News

News

• June 03, 2024 03 Jun'24

  Hugging Face tokens exposed, attack scope unknown

  After detecting unauthorized access on its Spaces platform, Hugging Face disclosed that customer secrets might have been exposed and began revoking access tokens.

• June 03, 2024 03 Jun'24

  Snowflake: No evidence of platform breach

  Snowflake on Saturday issued a joint statement with third-party investigators Mandiant and CrowdStrike denying reports that its platform had been breached.

• May 31, 2024 31 May'24

  Threat actor compromising Snowflake database customers

  A threat actor tracked as UNC5537 is using stolen credentials against Snowflake database customers to conduct data theft and extortion attacks, cloud security firm Mitiga said.

• May 30, 2024 30 May'24

  Law enforcement conducts 'largest ever' botnet takedown

  An international law enforcement effort called 'Operation Endgame' disrupted several infamous malware loaders and botnets used by ransomware gangs and other cybercriminals.

• May 29, 2024 29 May'24

  Check Point discovers vulnerability tied to VPN attacks

  While Check Point identified CVE-2024-24919 as the root cause behind recent attack attempts on its VPN products, it's unclear if threat actors gained access to customer networks.

• May 28, 2024 28 May'24

  Check Point warns of threat actors targeting VPNs

  Check Point said threat actors were targeting a small number of customers by attempting to compromise local VPN accounts that only utilized passwords for authentication.

• May 28, 2024 28 May'24

  How AI could bolster software supply chain security

  Supply chain risks have become more complicated and continue to affect a variety of organizations, but Synopsys' Tim Mackey believes AI could help create more secure software.

• May 23, 2024 23 May'24

  CISA executive director discusses CIRCIA, incident reporting

  CISA Executive Director Brandon Wales speaks with TechTarget Editorial to discuss CIRCIA and the importance of incident reporting to the larger cybersecurity ecosystem.

• May 23, 2024 23 May'24

  93% of vulnerabilities unanalyzed by NVD since February

  New research from VulnCheck shows the NIST's National Vulnerability Database has struggled to manage a growing number of reported vulnerabilities this year.

• May 22, 2024 22 May'24

  Arctic Wolf CPO: Most AI deployment is generic, 'pretty weak'

  Dan Schiappa, chief product officer at Arctic Wolf, said that while generative AI technology has enormous potential, many companies are deploying it for the wrong reasons.

• May 21, 2024 21 May'24

  Critical bug discovered in open source utility Fluent Bit

  Tenable researchers discovered a critical vulnerability, dubbed 'Linguistic Lumberjack,' in Fluent Bit, an open source logging utility widely used by major cloud providers.

• May 21, 2024 21 May'24

  Rapid7 warns of alarming zero-day vulnerability trends

  The cybersecurity vendor tracked vulnerabilities that were used by threat actors in mass compromise events and found more than half were exploited as zero days.

• May 20, 2024 20 May'24

  CyberArk to acquire Venafi from Thoma Bravo for $1.5B

  CyberArk said it intends to help enterprises with the growing number of machine identities, which the company said surpasses human identities by a ratio of 40 to 1.

• May 16, 2024 16 May'24

  What LockBitSupp charges mean for ransomware investigations

  At RSA Conference 2024, Recorded Future's Allan Liska discussed evolving ransomware trends and how authorities recently exposed the LockBit ransomware group ringleader.

• May 16, 2024 16 May'24

  IBM sells QRadar SaaS assets to Palo Alto Networks

  The deal with Palo Alto Networks comes one year after IBM announced QRadar Suite, an AI-enhanced security platform that combined existing SIEM and XDR products.

• May 15, 2024 15 May'24

  Risk & Repeat: Recapping RSA Conference 2024

  Artificial intelligence was center stage at RSA Conference 2024, but the show also focused on secure-by-design principles, the ransomware landscape and more.

• May 15, 2024 15 May'24

  AI-driven attacks seen as chief cloud security threat

  Tried and true cloud security threats are on the rise. But according to a new report from Palo Alto Networks, the specter of generative AI threats has organizations concerned.

