News

News

• May 15, 2023 15 May'23

  CrowdStrike warns of rise in VMware ESXi hypervisor attacks

  As enterprise adoption of virtualization technology increases, CrowdStrike has observed a rise in ransomware attacks on servers running VMware's ESXi bare-metal hypervisors.

• May 12, 2023 12 May'23

  Bl00dy ransomware gang targets schools via PaperCut flaw

  The Bl00dy ransomware gang is targeting schools via a critical remote code execution flaw present in unpatched instances of PaperCut MF and NG print management software.

• May 12, 2023 12 May'23

  Experts question San Bernardino's $1.1M ransom payment

  While no public safety services were compromised in the ransomware attack on San Bernardino County's Sheriff's Department, the government opted to $1.1 million to threat actors.

• May 10, 2023 10 May'23

  CISOs face mounting pressures, expectations post-pandemic

  Proofpoint's 2023 Voice of the CISO report shows deep concern among executives about impending data loss and exposure from negligent -- and malicious -- employees.

• May 10, 2023 10 May'23

  Dragos discloses blocked ransomware attack, extortion attempt

  Dragos Inc. published a blog post that outlined a likely ransomware attack it stopped this week, though a threat actor obtained 'general use data' for new hires.

• May 10, 2023 10 May'23

  Akamai bypasses mitigation for critical Microsoft Outlook flaw

  Enterprises might remain vulnerable to a critical Outlook flaw that Microsoft patched in March, as an Akamai researcher uncovered a way to bypass remediation efforts.

• May 09, 2023 09 May'23

  Risk & Repeat: Ex-Uber CSO Joe Sullivan sentenced

  This podcast episode covers the sentencing of former Uber CSO Joe Sullivan over the 2016 breach cover-up, and what it means for other security executives and the industry at large.

• May 08, 2023 08 May'23

  Intel BootGuard private keys leaked following MSI hack

  Intel said it was "actively investigating" reports that OEM BootGuard keys were stolen and leaked by ransomware actors following a breach at motherboard maker MSI

• May 08, 2023 08 May'23

  Western Digital confirms ransomware actors stole customer data

  Western Digital issued an update late Friday that confirmed customer data was stolen in an attack for which Alphv ransomware actors claimed responsibility.

• May 05, 2023 05 May'23

  Former Uber CSO Joe Sullivan avoids jail for breach cover-up

  A U.S. district judge sentenced former Uber security chief Joe Sullivan to three years of probation and 200 hours of community service for his role in the 2016 breach cover-up.

• May 04, 2023 04 May'23

  Cybersecurity execs ponder software liability implementation

  Reactions to the Biden Administration's push for legislation enforcing software liability were mostly positive, but questions remain regarding implementation.

• May 04, 2023 04 May'23

  Ransomware attack disrupts Dallas police, city services

  The city said less than 200 government devices were compromised by the Royal ransomware attack, though it's unclear if threat actors exfiltrated sensitive data.

• May 04, 2023 04 May'23

  Ransomware gangs display ruthless extortion tactics in April

  Ransomware groups are pressuring enterprises into paying with harsher extortion tactics, contacting individual victims directly and leaking stolen photos and video footage.

• May 03, 2023 03 May'23

  Google rolls out passkeys in service of passwordless future

  Google referred to its new passkey option, which features facial recognition, fingerprint and PIN-based authentication, as 'the beginning of the end of the password.'

• May 03, 2023 03 May'23

  Studies show ransomware has already caused patient deaths

  No patient deaths have been definitively attributed to cyber attacks on hospitals, but some infosec experts say that statistical evidence shows a different, grim reality.

• May 02, 2023 02 May'23

  CrowdStrike focuses on ChromeOS security, rising cloud threats

  Raj Rajamani, CrowdStrike's chief product officer of data, identity, cloud and endpoint security, said ChromeOS devices are gaining increasing adoption in the enterprise space.

• May 02, 2023 02 May'23

  Risk & Repeat: Security industry bets on AI at RSA Conference

  This podcast episode covers the focus on AI-powered security products and uses at RSA Conference 2023 in San Francisco last week, as well as other trends at the show.

