News

News

• September 06, 2023 06 Sep'23

  Okta: 4 customers compromised in social engineering attacks

  Okta said a threat actor convinced IT personnel at several customers to reset MFA factors for highly privileged users, though it's unclear how they accomplished that task.

• September 05, 2023 05 Sep'23

  Ransomware attacks on education sector spike in August

  While data breach notifications for MoveIt Transfer customers continued to rise, August also saw ransomware ramp up against schools and universities as classes resumed.

• August 30, 2023 30 Aug'23

  Risk & Repeat: Digging into Microsoft security criticisms

  Executives, researchers and former employees told TechTarget Editorial about issues with Microsoft security practices, including patch bypasses, poor transparency and more.

• August 30, 2023 30 Aug'23

  FBI, Justice Department dismantle Qakbot malware

  The FBI operation, one of the largest U.S.-led botnet disruption efforts ever, included international partners such as France, Germany, the Netherlands and the United Kingdom.

• August 30, 2023 30 Aug'23

  CrowdStrike CTO: 'Rookie mistakes' are hurting cloud security

  CrowdStrike's Elia Zaitsev discusses the rise in credential-based attacks, as well as the common errors organizations make in the cloud that often lead to breaches.

• August 29, 2023 29 Aug'23

  Mandiant reveals new backdoors used in Barracuda ESG attacks

  Further investigations show threat actors were prepared for Barracuda Networks' remediation efforts, including an action notice to replace all compromised devices.

• August 29, 2023 29 Aug'23

  Cisco VPNs under attack via Akira, LockBit ransomware

  Cisco and Rapid7 say ransomware actors LockBit and Akira have apparently been targeting Cisco VPNs not configured for multifactor authentication.

• August 25, 2023 25 Aug'23

  CloudNordic loses most customer data after ransomware attack

  The Danish cloud host said the ransomware attack it suffered last week 'has paralyzed CloudNordic completely' and that 'it has proved impossible' to recover more customer data.

• August 24, 2023 24 Aug'23

  FBI: Suspected Chinese actors continue Barracuda ESG attacks

  The alert comes after Barracuda Networks issued an advisory stating that patches for CVE-2023-2868 were insufficient and all affected ESG devices need to be replaced.

• August 23, 2023 23 Aug'23

  Sophos: RDP played a part in 95% of attacks in H1 2023

  While Sophos observed increasing activity around Active Directory and Remote Desktop Protocol abuse, it recommended simple mitigation steps can limit the attack surface.

• August 23, 2023 23 Aug'23

  Google launches AI-powered data classification for Workspace

  Available now in preview, the new capability can automatically label files across a customer's Drive environment to protect data from exposure and exfiltration.

• August 22, 2023 22 Aug'23

  Ivanti issues fix for third zero-day flaw exploited in the wild

  CVE-2023-38035 is the latest Ivanti zero-day vulnerability to be exploited in the wild. The vendor has released a series of remediation recommendations.

• August 21, 2023 21 Aug'23

  Vendors criticize Microsoft for repeated security failings

  Microsoft is facing frustration for numerous security issues, including problematic transparency, numerous patch bypasses and inconsistent communication practices.

• August 17, 2023 17 Aug'23

  CISA, vendors warn Citrix ShareFile flaw under attack

  A vulnerability in the managed file transfer product that enterprises use is being actively exploited two months after Citrix released a fix.

• August 17, 2023 17 Aug'23

  Risk & Repeat: Highlights from Black Hat USA 2023

  Black Hat USA 2023 in Las Vegas covered several trends, such as generative AI and cloud security issues, as well as new vulnerabilities, including the Downfall flaw in Intel chips.

• August 10, 2023 10 Aug'23

  CISA shares 'secure by design' plan for US tech ecosystem

  The cyber agency plans to establish secure-by-design principles through internal and external communications, data collection and education for the next generation.

• August 10, 2023 10 Aug'23

  Palo Alto: SugarCRM zero-day reveals growing cloud threats

  Recent incident response investigations reveal that attackers are becoming more advanced when it comes to the cloud, but there are steps enterprises can take to mitigate risks.