• May 14, 2024 14 May'24

  Google discloses 2 zero-day vulnerabilities in less than a week

  Google released fixed versions to address the two vulnerabilities in its Chrome web browser, but the updates will roll out in stages with no specific dates available.

• May 14, 2024 14 May'24

  SonicWall CEO talks transformation, security transparency

  SonicWall's CEO said that following a string of serious vulnerabilities the company responded to in 2021, product development and quality assurance operations were overhauled.

• May 10, 2024 10 May'24

  US officials optimistic on AI but warn of risks, abuse

  Federal government leaders at RSA Conference 2024 touted the benefits of AI pilot programs but also outlined how a variety of threat actors are currently abusing the technology.

• May 09, 2024 09 May'24

  Dell 'security incident' might affect millions

  Dell notified customers that a company portal connected to customer data exposed orders, names and addresses, while reports indicate the data is now up for sale on the dark web.

• May 09, 2024 09 May'24

  'Secure by design' makes waves at RSA Conference 2024

  Cybersecurity vendors and public sector organizations heavily promoted the secure by design approach, particularly for generative AI tools and projects.

• May 08, 2024 08 May'24

  National Security Agency warns against paying ransoms

  Rob Joyce and David Luber, former and current directors of cybersecurity at the NSA, discuss how the ransomware attack on Change Healthcare exemplified the cons of paying ransoms.

• May 08, 2024 08 May'24

  Experts highlight progress, challenges for election security

  Infosec professionals at RSA Conference 2024 discuss digital and physical security challenges for election cycles across the globe in a post-COVID-19 landscape.

• May 08, 2024 08 May'24

  White House: Threats to critical infrastructure are 'severe'

  While the White House released the new National Cybersecurity Strategy last year to help combat threats to critical infrastructure organizations, attacks have continued.

• May 08, 2024 08 May'24

  Microsoft touts expansion of Secure Future Initiative

  At RSA Conference 2024, Microsoft vice president Vasu Jakkal discussed some of the criticisms leveled against the company and how the Secure Future Initiative will address them.

• May 07, 2024 07 May'24

  SentinelOne: Ransomware actors are adapting to EDR

  At RSA Conference 2024, SentinelOne's Alex Stamos discussed ongoing global threats such as ransomware and how threat actors are changing their techniques.

• May 07, 2024 07 May'24

  Authorities identify, sanction LockBit ransomware ringleader

  After weeks of waiting, authorities in the U.S., the U.K. and Australia publicly identified 'LockBitSupp,' the mysterious operator behind the prolific LockBit ransomware gang.

• May 07, 2024 07 May'24

  U.S. agencies continue to observe Volt Typhoon intrusions

  A panel of experts at RSA Conference 2024 discussed Volt Typhoon and warned the Chinese nation-state threat group is still targeting and compromising U.S. organizations.

• May 06, 2024 06 May'24

  Google unveils new threat intelligence service at RSAC 2024

  Google Threat Intelligence combines investigation findings from Mandiant with crowdsourced intelligence from VirusTotal and operationalizes the data with Google's Gemini AI model.

• May 06, 2024 06 May'24

  Recorded Future observes 'concerning' hacktivism shift

  At RSA Conference 2024, Recorded Future detailed alarming trends as nation-state attackers operate under the guise of hacktivism to cover real threats to organizations.

• May 06, 2024 06 May'24

  Splunk details Sqrrl 'screw-ups' that hampered threat hunting

  At RSA Conference 2024, Splunk's David Bianco emphasizes that enterprises need revamped threat hunting frameworks to help with threat detection and response challenges.

• May 06, 2024 06 May'24

  IBM study shows security for GenAI projects is an afterthought

  IBM's survey of C-suite executives finds that 82% say trustworthy and secure AI are essential, but only 24% have a security component included in their GenAI projects.

• May 06, 2024 06 May'24

  Cisco details Splunk security integrations, AI developments

  Just two months after Cisco completed its $28 billion acquisition of analytics giant Splunk, the company added XDR capabilities into Splunk Enterprise Security.