• May 01, 2023 01 May'23

  1Password execs outline shift to passwordless authentication

  1Password CEO Jeff Shiner and Anna Pobletts, head of passwordless, discuss the power of passkeys, the adoption challenges ahead, and the threat of generative AI attacks.

• April 28, 2023 28 Apr'23

  ChatGPT uses for cybersecurity continue to ramp up

  The use of OpenAI's technology in cybersecurity products is growing as companies look to improve threat detection and assist short-staffed and fatigued security teams.

• April 27, 2023 27 Apr'23

  Secureworks CEO weighs in on XDR landscape, AI concerns

  Secureworks CEO Wendy Thomas talks with TechTarget Editorial about the evolution of the threat detection and response market, as well as the risks posed by new AI technology.

• April 26, 2023 26 Apr'23

  CISA aims to reduce email threats with serial CDR prototype

  CISA officials at RSA Conference 2023 showed off a prototype designed to measure the risk of suspicious files and remove them from email and web services.

• April 26, 2023 26 Apr'23

  How ransomware victims can make the best of a bad situation

  At RSA Conference 2023, Mandiant's Jibran Ilyas provided tips for ransomware victims that decide to pay, including a list of counterdemands to make to the threat actors.

• April 26, 2023 26 Apr'23

  CrowdStrike details new MFA bypass, credential theft attack

  At RSA Conference 2023, CrowdStrike demonstrated an effective technique that a cybercrime group used in the wild to steal credentials and bypass MFA in Microsoft 365.

• April 25, 2023 25 Apr'23

  RSAC panel warns AI poses unintended security consequences

  A panel of experts at RSA conference 2023 warned of hallucinations and inherent biases but also said generative AI can assist in incident response and other security needs.

• April 25, 2023 25 Apr'23

  Rising AI tide sweeps over RSA Conference, cybersecurity

  AI is everywhere at RSA Conference 2023, though experts have differing views about why the technology has become omnipresent and how it will best serve cybersecurity.

• April 25, 2023 25 Apr'23

  RSAC speaker offers ransomware victims unconventional advice

  Triton Tech Consulting CEO Brandon Clark advised organizations to set aside the stigma of 'negotiating with terrorists' when deciding whether to pay a ransomware gang.

• April 25, 2023 25 Apr'23

  Bugcrowd CTO talks hacker feedback, vulnerability disclosure

  Bugcrowd CTO Casey Ellis said the company's new penetration testing service helps establish the company beyond public perception of it being purely a bug bounty platform.

• April 25, 2023 25 Apr'23

  Google, Mandiant highlight top threats, evolving adversaries

  Enterprises are struggling to keep up as adversary groups improve tactics. But one of the most difficult groups to defend against, according to Google and Mandiant, was a surprise.

• April 25, 2023 25 Apr'23

  DOJ's Monaco addresses 'misperception' of Joe Sullivan case

  In her RSA Conference keynote, Deputy Attorney General Lisa Monaco was asked if the prosecution of former Uber CSO Joe Sullivan damaged trust with the private sector.

• April 24, 2023 24 Apr'23

  IBM launches AI-powered security offering QRadar Suite

  IBM aims to use QRadar Suite's AI features, which it calls the 'unified analyst experience,' to enable security analysts to focus on higher-priority work.

• April 20, 2023 20 Apr'23

  Fortra completes GoAnywhere MFT investigation

  An investigation around the zero-day attack that affected a growing number of victims revealed that activity started earlier than Fortra initially reported.

• April 20, 2023 20 Apr'23

  DC Health Link breach caused by misconfigured server

  Mila Kofman, executive director of the District of Columbia Health Benefit Exchange Authority, blames "human error" for the DC Health Link breach.

• April 20, 2023 20 Apr'23

  Mandiant: 3CX breach caused by second supply chain attack

  Trading Technologies said in a statement it had 'not had the ability to verify the assertions in Mandiant's report' that its software played a role in the 3CX supply chain attack.

