Jun'24

  TeamViewer breached by Russian state actor Midnight Blizzard

  TeamViewer says a Russian state-sponsored threat actor known as Midnight Blizzard gained accessed to the company's corporate network via compromised employee credentials.

• June 27, 2024 27 Jun'24

  Supply chain attacks conducted through Polyfill.io service

  In February, a Chinese company named Funnell bought the Polyfill.io domain, which sparked concerns in the infosec community about potential supply chain threats.

• June 26, 2024 26 Jun'24

  LockBit claim about hacking U.S. Federal Reserve fizzles

  Evolve Bank & Trust confirmed that it was affected by a cybersecurity-related incident, but has not yet said whether the LockBit ransomware gang was responsible.

• June 26, 2024 26 Jun'24

  MoveIt Transfer vulnerability targeted amid disclosure drama

  Progress Software's MoveIt Transfer is under attack again, just one year after a Clop ransomware actor exploited a different zero-day MoveIt flaw against thousands of customers.

• June 25, 2024 25 Jun'24

  CISA discloses breach of Chemical Security Assessment Tool

  The breach, which CISA first disclosed in March, stemmed from Ivanti zero-day vulnerabilities that a Chinese nation-state threat actor first exploited in January.

• June 24, 2024 24 Jun'24

  Corvus: Cyber insurance premiums see 'stabilization'

  Corvus Insurance's Peter Hedberg provided insight into the cyber insurance landscape after a tumultuous 2023 and what enterprises can expect moving forward.

• June 21, 2024 21 Jun'24

  Biden administration bans Kaspersky Lab products in US

  The Biden administration announced a ban on Kaspersky Lab products inside the United States due to the antivirus vendor's ties with the Russian government.

• June 20, 2024 20 Jun'24

  SolarWinds Serv-U vulnerability under attack

  The Centre for Cybersecurity Belgium observed exploitation against CVE-2024-28995, a high-severity vulnerability in SolarWind's Serv-U file transfer product.

• June 20, 2024 20 Jun'24

  Phoenix SecureCore UEFI firmware bug affects Intel processors

  Multiple Intel processors and hundreds of PC models are potentially vulnerable to a recently disclosed vulnerability in Phoenix SecureCore UEFI firmware.

• June 20, 2024 20 Jun'24

  How Amazon's decision to ditch Active Directory paid off

  Amazon's decision to build its own identity and access management system was an expensive one, but an infamous supply chain attack validated the move.

• June 18, 2024 18 Jun'24

  Risk & Repeat: Microsoft under fire again over Recall

  Microsoft made changes to its AI-driven Recall feature, but that didn't stop Congress from grilling company president Brad Smith during a House committee hearing.

• June 18, 2024 18 Jun'24

  EPAM denies link to Snowflake customer attacks

  EPAM, a Belarusian software company, said an investigation found no evidence that it was connected to recent attacks against Snowflake customer databases.

• June 17, 2024 17 Jun'24

  Alex Stamos on how to break the cycle of security mistakes

  In an interview, SentinelOne's Alex Stamos discussed the importance of security by design and why it needs to be applied to emerging technologies, including generative AI.

• June 14, 2024 14 Jun'24

  Congress grills Microsoft president over security failures

  Microsoft President Brad Smith testifies on a wide range of issues, including Chinese and Russian nation-state attacks, the controversial AI-powered Recall feature and more.

• June 13, 2024 13 Jun'24

  Microsoft's Recall changes might be too little, too late

  Criticism of Microsoft's Recall feature continues even after the software giant announced several updates to address concerns from the infosec community.

• June 12, 2024 12 Jun'24

  AWS touts security culture, AI protections at re:Inforce 2024

  AWS executives highlighted the company's longstanding security, which evoked comparisons to its chief cloud rival Microsoft and the recent Cyber Safety Review Board report.

• June 12, 2024 12 Jun'24

  Black Basta might have exploited Microsoft flaw as zero-day

  While investigating a ransomware attack, Symantec found evidence that suggests Black Basta threat actors exploited a Microsoft vulnerability as a zero-day.

• June 12, 2024 12 Jun'24

  Acronis XDR expands endpoint security capabilities for MSPs

  Extended detection and response capabilities for the Acronis platform can automatically lock accounts and generate incident summaries for MSPs looking for additional security.

• June 10, 2024 10 Jun'24

  Mandiant: 'Exposed credentials' led to Snowflake attacks

  According to new threat research, Mandiant is reporting that UNC5537 conducted attacks against Snowflake database customers at least as early as April 14.

• June 06, 2024 06 Jun'24

  Critical Progress Telerik vulnerability under attack

  Threat actors are targeting vulnerable Progress Telerik Report Server systems just days after a proof of concept was published detailing a vulnerability exploit chain.

• June 06, 2024 06 Jun'24

  Ransomware ravaged schools and cities in May

  The public sector took the brunt of ransomware in May, while another damaging attack against a healthcare company disrupted patient access to pharmacy services.

• June 05, 2024 05 Jun'24

  Risk & Repeat: Sorting out Snowflake's security mess

  This podcast episode discusses the recent attacks against Snowflake customers and a controversial report that claimed the cloud storage and analytics giant had been breached.

• June 04, 2024 04 Jun'24

  Tenable warns of vulnerability in Azure service tags

  Microsoft disagreed with Tenable's assessment, saying the security issue in Azure service tags is not a vulnerability and that additional authentication layers are required.

• June 03, 2024 03 Jun'24

  Mandiant: Ransomware investigations up 20% in 2023

  The cybersecurity company observed a sharp rise in activity on data leak sites in 2023 as well as an increase in ransomware actors using legitimate commercial tools during attacks.