• August 10, 2023 10 Aug'23

  Kemba Walden: We need to secure open source software

  During her Black Hat USA 2023 keynote, the acting national cyber director said the White House wants to develop realistic policies to improve the security of open source software.

• August 10, 2023 10 Aug'23

  Trend Micro discloses 'silent threat' flaws in Azure ML

  During a Black Hat 2023 session, Trend Micro researchers discussed several vulnerabilities they discovered in Azure Machine Learning that allow sensitive information disclosure.

• August 10, 2023 10 Aug'23

  U.S., Ukraine cyber leaders talk resilience, collaboration

  At Black Hat 2023, CISA's Jen Easterly and Ukraine's Victor Zhora discuss cyber resilience and security hardening in the face of destructive cyber campaigns.

• August 10, 2023 10 Aug'23

  Researchers put LLMs to the test in phishing email experiment

  A Black Hat USA 2023 session discussed an experiment that used large language models to see how effective the technology can be in both detecting and producing phishing emails.

• August 09, 2023 09 Aug'23

  Generative AI takes center stage at Black Hat USA 2023

  About one year after generative AI launched into the spotlight, the technology is showing early signs of potential for security at Black Hat USA 2023 in Las Vegas.

• August 09, 2023 09 Aug'23

  Coalition looks to bridge gap between CISOs, cyber insurance

  While carriers and CISOs agree cyber insurance has contributed to better security postures, Coalition said the relationship needs to stronger as threat evolve and intensify.

• August 09, 2023 09 Aug'23

  Wiz warns of exposed multi-tenant apps in Azure AD

  During a Black Hat USA 2023 session, a Wiz researcher explained how a common misconfiguration in Azure Active Directory led to the exposure of nearly 1,300 applications.

• August 09, 2023 09 Aug'23

  Onapsis researchers detail new SAP security threats

  At Black Hat 2023, Onapsis researchers demonstrated how attackers could chain a series of SAP vulnerabilities impacting the P4 protocol to gain root access to a target network.

• August 09, 2023 09 Aug'23

  Tenable launches LLM-powered ExposureAI product

  ExposureAI will be integrated into Tenable One, the vendor's encompassing exposure management platform, and is the latest cybersecurity produce to employ large language models.

• August 08, 2023 08 Aug'23

  Google unveils 'Downfall' attacks, vulnerability in Intel chips

  Google researcher Daniel Moghimi first reported CVE-2022-40982 and the resulting data leak attacks to Intel in August 2022, but it's taken nearly 12 months to disclose the flaw.

• August 08, 2023 08 Aug'23

  CrowdStrike observes massive spike in identity-based attacks

  Identity-based attacks like Kerberoasting saw massive increases over the last 12 months as adversary breakout time fell, according to CrowdStrike's 2023 Threat Hunting Report.

• August 07, 2023 07 Aug'23

  Google to discuss LLM benefits for threat intelligence programs

  Large language models are the backbone of generative AI products launching in the security space. Google will discuss how best to integrate the technology at this week's Black Hat USA.

• August 03, 2023 03 Aug'23

  MoveIt Transfer attacks dominate July ransomware disclosures

  Traditional ransomware attacks took a back seat last month, as Clop operators continued to claim victims from the zero-day attacks on MoveIt Transfer customers.

• August 03, 2023 03 Aug'23

  Risk & Repeat: Microsoft takes heat over Storm-0558 attacks

  The Storm-0558 attacks have raised questions about Microsoft's response to a cloud flaw and a stolen MSA key that was used to compromise customer email accounts.

• August 01, 2023 01 Aug'23

  Infosec experts divided on SEC four-day reporting rule

  Professionals in the cybersecurity industry voiced concerns and praises of new incident disclosure rules that allow companies four days to report a "material" cyber attack.

• July 31, 2023 31 Jul'23

  CISA details backdoor malware used in Barracuda ESG attacks

  CISA said Friday that 'Submarine' is a novel persistent backdoor used in attacks against Barracuda Email Security Gateway appliances vulnerable to CVE-2023-2868.