• April 19, 2023 19 Apr'23

  Point32Health confirms service disruption due to ransomware

  A ransomware attack interrupted access to services provided by one of New England's largest healthcare insurers, though the scope of affected customers and data remains unknown.

• April 18, 2023 18 Apr'23

  Mandiant: 63% of breaches were discovered externally in 2022

  Mandiant said the 2022 increase is most likely affected by the threat intelligence firm proactively investigating threat activity targeting Ukraine last year.

• April 13, 2023 13 Apr'23

  Western Digital restores service; attack details remain unclear

  While Western Digital confirmed that it suffered a data breach on March 26, the storage company has not offered details about the attack scope or whether ransomware was involved.

• April 13, 2023 13 Apr'23

  Hacking Policy Council launches, aims to improve bug disclosure

  Founding members for the Hacking Policy Council, launched Thursday by the Center for Cybersecurity Policy and Law, include HackerOne, Bugcrowd, Google and others.

• April 12, 2023 12 Apr'23

  OpenAI launches bug bounty program with Bugcrowd

  ChatGPT publisher OpenAI said its new Bugcrowd bug bounty program will not accept submissions involving "issues related to the content of model prompts and responses."

• April 12, 2023 12 Apr'23

  Nokoyawa ransomware exploits Windows CLFS zero-day

  The Nokoyawa ransomware attacks highlight the growing use of zero-day exploits by a variety of threat groups, including financially motivated cybercriminals.

• April 11, 2023 11 Apr'23

  FTX bankruptcy filing highlights security failures

  Debtors claim that defunct cryptocurrency exchange FTX lacked any dedicated security personnel and failed to implement critical access controls for billions of dollars in assets.

• April 11, 2023 11 Apr'23

  Recorded Future launches OpenAI GPT model for threat intel

  The new OpenAI GPT model was trained on Recorded Future's large data set and interprets evidence to help support enterprises struggling with cyberdefense.

• April 07, 2023 07 Apr'23

  Microsoft, Fortra get court order to disrupt Cobalt Strike

  Microsoft, Fortra and the Health Information Sharing and Analysis center announced they obtained a court order in an effort to curb malicious Cobalt Strike use.

• April 06, 2023 06 Apr'23

  119 arrested in Genesis Market takedown

  The FBI and Dutch National Police led the takedown of Genesis Market alongside more than a dozen partners, including the U.K., Italy, Spain and Romania.

• April 05, 2023 05 Apr'23

  42% of IT leaders told to maintain breach confidentiality

  While transparency and prompt reporting are important steps following an attack, Bitdefender found that many IT professionals were told to maintain confidentiality after a breach.

• April 04, 2023 04 Apr'23

  March ransomware disclosures spike behind Clop attacks

  The Clop ransomware gang claimed responsibility for several disclosed ransomware attacks on major enterprises, which stemmed from a zero-day flaw in Fortra's GoAnywhere software.

• April 04, 2023 04 Apr'23

  Risk & Repeat: Inside the 3CX supply chain attack

  This podcast episode discusses the 3CX supply chain attack, where it may have started, who was behind it and how the unified communications vendor has responded to the incident.

• April 03, 2023 03 Apr'23

  Source of 3CX supply chain attack unclear as fallout continues

  Multiple statements originally referenced a third-party library as the apparent source for 3CX's recent supply chain attack, but that may no longer be the case.

• April 03, 2023 03 Apr'23

  Why medical device vulnerabilities are hard to prioritize

  Vulnerabilities in critical medical devices could lead to loss of life. But opinions are mixed on how serious the risk is to patient safety and how best to address the flaws.

• March 30, 2023 30 Mar'23

  3CX desktop app compromised, abused in supply chain attack

  3CX customers noticed that several threat detection platforms began flagging and blocking the UC vendor's desktop application last week due to malicious activity in the executable.

• March 30, 2023 30 Mar'23

  Azure Pipelines vulnerability spotlights supply chain threats

  Legit Security researchers discovered a remote code execution flaw within Microsoft's Azure DevOps platform that could give threat actors complete control of development pipelines.