• May 02, 2024 02 May'24

  Dropbox discloses data breach involving Dropbox Sign

  A threat actor accessed Dropbox Sign customer names, emails, hashed passwords, API keys, OAuth tokens, multifactor authentication information and other data.

• May 01, 2024 01 May'24

  U.S. warns of pro-Russian hacktivist attacks against OT systems

  CISA calls on OT device manufacturers to implement more effective security protocols as attacks against critical infrastructure organizations continue.

• May 01, 2024 01 May'24

  Verizon DBIR: Vulnerability exploitation in breaches up 180%

  Verizon said it examined approximately twice as many breaches for the 2024 Data Breach Investigations Report -- 10,626 out of 30,458 total tracked incidents.

• April 30, 2024 30 Apr'24

  Change Healthcare breached via Citrix portal with no MFA

  UnitedHealth Group CEO Andrew Witty's opening statement for Wednesday's congressional hearing shed more light on the ransomware attack against Change Healthcare.

• April 25, 2024 25 Apr'24

  Risk & Repeat: Change Healthcare's bad ransomware bet

  This Risk & Repeat podcast discusses Change Healthcare's ransomware attack and the apparent further spread of sensitive data despite the company paying a ransom.

• April 25, 2024 25 Apr'24

  Dymium scares ransomware attacks with honeypot specters

  Dymium, a security startup that recently emerged from stealth, offers ransomware defense for data stores with a network of honeypot traps for spoofing attackers.

• April 25, 2024 25 Apr'24

  Cisco zero-day flaws in ASA, FTD software under attack

  Cisco revealed that a nation-state threat campaign dubbed 'ArcaneDoor' exploited two zero-day vulnerabilities in its Adaptive Security Appliance and Firepower Threat Defense products.

• April 24, 2024 24 Apr'24

  Critical CrushFTP zero-day vulnerability under attack

  While a patch is now available, a critical CrushFTP vulnerability came under attack as a zero-day and could allow attackers to exfiltrate all files on the server.

• April 24, 2024 24 Apr'24

  Coalition: Insurance claims for Cisco ASA users spiked in 2023

  Coalition urged enterprises to be cautious when using Cisco and Fortinet network boundary devices as attackers can leverage the attack vectors to gain initial access.

• April 24, 2024 24 Apr'24

  GitHub vulnerability leaks sensitive security reports

  The vulnerability is triggered when GitHub users correct code or other mistakes they discover on repositories. But GitHub does not believe it warrants a fix.

• April 23, 2024 23 Apr'24

  U.S. cracks down on commercial spyware with visa restrictions

  The move marks the latest effort by the U.S. government to curb the spread of commercial spyware, which has been used to target journalists, politicians and human rights activists.

• April 23, 2024 23 Apr'24

  Mandiant: Attacker dwell time down, ransomware up in 2023

  Mandiant's 'M-Trends' 2024 report offered positive signs for global cybersecurity but warned that threat actors are shifting to zero-day exploitation and evasion techniques.

• April 22, 2024 22 Apr'24

  Mitre breached by nation-state threat actor via Ivanti flaws

  An unnamed nation-state threat actor breached Mitre through two Ivanti Connect Secure zero-day vulnerabilities, CVE-2023-46805 and CVE-2024-21887, disclosed earlier this year.

• April 19, 2024 19 Apr'24

  CISA: Akira ransomware extorted $42M from 250+ victims

  The Akira ransomware gang, which utilizes sophisticated hybrid encryption techniques and multiple ransomware variants, targeted vulnerable Cisco VPNs in a campaign last year.

• April 18, 2024 18 Apr'24

  Cisco discloses high-severity vulnerability, PoC available

  The security vendor released fixes for a vulnerability that affects Cisco Integrated Management Controller, which is used by devices including routers and servers.

• April 18, 2024 18 Apr'24

  CrowdStrike extends cloud security to Mission Cloud customers

  CrowdStrike Falcon Cloud Security and Falcon Complete Cloud Detection and Response (CDR) will be made available through the Mission Cloud One AWS MSP platform.

