Threats & Vulnerabilities: Page

Developer platform Retool breached in vishing attack

A successful vishing attack against a Retool employee led to account takeovers of 27 cloud customers, but the company is pointing the finger at Google.

By Arielle Waldman • Sept. 14, 2023

Caesars Entertainment breached in social engineering attack

Caesars said it took steps after the breach to "ensure that the stolen data is deleted by the unauthorized actor," suggesting it paid a ransom to the attackers.

By Alexander Culafi • Sept. 14, 2023

Palo Alto Networks: 80% of security exposures exist in cloud

It's no surprise that organizations struggle with cloud security, but a new report reveals an alarming split between cloud and on-premise security exposures.

By Arielle Waldman • Sept. 14, 2023

Cisco VPN flaw faces attempted Akira ransomware attacks

Cisco said it became aware of 'attempted exploitation' last month and referenced an Aug. 24 security advisory saying its VPNs were under attack by the Akira ransomware gang.

By Alexander Culafi • Sept. 11, 2023

Okta: 4 customers compromised in social engineering attacks

Okta said a threat actor convinced IT personnel at several customers to reset MFA factors for highly privileged users, though it's unclear how they accomplished that task.

By Rob Wright, Arielle Waldman • Sept. 6, 2023

Ransomware attacks on education sector spike in August

While data breach notifications for MoveIt Transfer customers continued to rise, August also saw ransomware ramp up against schools and universities as classes resumed.

By Arielle Waldman • Sept. 5, 2023

FBI, Justice Department dismantle Qakbot malware

The FBI operation, one of the largest U.S.-led botnet disruption efforts ever, included international partners such as France, Germany, the Netherlands and the United Kingdom.

By Alexander Culafi • Aug. 30, 2023

Mandiant reveals new backdoors used in Barracuda ESG attacks

Further investigations show threat actors were prepared for Barracuda Networks' remediation efforts, including an action notice to replace all compromised devices.

By Arielle Waldman • Aug. 29, 2023

Cisco VPNs under attack via Akira, LockBit ransomware

Cisco and Rapid7 say ransomware actors LockBit and Akira have apparently been targeting Cisco VPNs not configured for multifactor authentication.

By Alexander Culafi • Aug. 29, 2023

FBI: Suspected Chinese actors continue Barracuda ESG attacks

The alert comes after Barracuda Networks issued an advisory stating that patches for CVE-2023-2868 were insufficient and all affected ESG devices need to be replaced.

By Arielle Waldman • Aug. 24, 2023

Sophos: RDP played a part in 95% of attacks in H1 2023

While Sophos observed increasing activity around Active Directory and Remote Desktop Protocol abuse, it recommended simple mitigation steps can limit the attack surface.

By Rob Wright, Arielle Waldman • Aug. 23, 2023

6 top workplace safety concerns

Explore the importance of workplace safety, discover six workplace safety concerns and learn how to ensure a safer work environment for all with workplace safety tips.

By Sam Campanella • Aug. 23, 2023

Ivanti issues fix for third zero-day flaw exploited in the wild

CVE-2023-38035 is the latest Ivanti zero-day vulnerability to be exploited in the wild. The vendor has released a series of remediation recommendations.

By Arielle Waldman • Aug. 22, 2023

Vendors criticize Microsoft for repeated security failings

Microsoft is facing frustration for numerous security issues, including problematic transparency, numerous patch bypasses and inconsistent communication practices.

By Alexander Culafi • Aug. 21, 2023

CISA, vendors warn Citrix ShareFile flaw under attack

A vulnerability in the managed file transfer product that enterprises use is being actively exploited two months after Citrix released a fix.

By Arielle Waldman • Aug. 17, 2023

net zero

Net zero refers to a state in which all human-caused greenhouse gas emissions are counterbalanced so humanity no longer adds carbon to the atmosphere.

By Ben Lutkevich • Aug. 15, 2023

Palo Alto: SugarCRM zero-day reveals growing cloud threats

Recent incident response investigations reveal that attackers are becoming more advanced when it comes to the cloud, but there are steps enterprises can take to mitigate risks.

By Arielle Waldman • Aug. 10, 2023

Trend Micro discloses ‘silent threat’ flaws in Azure ML

During a Black Hat 2023 session, Trend Micro researchers discussed several vulnerabilities they discovered in Azure Machine Learning that allow sensitive information disclosure.

By Alexander Culafi • Aug. 10, 2023

Researchers put LLMs to the test in phishing email experiment

A Black Hat USA 2023 session discussed an experiment that used large language models to see how effective the technology can be in both detecting and producing phishing emails.

By Rob Wright • Aug. 10, 2023

Onapsis researchers detail new SAP security threats

At Black Hat 2023, Onapsis researchers demonstrated how attackers could chain a series of SAP vulnerabilities impacting the P4 protocol to gain root access to a target network.

By Arielle Waldman • Aug. 9, 2023

Google unveils ‘Downfall’ attacks, vulnerability in Intel chips

Google researcher Daniel Moghimi first reported CVE-2022-40982 and the resulting data leak attacks to Intel in August 2022, but it's taken nearly 12 months to disclose the flaw.

By Rob Wright • Aug. 8, 2023

carbon accounting

Carbon accounting is the process of calculating and tracking the amount of carbon dioxide (CO2) and other greenhouse gas (GHG) emissions both produced and removed from the biosphere by an organization.

By Andy Patrizio • Aug. 8, 2023

insecure deserialization

Insecure deserialization is a vulnerability in which untrusted or unknown data is used to inflict a denial-of-service attack, execute code, bypass authentication or otherwise abuse the logic behind an application.

By Alexander Gillis • Aug. 7, 2023

MoveIt Transfer attacks dominate July ransomware disclosures

Traditional ransomware attacks took a back seat last month, as Clop operators continued to claim victims from the zero-day attacks on MoveIt Transfer customers.

By Arielle Waldman • Aug. 3, 2023

CISA details backdoor malware used in Barracuda ESG attacks

CISA said Friday that 'Submarine' is a novel persistent backdoor used in attacks against Barracuda Email Security Gateway appliances vulnerable to CVE-2023-2868.

By Alexander Culafi • July 31, 2023