• March 29, 2023 29 Mar'23

  Google: Spyware vendors exploiting iOS, Android zero days

  Recent campaigns observed by Google's Threat Analysis Group showed spyware vendors' use of zero days and known vulnerabilities pose an increasing threat.

• March 28, 2023 28 Mar'23

  Microsoft launches AI-powered Security Copilot

  Microsoft Security Copilot is an AI assistant for infosec professionals that combines OpenAI's GPT-4 technology with the software giant's own cybersecurity-trained model.

• March 28, 2023 28 Mar'23

  Publicly disclosed U.S. ransomware attacks in 2023

  TechTarget Editorial's ransomware database collects public disclosures, notifications and confirmed reports of attacks against U.S. organizations each month.

• March 27, 2023 27 Mar'23

  Zoom launches Okta Authentication for E2EE to verify identity

  Authenticated Zoom attendees will get a blue shield icon next to their participant name to give enterprises additional security during sensitive meetings.

• March 23, 2023 23 Mar'23

  More victims emerge from Fortra GoAnywhere zero-day attacks

  Threat actors began exploiting a zero-day vulnerability in Fortra's GoAnywhere file sharing software in late January, victimizing several large enterprises.

• March 22, 2023 22 Mar'23

  BreachForums taken down after arrest of alleged owner

  This Risk & Repeat podcast episode covers the arrest of BreachForums' alleged owner and the site's subsequent closure, as well as possible connections to the DC Health Link breach.

• March 22, 2023 22 Mar'23

  Cyber insurance carriers expanding role in incident response

  While cyber insurance has its benefits, infosec professionals expressed concern that carriers have too much influence over incident response decisions, especially with ransomware.

• March 21, 2023 21 Mar'23

  ZenGo finds transaction simulation flaw in Coinbase, others

  Referred to as a 'red pill attack,' ZenGo researchers discovered a way to exploit smart contracts and bypass security features known as transaction simulation solutions.

• March 20, 2023 20 Mar'23

  FBI arrests suspected BreachForums owner in New York

  The BreachForums arrest occurred days after DC Health Link's data went up for sale on the dark web message board, though the affidavit did not cite the breach in the arrest.

• March 17, 2023 17 Mar'23

  Google warns users of Samsung Exynos zero-day vulnerabilities

  To prevent threat actors from exploiting the unpatched attack vectors, Google Project Zero made an exception for four Exynos chipset flaws by extending its disclosure timeline.

• March 16, 2023 16 Mar'23

  U.S. federal agency hacked via 3-year-old Telerik UI flaw

  A CISA advisory said multiple threat actors recently exploited a Progress Telerik UI vulnerability, first disclosed in 2019, to breach an unnamed federal civilian agency.

• March 15, 2023 15 Mar'23

  Secureworks IR team saw BEC attacks double in 2022

  Vendor and incident response firm Secureworks referred to business email compromise, or BEC attacks, as 'the largest monetary threat to organizations.'

• March 15, 2023 15 Mar'23

  Rubrik discloses data breach, blames Fortra zero-day

  The cybersecurity vendor said it is investigating a data breach after attackers exploited a zero-day vulnerability in Fortra's GoAnywhere managed file transfer software.

• March 15, 2023 15 Mar'23

  Dell launches new security offerings for data protection, MDR

  Dell's new and expansive services focus on top security challenges enterprises face, such as data protection, ransomware recovery and supply chain threats.

• March 15, 2023 15 Mar'23

  Hacker claims exposed database led to DC Health Link breach

  This Risk & Repeat podcast episode covers the breach of health insurance exchange DC Health Link, as well as a hacker's claim that the breach was caused by an exposed database.

• March 14, 2023 14 Mar'23

  Magniber ransomware actors exploiting Microsoft zero day

  Magniber ransomware actors discovered a way to bypass Microsoft's remediation for a previous SmartScreen vulnerability to attack enterprises, according to Google researchers.

• March 13, 2023 13 Mar'23

  DC Health Link confirms breach, but questions remain

  While DC Health Link confirmed the breach, it is unknown how threat actors obtained the personal health data of more than 56,000 customers, including members of Congress.