• April 17, 2024 17 Apr'24

  Mandiant upgrades Sandworm to APT44 due to increasing threat

  Over the past decade, Sandworm has been responsible for high-severity attacks that highlight the group's persistence, evasion techniques and threat to government bodies.

• April 16, 2024 16 Apr'24

  OT security vendor Nozomi Networks lands Air Force contract

  Nozomi Networks CEO Edgard Capdevielle said the $1.25 million contract will be a guarantee that 'our products will continue to meet the requirements of the Air Force.'

• April 12, 2024 12 Apr'24

  CISA: Midnight Blizzard obtained federal agency emails

  CISA ordered U.S. federal agencies to reset any credentials exposed by Midnight Blizzard's breach against Microsoft and notify CISA in the case of a known or suspected compromise.

• April 12, 2024 12 Apr'24

  Palo Alto Networks discloses RCE zero-day vulnerability

  Threat actors have exploited the remote code injection flaw, which affects the GlobalProtect gateway in Palo Alto Networks' PAN-OS software, in a 'limited' number of attacks.

• April 11, 2024 11 Apr'24

  CISA discloses Sisense breach, customer data compromised

  CISA is investigating a breach of data analytics vendor Sisense that may have exposed customers' credentials and secrets and could impact critical infrastructure organizations.

• April 10, 2024 10 Apr'24

  Supply chain attack abuses GitHub features to spread malware

  Checkmarx warned developers to be cautious when choosing which repositories to use, as attackers are manipulating GitHub features to boost malicious code.

• April 09, 2024 09 Apr'24

  Unit 42: Malware-initiated scanning attacks on the rise

  Palo Alto Networks' research team warned of threat actors compromising one victim and then using that victim's resources to discreetly scan for vulnerabilities on other systems.

• April 09, 2024 09 Apr'24

  Why the Keitaro TDS keeps causing security headaches

  Keitaro insists it is on the side of the law, but threat actors continue to flock to the software company's traffic distribution system to redirect users to malicious domains.

• April 08, 2024 08 Apr'24

  Flaws in legacy D-Link NAS devices under attack

  Internet scans show threat actors are targeting CVE-2024-3273 in thousands of end-of-life D-Link NAS devices, and exploitation requires no authentication.

• April 05, 2024 05 Apr'24

  Risk & Repeat: Cyber Safety Review Board takes Microsoft to task

  This podcast episode discusses the Cyber Safety Review Board's report on Microsoft and its conclusion that the software giant must overhaul its security culture.

• April 04, 2024 04 Apr'24

  Ransomware attacks ravaged municipal governments in March

  Many municipalities across the U.S. faced network outages, data breaches and large ransom demands following a flurry of ransomware attacks last month.

• April 04, 2024 04 Apr'24

  Infosec professionals praise CSRB report on Microsoft breach

  Security professionals and executives weigh in on how the Cyber Safety Review Board handled its investigation into Microsoft and what it could mean for the tech giant.

• April 03, 2024 03 Apr'24

  Sophos: Ransomware present in 70% of IR investigations

  Sophos' Active Adversary Report said securing remote desktop protocols and Active Directories and hardening credentials can help limit the influx of successful ransomware attacks.

• April 03, 2024 03 Apr'24

  Cyber Safety Review Board slams Microsoft security failures

  The Department of Homeland Security's Cyber Safety Review Board said a 'cascade' of errors at Microsoft allowed nation-state hackers to access U.S. government emails last year.

• April 03, 2024 03 Apr'24

  Trend Micro: LockBit ransomware gang's comeback is failing

  LockBit is struggling to resume operations in part due to the name-and-shame aspect of the international law enforcement operation responsible for the gang's disruption.

• April 02, 2024 02 Apr'24

  Microsoft Copilot for Security brings GenAI to SOC teams

  Microsoft's latest AI-powered tool, now generally available, has been beneficial for security teams regarding efficiency, but infosec experts see some room for improvements.

• April 01, 2024 01 Apr'24

  XZ backdoor discovery reveals Linux supply chain attack

  A maintainer for XZ, a popular open source compression library for Linux distributions, compromised the open source project over the course of two years.