• July 27, 2023 27 Jul'23

  Google: 41 zero-day vulnerabilities exploited in 2022

  While attackers increasingly exploited zero-day flaws last year, one of the most notable findings from the report emphasized how inadequate patches led to new variants.

• July 25, 2023 25 Jul'23

  Thoma Bravo sells Imperva to Thales Group for $3.6B

  With the acquisition, Thales looks to expand its Digital Security and Identity business with an increased focus on protecting web applications and API.

• July 25, 2023 25 Jul'23

  Ivanti EPMM zero-day vulnerability exploited in wild

  A zero-day authentication bypass vulnerability in Ivanti Endpoint Manager Mobile was exploited in a cyber attack against a Norwegian government agency.

• July 24, 2023 24 Jul'23

  Coveware: Rate of victims paying ransom continues to plummet

  Incident response firm Coveware said 34% of ransomware victims paid the ransom in Q2 2023, a sharp decline from last quarter and an enormous decline from 2020 and 2019.

• July 24, 2023 24 Jul'23

  Mandiant: JumpCloud breach led to supply chain attack

  Mandiant researchers attribute the supply chain attack to a North Korean threat actor that abused JumpCloud's commands framework to gain access to a downstream customer.

• July 20, 2023 20 Jul'23

  Risk & Repeat: Are data extortion attacks ransomware?

  Ransomware gangs are focusing more on data theft and extortion, while skipping the encryption of networks. But should these attacks still be considered ransomware?

• July 20, 2023 20 Jul'23

  Cyber insurers adapting to data-centric ransomware threats

  Cyber insurance carriers and infosec vendors weigh in on how the shift in ransomware tactics is affecting policies and coverage, presenting challenges for enterprises.

• July 19, 2023 19 Jul'23

  Microsoft to expand free cloud logging following recent hacks

  Microsoft faced criticism over a lack of free cloud log data after a China-based threat actor compromised email accounts of several organizations, including some federal agencies.

• July 19, 2023 19 Jul'23

  Citrix NetScaler ADC and Gateway flaw exploited in the wild

  Critical remote code execution flaw CVE-2023-3519 was one of three vulnerabilities in Citrix's NetScaler ADC and Gateway. Customers are urged to patch their instances.

• July 18, 2023 18 Jul'23

  Multiple Adobe ColdFusion flaws exploited in the wild

  One of the Adobe ColdFusion flaws exploited in the wild, CVE-2023-38203, was a zero-day bug that security vendor Project Discovery inadvertently published.

• July 18, 2023 18 Jul'23

  Orca: Google Cloud design flaw enables supply chain attacks

  Orca Security says threat actors can use a design flaw in Google Cloud Build's default permissions to gain access to Artifact Registry code repositories and poison software.

• July 17, 2023 17 Jul'23

  Microsoft still investigating stolen MSA key from email attacks

  While Microsoft provided additional attack details and techniques used by Storm-0558, it remains unclear how the Microsoft account signing key was acquired.

• July 17, 2023 17 Jul'23

  JumpCloud breached by nation-state threat actor

  JumpCloud's mandatory API key rotation earlier this month was triggered by a breach at the hands of a nation-state threat actor that gained access through spear phishing.

• July 14, 2023 14 Jul'23

  XSS zero-day flaw in Zimbra Collaboration Suite under attack

  A manual workaround is currently available for a cross-site scripting vulnerability in Zimbra Collaboration Suite, though a patch won't be available until later this month.

• July 13, 2023 13 Jul'23

  Microsoft: Government agencies breached in email attacks

  While Microsoft mitigated the attacks and found no evidence of further access beyond the email accounts, the Outlook breaches raised questions for the software giant.

• July 12, 2023 12 Jul'23

  Chainalysis observes sharp rise in ransomware payments

  The rise in total ransomware payments so far this year is a reversal of the decline Chainalysis saw in 2022, when payments fell sharply to $457 million from $766 million in 2021.

• July 12, 2023 12 Jul'23

  Threat actors forged Windows driver signatures via loophole

  Threat actors bypassed Microsoft's driver signing policy using a technical loophole and signature timestamp forging tools commonly used in the video game cheat community.