• March 09, 2023 09 Mar'23

  Is ransomware declining? Not so fast, experts say

  While some 2022 ransomware statistics indicate a possible 'decline' in activity, threat researchers warn there's more to the picture than the numbers suggest.

• March 09, 2023 09 Mar'23

  IceFire ransomware targets Linux, exploits IBM vulnerability

  IceFire ransomware actors have shifted their attention to Linux servers and are actively exploiting a known vulnerability in IBM's Aspera Faspex file sharing software.

• March 09, 2023 09 Mar'23

  Flashpoint: Threat vectors converging, increasing damage

  The threat intelligence vendor warned that threat actors are increasingly combining known vulnerabilities, stolen credentials and exposed data to wreak maximum damage.

• March 09, 2023 09 Mar'23

  VulnCheck: CISA's KEV missing 42 vulnerabilities from 2022

  VulnCheck said CISA's Known Exploited Vulnerabilities catalog 'cannot be treated as the authoritative catalog of exploited vulnerabilities' in its current state.

• March 07, 2023 07 Mar'23

  Biden administration raises software liability questions

  This Risk & Repeat podcast episode discusses the White House's National Cybersecurity Strategy and its proposal to hold technology companies liable for insecure software.

• March 07, 2023 07 Mar'23

  Vishing attacks increasing, but AI's role still unclear

  The volume of vishing attacks continues to rise. But threat researchers say it's difficult to attribute such threats to artificial intelligence tools and deepfake technology.

• March 06, 2023 06 Mar'23

  Police raids target 'core' DoppelPaymer ransomware members

  A coordinated law enforcement effort last week resulted in raids and arrest warrants against 'core members' of the infamous DoppelPaymer ransomware group.

• March 02, 2023 02 Mar'23

  New National Cybersecurity Strategy takes aim at ransomware

  The Biden-Harris administration's 39-page National Cybersecurity Strategy covers multiple areas, including disrupting ransomware operations and addressing vulnerable software.

• March 02, 2023 02 Mar'23

  Ransomware attacks ravaged big names in February

  While ransomware incidents appear to be decreasing, several high-profile organizations, including Dole, Dish Network and the U.S. Marshals Service, suffered notable attacks.

• February 28, 2023 28 Feb'23

  Rapid7: Attackers exploiting vulnerabilities 'faster than ever'

  Rapid7's 2022 Vulnerability Intelligence Report analyzed how attackers' increasing speed in deploying exploits affected an onset of widespread threats in 2022.

• February 28, 2023 28 Feb'23

  LastPass breach tied to hack of engineer's home computer

  LastPass said a threat actor hacked an employee's home computer to access a corporate password vault and steal decryption keys for its product backups and cloud storage resources.

• February 28, 2023 28 Feb'23

  Bitdefender releases decryptor for MortalKombat ransomware

  MortalKombat ransomware was first spotted in January, but Bitdefender has already cracked the new variant and released a free decryptor to help victims recover data.

• February 28, 2023 28 Feb'23

  U.S. Marshals Service suffers ransomware attack, data breach

  Ransomware actors breached the U.S. Marshals Service earlier this month and stole sensitive information pertaining to agency investigations, though many questions remain.

• February 22, 2023 22 Feb'23

  Exploitation attempts observed against Fortinet FortiNAC flaw

  Hours after Horizon3.ai released a proof of concept exploit through GitHub, Shadowserver Foundation observed several IP addresses attempting to exploit the vulnerability.

• February 22, 2023 22 Feb'23

  How hackers can abuse ChatGPT to create malware

  ChatGPT's capabilities for producing software code are limited. But researchers have observed cybercriminals bypassing the chatbot's safeguards to produce malicious content.

• February 22, 2023 22 Feb'23

  IBM: Ransomware defenders showing signs of improvement

  According to IBM X-Force's Threat Intelligence Index report, a smaller percentage of threat actors executed a ransomware attack after gaining access in 2022 than in 2021.

• February 21, 2023 21 Feb'23

  GoDaddy's response to 'multi-year' breach criticized

  GoDaddy took nearly three months to disclose that attackers breached the company in a multi-year campaign, and customers are still in the dark about the details of the attack.

