Threats & Vulnerabilities: Page
-
Brand Experience Team/TechTarget
Apple warns 2 macOS zero-day vulnerabilities under attack
The macOS Sequoia vulnerabilities are the latest to be targeted and exploited by threat actors as cybersecurity vendors report a shift in the landscape.
By Arielle Waldman • Nov. 20, 2024 -
Brand Experience Team/TechTarget
Microsoft to offer hackers millions in Zero Day Quest event
Microsoft launched Zero Day Quest on Tuesday with a preliminary event offering bug bounty researchers rewards with multipliers for select security scenarios.
By Alexander Culafi • Nov. 19, 2024 -
Brand Experience Team/TechTarget
2 Palo Alto Networks zero-day vulnerabilities under attack
CVE-2024-9474 marks the second zero-day vulnerability in Palo Alto Networks' PAN-OS firewall management interface to come under attack in the last week.
By Arielle Waldman • Nov. 19, 2024 -
Brand Experience Team/TechTarget
Chinese APT exploited unpatched Fortinet zero-day flaw
Volexity reported that a Chinese APT actor exploited a zero-day vulnerability in Fortinet's Windows VPN FortiClient software that enables credentials to be stolen from a system.
By Alexander Culafi • Nov. 18, 2024 -
Brand Experience Team/TechTarget
What is a whaling attack (whaling phishing)?
A whaling attack, also known as 'whaling phishing' or a 'whaling phishing attack,' is a specific type of phishing attack that targets high-profile employees, such as the chief executive officer (CEO) or chief financial officer, to steal sensitive information from a company.
By Ben Lutkevich, Casey Clark, Scott Robinson • Nov. 18, 2024 -
Brand Experience Team/TechTarget
Palo Alto Networks PAN-OS management interfaces under attack
Palo Alto Networks confirmed that threat actors are exploiting a vulnerability in PAN-OS firewall management interfaces after warning customers to secure them for nearly a week.
By Alexander Culafi • Nov. 15, 2024 -
Brand Experience Team/TechTarget
Infoblox: 800,000 domains vulnerable to hijacking attack
While the 'Sitting Ducks' attack vector continues to pose a problem, Infoblox says domain registrars, DNS providers and government bodies remain inactive.
By Arielle Waldman • Nov. 14, 2024 -
Brand Experience Team/TechTarget
Most widely exploited vulnerabilities in 2023 were zero days
While zero-day exploitation surged throughout 2023, CISA said threat actors continue to exploit known vulnerabilities that were disclosed and patched as far back as 2017.
By Arielle Waldman • Nov. 13, 2024 -
Brand Experience Team/TechTarget
Video
An explanation of ethical hackers
Ethical hackers protect businesses by identifying vulnerabilities. They use the same techniques as malicious hackers, but for the greater good.
By Kaitlin Herbert • Nov. 13, 2024 -
Brand Experience Team/TechTarget
Amazon employee data leaked from MoveIt Transfer attack
Although Amazon confirms that employee data was leaked, it stresses that data was stolen via a third-party vendor and that only contact information was obtained.
By Alexander Culafi • Nov. 12, 2024 -
Brand Experience Team/TechTarget
Ransomware attacks caused prolonged disruptions in October
The Ransomhub, Rhysdia and Interlock ransomware gangs claimed responsibility for attacks that knocked victims' services offline, sometimes for several weeks.
By Arielle Waldman • Nov. 7, 2024 -
Brand Experience Team/TechTarget
Canadian authorities arrest alleged Snowflake hacker
Alexander Moucka was arrested last week and is expected to appear in court Tuesday for allegedly breaching dozens of Snowflake customers.
By Arielle Waldman • Nov. 5, 2024 -
Brand Experience Team/TechTarget
China-based APTs waged 5-year campaign on Sophos firewalls
For years, several advanced persistent threat groups tied to the Chinese government targeted Sophos firewall products with custom malware and zero-day exploits.
By Alexander Culafi • Oct. 31, 2024 -
Brand Experience Team/TechTarget
Lottie Player NPM package compromised in supply chain attack
Threat actors published compromised versions of the Lottie Player component on NPM, and the malicious code prompted users to access their cryptocurrency wallets.
By Arielle Waldman • Oct. 31, 2024 -
Brand Experience Team/TechTarget
Play ransomware attack tied to North Korean nation-state actor
A relationship between North Korean actor Jumpy Pisces and Play ransomware would be unprecedented, as the former has not collaborated with cybercrime gangs previously.
By Alexander Culafi • Oct. 30, 2024 -
Brand Experience Team/TechTarget
Microsoft warns of Midnight Blizzard spear phishing campaign
The tech giant is notifying users affected by a recently observed campaign, which has targeted more than 100 victim organizations globally so far.
By Arielle Waldman • Oct. 30, 2024 -
Brand Experience Team/TechTarget
REvil convictions unlikely to curb Russian cybercrime
In a rare action against cybercrime, a court in Russia sentenced four individuals tied to the Revil ransomware gang for money laundering and malware distribution charges.
By Arielle Waldman • Oct. 29, 2024 -
Brand Experience Team/TechTarget
Expert Advice // Top LLM threats and how to defend against them
How to identify and prevent insecure output handling
Sanitation, validation and zero trust are essential ways to reduce the threat posed by large language models generating outputs that could cause harm to downstream systems and users.
By Matthew Smith • Oct. 28, 2024 -
Brand Experience Team/TechTarget
Fortinet FortiManager zero-day flaw exploited since June
Mandiant researchers first observed exploitation activity against CVE-2024-47575 on June 27, with more than 50 FortiManager devices compromised since.
By Rob Wright • Oct. 24, 2024 -
Brand Experience Team/TechTarget
Fortinet discloses critical zero-day flaw in FortiManager
According to Fortinet, the FortiManager vulnerability 'may allow a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.'
By Alexander Culafi • Oct. 23, 2024 -
Brand Experience Team/TechTarget
Expert Advice // Modern phishing
How AI is making phishing attacks more dangerous
Cybercriminals are using AI chatbots, such as ChatGPT, to launch sophisticated business email compromise attacks. Cybersecurity practitioners must fight fire with fire.
By Sharon Shea , Ashwin Krishnan • Oct. 22, 2024 -
Brand Experience Team/TechTarget
Cisco confirms attackers stole data from DevHub environment
While Cisco said its systems were not breached, the vendor did confirm that attackers stole sensitive information from the public-facing portal.
By Arielle Waldman • Oct. 21, 2024 -
Brand Experience Team/TechTarget
The American Water cyberattack: Explaining how it happened
A cyberattack on American Water disrupted customer systems. While water operations were unaffected, the incident underscores the vulnerability of critical infrastructure.
By Sean Kerner • Oct. 18, 2024 -
Brand Experience Team/TechTarget
What is tailgating (piggybacking)?
Tailgating, sometimes referred to as piggybacking, is a type of physical security breach in which an unauthorized person follows an authorized individual to enter secured premises while avoiding detection by an electronic or human access control (or alarm) system.
By Rahul Awati • Oct. 17, 2024 -
Brand Experience Team/TechTarget
DOJ charges alleged Anonymous Sudan ringleaders
Two Sudanese brothers are accused of leading the cybercriminal group that caused significant damage to healthcare organizations as well as other high-profile victims.
By Arielle Waldman • Oct. 17, 2024
Previous