• July 12, 2023 12 Jul'23

  Russia-based actor exploited unpatched Office zero day

  Microsoft investigated an ongoing phishing campaign that leverages Word documents to deliver malicious attachments to targeted organizations in the U.S. and Europe.

• July 11, 2023 11 Jul'23

  Risk & Repeat: How bad is Clop's MoveIt Transfer campaign?

  Clop's data theft and extortion campaign against MoveIt Transfer customers marks some of the most high-profile threat activity this year, but its success level remains unclear.

• July 11, 2023 11 Jul'23

  Clop's MoveIt Transfer attacks lead to mixed results

  Clop's data theft extortion campaign against MoveIt Transfer customers has apparently compromised hundreds of organizations. But it's unclear how many victims have paid ransoms.

• July 10, 2023 10 Jul'23

  TPG Capital acquires Forcepoint's government unit for $2.45B

  Forcepoint's Global Governments and Critical Infrastructure unit will operate independently under TPG, while the commercial business will remain at Francisco Partners.

• July 06, 2023 06 Jul'23

  CISA: Truebot malware infecting networks in U.S., Canada

  CISA warned of Truebot attacks in a joint advisory alongside the FBI, the Canadian Centre for Cyber Security and the Multi-State Information Sharing and Analysis Center.

• July 06, 2023 06 Jul'23

  JumpCloud invalidates API keys in response to ongoing incident

  The cloud provider did not give any details about the incident that prompted a mandatory API key rotation, which might have caused service disruptions for customers.

• July 05, 2023 05 Jul'23

  June saw flurry of ransomware attacks on education sector

  As the school year culminated, ransomware attacks surged across K-12 schools and universities, causing class disruptions and putting sensitive data at risk.

• June 30, 2023 30 Jun'23

  TSMC partner breached by LockBit ransomware gang

  A cyber attack against Chinese systems integrator Kinmax led to the theft of TSMC proprietary data, which LockBit threatened to publish unless TSMC paid a $70 million ransom.

• June 28, 2023 28 Jun'23

  DDoS attacks surging behind new techniques, geopolitical goals

  A rise in massive DDoS attacks, some of which target the application layer and cause significant disruptions, might require new defense strategies from cybersecurity vendors.

• June 27, 2023 27 Jun'23

  Censys finds hundreds of exposed devices in federal orgs

  Censys found exposed instances of Progress Software's MoveIt Transfer and Barracuda Networks' Email Security Gateway appliances during its analysis of FCEB agency networks.

• June 27, 2023 27 Jun'23

  ChatGPT users at risk for credential theft

  As ChatGPT's user base continues to grow, Group-IB says threat actors have exploited stolen accounts to collect users' sensitive data and professional credentials.

• June 22, 2023 22 Jun'23

  Apple patches zero days used in spyware attacks on Kaspersky

  Two Apple zero days were used in the spyware campaign Kaspersky Lab named 'Operation Triangulation,' which was initially discovered on iOS devices of Kaspersky employees.

• June 21, 2023 21 Jun'23

  Critical VMware Aria Operations bug under active exploitation

  Reports of exploitation for a critical command injection flaw in VMware Aria Operations for Networks came roughly a week after a researcher published a proof-of-concept for it.

• June 21, 2023 21 Jun'23

  May ransomware activity rises behind 8base, LockBit gangs

  LockBit was the most active group last month, but NCC Group researchers were surprised by 8base, which started listing victims from attacks that occurred beginning in April 2022.

• June 20, 2023 20 Jun'23

  Risk & Repeat: More victims emerge from MoveIt Transfer flaw

  CISA last week said several federal agencies suffered data breaches resulting from a MoveIt Transfer zero-day vulnerability, though it's unclear what type of data was stolen.

• June 20, 2023 20 Jun'23

  Attackers discovering exposed cloud assets within minutes

  Cloud security vendor Orca Security used honeypots to learn more about how threat actors compromise cloud resources such as misconfigured AWS S3 buckets and GitHub repositories.

• June 19, 2023 19 Jun'23

  Microsoft: DDoS attacks caused M365, Azure disruptions

  Microsoft confirmed widespread service disruptions earlier this month were caused by layer 7 DDoS attacks by a threat group it identified as Storm-1359.