• March 29, 2024 29 Mar'24

  Typosquatting campaign, malicious packages slam PyPI

  Threat actors used automated typosquatting attacks to lead victims to malicious python packages in yet another campaign targeting the open-source software supply chain.

• March 27, 2024 27 Mar'24

  Spyware vendors behind 75% of zero-days targeting Google

  Google observed 97 zero-day vulnerabilities exploited in the wild last year, which was more than a 50% increase over the 62 exploited zero-day vulnerabilities tracked in 2022.

• March 27, 2024 27 Mar'24

  Unpatched flaw in Anyscale's Ray AI framework under attack

  Oligo Security researchers say thousands of Ray servers have been compromised through the flaw, but Anyscale said it has received no reports of exploitation.

• March 27, 2024 27 Mar'24

  Flashpoint observes 84% surge in ransomware attacks in 2023

  The threat intelligence vendor anticipates that enterprises will continue to face increases in ransomware activity and data breaches in 2024, with some silver linings ahead.

• March 26, 2024 26 Mar'24

  SQL injection vulnerability in Fortinet software under attack

  Fortinet and CISA confirmed CVE-2023-48788 is being actively exploited. But the Shadowserver Foundation found that many vulnerable instances remain online.

• March 26, 2024 26 Mar'24

  Top.gg supply chain attack highlights subtle risks

  Threat actors used fake Python infrastructure and cookie stealing to poison multiple GitHub code repositories, putting another spotlight on supply chain risks.

• March 22, 2024 22 Mar'24

  'GoFetch' attack spells trouble for Apple M-series chips

  Academic researchers discovered a hardware optimization feature called 'data memory-dependent prefetcher' could be abused to extract secret encryption keys from vulnerable systems.

• March 21, 2024 21 Mar'24

  AWS fixes 'FlowFixation' vulnerability for account hijacking

  A Tenable researcher discovered a session fixation flaw in AWS Managed Workflows for Apache Airflow that, combined with a misconfiguration, could enable account hijacking.

• March 21, 2024 21 Mar'24

  NCC Group: Ransomware attacks jump 73% in February

  While NCC Group expected an increase in ransomware attacks from January to February, year-over-year data showed just how persistent the threat is to enterprises.

• March 20, 2024 20 Mar'24

  CISA urges defensive actions against Volt Typhoon threats

  The U.S. cybersecurity agency advised critical infrastructure leaders to adopt several best practices and defensive measures to protect against Chinese state-sponsored attacks.

• March 19, 2024 19 Mar'24

  Risk & Repeat: Microsoft's Midnight Blizzard mess

  This podcast episode discusses the latest disclosure from Microsoft regarding Midnight Blizzard, which accessed internal systems, source code and some cryptographic secrets.

• March 18, 2024 18 Mar'24

  Exploitation activity increasing on Fortinet vulnerability

  The Shadowserver Foundation recently saw an increase in exploitation activity for CVE-2024-21762, two days after a proof-of-concept exploit was published.

• March 14, 2024 14 Mar'24

  JetBrains, Rapid7 clash over vulnerability disclosure policies

  In a blog post this week, JetBrains argued that attacks on TeamCity customers were the result of Rapid7 publishing the full technical details of two critical vulnerabilities.

• March 13, 2024 13 Mar'24

  Risk & Repeat: CISA hacked via Ivanti vulnerabilities

  The compromise of two internal CISA systems comes on the heels of ongoing attacks and developments related to two zero-day vulnerabilities Ivanti disclosed in January.

• March 12, 2024 12 Mar'24

  Sophos: Remote ransomware attacks on SMBs increasing

  According to new research from Sophos, small businesses are seeing a rise in threats such as remotely executed ransomware attacks, malvertising, driver abuse and more.

• March 12, 2024 12 Mar'24

  LockBit attacks continue via ConnectWise ScreenConnect flaws

  Coalition is latest company to confirm LockBit activity against vulnerable ScreenConnect instances. But the insurer found significant differences between previous LockBit attacks.

• March 11, 2024 11 Mar'24

  CISA confirms compromise of its Ivanti systems

  CISA said that approximately one month ago, it identified 'activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses.'