• February 16, 2023 16 Feb'23

  Google: Russia continues to set cyber sights on NATO nations

  A new report from Google's Threat Analysis Group shed light on Russia's efforts to conduct malicious cyber campaigns not only against Ukraine but also NATO nations too.

• February 16, 2023 16 Feb'23

  No relief in sight for ransomware attacks on hospitals

  Despite being off limits for some hackers, hospitals continue to be lucrative targets for ransomware groups because of their valuable data and higher rate of paying ransoms.

• February 16, 2023 16 Feb'23

  Ransomware actors increasingly weaponizing old vulnerabilities

  A new report from Cyber Security Works shows that 76% of all ransomware-associated vulnerabilities tracked in 2022 were old flaws initially discovered between 2010 and 2019.

• February 15, 2023 15 Feb'23

  Cisco Talos spots new MortalKombat ransomware attacks

  Researchers discovered the threat campaign is also using a new GO version of malware called Laplas Clipper to steal cryptocurrency from individuals and businesses in the U.S.

• February 15, 2023 15 Feb'23

  ESXiArgs attack vector unclear as infections continue

  This Risk & Repeat podcast episode discusses the recent developments involving ESXiArgs, the ransomware variant that has been infecting vulnerable VMware ESXi servers this month.

• February 14, 2023 14 Feb'23

  Dragos: ICS/OT ransomware attacks up 87%

  Ransomware attacks against industrial organizations remains a growing problem, according to ICS/OT vendor Dragos' new 'Year in Review 2022' report.

• February 13, 2023 13 Feb'23

  Namecheap email system hacked, used for phishing campaign

  While the domain registrar said it was not breached directly, it did confirm its third-party email system was compromised Sunday and warned customers not to open any unauthorized emails.

• February 10, 2023 10 Feb'23

  New ESXi ransomware strain spreads, foils decryption tools

  Since the onset of the widespread attacks last week, the ESXiArgs ransomware strain appears to have undergone updates that make it harder for enterprises to recover data.

• February 09, 2023 09 Feb'23

  U.S., U.K. hit TrickBot cybercrime gang with sanctions

  TrickBot malware has caused considerable damage to U.S. organizations, particularly in the healthcare industry, and was used in Conti and Ryuk ransomware attacks.

• February 09, 2023 09 Feb'23

  Hypervisor patching struggles exacerbate ESXiArgs attacks

  Ransomware hit a high number of unpatched VMware ESXi servers by exploiting two- and three-year-old flaws, which has put hypervisor patching difficulties in the spotlight.

• February 09, 2023 09 Feb'23

  Thousands of victims apparently hit by ESXiArgs ransomware

  A joint security advisory from CISA and the FBI said the ESXiArgs ransomware campaign has claimed over 3,800 servers globally since attacks first emerged last week.

• February 08, 2023 08 Feb'23

  CISA battles ESXiArgs ransomware campaign with recovery tool

  The U.S. Cybersecurity and Infrastructure Security Agency published a decryptor script intended to assist VMware customers affected by ESXiArgs ransomware.

• February 08, 2023 08 Feb'23

  ESXiArgs ransomware campaign raises concerns, questions

  This Risk & Repeat podcast looks at the widespread ESXiArgs ransomware attacks and the questions they've raised about the threat landscape, vulnerability patching and more.

• February 06, 2023 06 Feb'23

  Vastaamo hacking suspect arrested in France

  The suspect in the infamous cyber attack, Julius Kivimäki, is a 25-year-old Finnish man who was arrested after being remanded in absentia in October 2022.

• February 06, 2023 06 Feb'23

  Widespread ransomware campaign targets VMware ESXi servers

  The attacks exploited a two-year-old heap overflow vulnerability in VMware ESXi. Many questions remain about the scope of the campaign and the threat actor behind it.

• February 02, 2023 02 Feb'23

  Threat activity increasing around Fortinet VPN vulnerability

  Following public disclosure of the critical VPN flaw in December, multiple reports show threat actors are exploiting it to target high-profile organizations.