• June 16, 2023 16 Jun'23

  U.S. government agencies breached via MoveIt Transfer flaw

  CISA Director Jen Easterly said 'several' U.S. agencies suffered intrusions via their MoveIt Transfer instances, but have not seen significant effects from the attacks.

• June 15, 2023 15 Jun'23

  Risk & Repeat: Mandiant sheds light on Barracuda ESG attacks

  Barracuda Networks attempted to fix the critical ESG zero-day vulnerability, but a Chinese nation-state threat actor was able to maintain access on compromised devices.

• June 15, 2023 15 Jun'23

  Chinese nation-state actor behind Barracuda ESG attacks

  Mandiant said the zero-day attacks on Barracuda Email Security Gateway appliances were part of a 'wide-ranging campaign in support of the People's Republic of China.'

• June 14, 2023 14 Jun'23

  State governments among victims of MoveIT Transfer breach

  The Clop ransomware gang, which claimed responsibility for multiple data breaches tied to the MoveIT Transfer flaw, said it would delete data stolen from government agencies.

• June 13, 2023 13 Jun'23

  AWS launches EC2 Instance Connect Endpoint, Verified Permissions

  At re:Inforce 2023, AWS launched a new service that allows customers to connect to their EC2 instances through SSH and RDP connections, removing the need for a public IP address.

• June 13, 2023 13 Jun'23

  Fortinet warns critical VPN vulnerability 'may' be under attack

  Fortinet said the heap buffer overflow flaw might have been exploited already and warned that Chinese nation-state threat group Volt Typhoon would likely attack the vulnerability.

• June 13, 2023 13 Jun'23

  Mandiant: New VMware ESXi zero-day used by Chinese APT

  VMware said the ESXi flaw was 'low severity' despite being under active exploitation because it requires the attacker to already have gained root access on the target's system.

• June 12, 2023 12 Jun'23

  MoveIT Transfer attacks highlight SQL injection risks

  Security vendors say SQL injection flaws, like the zero-day vulnerability recently disclosed by Progress Software, can be challenging for companies to identify and resolve.

• June 08, 2023 08 Jun'23

  Risk & Repeat: Moveit Transfer flaw triggers data breaches

  Several organizations, predominantly in the U.K., have confirmed data breaches that stemmed from exploitation of the critical Moveit Transfer zero-day vulnerability.

• June 08, 2023 08 Jun'23

  Barracuda: Replace vulnerable ESG devices 'immediately'

  Customers with email security gateway appliances affected by a recent zero-day flaw, CVE-2023-2868, are being urged to replace devices, even if the hardware has been patched.

• June 08, 2023 08 Jun'23

  MoveIt Transfer flaw leads to wave of data breach disclosures

  Organizations that have confirmed a data breach tied to the critical MoveIt flaw disclosed in May include the government of Nova Scotia, the BBC and HR software firm Zellis.

• June 07, 2023 07 Jun'23

  What generative AI's rise means for the cybersecurity industry

  ChatGPT's moment in cybersecurity is significant for both technological and marketing reasons. Security analysts and experts have their own reasons why.

• June 06, 2023 06 Jun'23

  Ransomware takes down multiple municipalities in May

  City and local governments experienced severe disruptions to public services due to ransomware attacks in May, particularly from the Royal ransomware group.

• June 06, 2023 06 Jun'23

  Verizon 2023 DBIR: Ransomware remains steady but complicated

  Chris Novak, managing director of cybersecurity consulting at Verizon Business, said 2023 was a "retooling year" for ransomware threat actors adapted to improved defenses.

• June 05, 2023 05 Jun'23

  Ransomware actors exploiting MoveIt Transfer vulnerability

  Microsoft said the recently disclosed zero-day flaw in Progress Software's managed file transfer product is being exploited by threat actors connected to the Clop ransomware gang.

• June 01, 2023 01 Jun'23

  Zyxel vulnerability under 'widespread exploitation'

  Researchers warn that threat actors are widely exploiting an unauthenticated command injection vulnerability to target multiple Zyxel network devices.