• March 08, 2024 08 Mar'24

  Midnight Blizzard accessed Microsoft systems, source code

  Microsoft said Midnight Blizzard used data stolen from a breach of its corporate email system to access other parts of the company's network, including source code repositories.

• March 07, 2024 07 Mar'24

  Risk & Repeat: Alphv/BlackCat's chaotic exit (scam)

  This podcast episode discusses the possible exit scam of ransomware-as-a-service gang Alphv/BlackCat, as well as the chaotic months the gang had leading up to its closure.

• March 07, 2024 07 Mar'24

  Former Google engineer charged with stealing AI trade secrets

  Linwei Ding, a Chinese national, allegedly evaded Google's data loss prevention systems and stole confidential information to start his own China-based AI company.

• March 06, 2024 06 Mar'24

  Apple discloses 2 iOS zero-day vulnerabilities

  CVE-2024-23225 and CVE-2024-23296, which bypass kernel memory protections, mark the second and third zero-day vulnerabilities that Apple has disclosed and patched this year.

• March 05, 2024 05 Mar'24

  Alphv/BlackCat leak site goes down in possible exit scam

  An Alphv/BlackCat affiliate accused the ransomware gang of stealing a ransom payment worth more than $20 million that may have been obtained in the Change Healthcare attack.

• March 05, 2024 05 Mar'24

  Critical JetBrains TeamCity vulnerabilities under attack

  Exploitation activity has started against two vulnerabilities in JetBrains TeamCity, which has been targeted previously by nation-state threat actors such as Russia's Cozy Bear.

• March 05, 2024 05 Mar'24

  Inside an Alphv/BlackCat ransomware attack

  Sygnia researchers investigated an intrusion in a client's network and discovered an Alphv/BlackCat ransomware actor had been lurking in the environment for weeks.

• March 04, 2024 04 Mar'24

  Infosec pros weigh in on proposed ransomware payment bans

  Whether for or against a payment ban, security professionals are concerned regulations could negatively affect victims and result in fewer incident disclosures.

• March 04, 2024 04 Mar'24

  LockBit, Alphv/BlackCat highlight February ransomware activity

  With events surrounding the LockBit and Alphv/BlackCat gangs and the ConnectWise ScreenConnect flaws, ransomware activity continues this year after a surge in 2023.

• February 29, 2024 29 Feb'24

  CISA warns Ivanti ICT ineffective for detecting compromises

  CISA observed ongoing exploitation against four Ivanti vulnerabilities and found problems with the vendor's Integrity Checker Tool, which is designed to detect compromises.

• February 29, 2024 29 Feb'24

  AWS on why CISOs should track 'the metric of no'

  AWS' Clarke Rodgers believes that tracking the number of times CISOs say no to line-of-business requests will ultimately help them build a stronger security culture.

• February 28, 2024 28 Feb'24

  Alphv/BlackCat attacking hospitals following FBI takedown

  The ransomware attacks against hospitals and the healthcare sector come after law enforcement agencies, led by the FBI, disrupted Alphv/BlackCat's network in December.

• February 27, 2024 27 Feb'24

  Risk & Repeat: LockBit resurfaces after takedown

  LockBit returns just days after an international law enforcement operation infiltrated the ransomware gang's network and seized infrastructure, source code and decryption keys.

• February 27, 2024 27 Feb'24

  Ransomware gangs exploiting ConnectWise ScreenConnect flaws

  Ransomware activity is ramping up against vulnerable ScreenConnect systems as Black Basta and Bl00dy threat actors were observed exploiting the vulnerabilities.

• February 26, 2024 26 Feb'24

  LockBit restores servers following law enforcement takedown

  Law enforcement agencies last week announced a takedown of the LockBit ransomware gang that involved the seizure of servers, websites and decryption keys, as well as two arrests.

• February 26, 2024 26 Feb'24

  CISA: APT29 targeting cloud accounts for initial access

  U.K. and U.S. government agencies have observed the Russian nation-state group increasingly target dormant and inactive cloud service accounts to gain initial access.