• June 01, 2023 01 Jun'23

  Zero-day vulnerability in MoveIt Transfer under attack

  Rapid7 observed exploitation of a SQL injection vulnerability in Progress Software's managed file transfer product, which was disclosed this week but has not been patched.

• June 01, 2023 01 Jun'23

  Mitiga warns free Google Drive license lacks logging visibility

  The ability to view logs is critical for enterprises to detect and attribute malicious activity. Mitiga said the Google Drive issue allows data exfiltration without a trace.

• May 31, 2023 31 May'23

  Barracuda zero-day bug exploited months prior to discovery

  Barracuda said a zero-day flaw used to target its email security gateway appliance customers is a remote command injection vulnerability exploited since at least October 2022.

• May 31, 2023 31 May'23

  Many Gigabyte PC models affected by major supply chain issue

  Eclypsium researchers say the insecure implementation of PC hardware manufacturer Gigabyte's App Center could potentially result in supply chain attacks.

• May 30, 2023 30 May'23

  Vendors: Threat actor taxonomies are confusing but essential

  Despite concern about the proliferation of naming taxonomies used to identify threat groups, vendors say they are crucial their understanding and visibility into threat activity.

• May 25, 2023 25 May'23

  Chinese hackers targeting U.S. critical infrastructure

  Microsoft uncovered a Chinese nation-state threat group that is compromising Fortinet FortiGuard devices to gain access to critical infrastructure entities in the U.S. and Guam.

• May 25, 2023 25 May'23

  Risk & Repeat: A troubling trend of poor breach disclosures

  This Risk & Repeat episode covers three data breach disclosures from Dish Network, Gentex Corporation and Clarke County Hospital and the troubling trends that connect all three.

• May 24, 2023 24 May'23

  Updated 'StopRansomware Guide' warns of shifting tactics

  CISA's updates to the 'StopRansomware Guide' address shifts in the threat landscape as more threat actors skip the encryption step and focus on data theft and extortion.

• May 24, 2023 24 May'23

  Barracuda discloses zero-day flaw affecting ESG appliances

  Barracuda Networks said threat actors exploited the zero-day to gain 'unauthorized access to a subset of email gateway appliances,' though it did not say how many.

• May 23, 2023 23 May'23

  Threat actors leverage kernel drivers in new attacks

  Fortinet detailed a campaign using a malicious driver in attacks against organizations in the Middle East, and Trend Micro detailed a driver-based attack by BlackCat ransomware.

• May 22, 2023 22 May'23

  Iowa hospital discloses breach following Royal ransomware leak

  Clarke County Hospital revealed that it took network services offline after an attack in April, but did not address the reported data leak by the Royal ransomware gang.

• May 19, 2023 19 May'23

  Dish 'received confirmation' ransomware gang deleted stolen data

  A line in Dish Network's breach notification sent to affected employees this week suggested the satellite TV provider had paid a ransomware gang to delete stolen data.

• May 18, 2023 18 May'23

  Acronis adds EDR to endpoint security

  Acronis EDR uses Intel threat detection technology to uncover sophisticated attacks, such as fileless malware, but it also has to compete in a crowded market.

• May 18, 2023 18 May'23

  Gentex confirms data breach by Dunghill ransomware actors

  The Dunghill ransomware gang last month claimed responsibility for an attack against Gentex Corporation, which confirmed this week that it suffered a breach several months ago.

• May 17, 2023 17 May'23

  KeePass vulnerability enables master password theft

  KeePass developer Dominik Reichl said the vulnerability should be fixed in KeePass version 2.54, which is expected to release in July along with other security updates.

• May 16, 2023 16 May'23

  Chinese APT exploits TP-Link router firmware via implant

  Check Point Software Technologies said the malicious implant, which it attributed to Chinese APT "Camaro Dragon," was firmware agnostic and could be used against other vendors.

• May 16, 2023 16 May'23

  Coalition: Employee actions are driving cyber insurance claims

  After analyzing cyber insurance claims data, Coalition determined that phishing escalated in 2022, ransomware dropped and timely patching remained a consistent problem.