Threats & Vulnerabilities: Page

May ransomware activity rises behind 8base, LockBit gangs

LockBit was the most active group last month, but NCC Group researchers were surprised by 8base, which started listing victims from attacks that occurred beginning in April 2022.

By Arielle Waldman • June 21, 2023

Attackers discovering exposed cloud assets within minutes

Cloud security vendor Orca Security used honeypots to learn more about how threat actors compromise cloud resources such as misconfigured AWS S3 buckets and GitHub repositories.

By Alexander Culafi • June 20, 2023

Microsoft: DDoS attacks caused M365, Azure disruptions

Microsoft confirmed widespread service disruptions earlier this month were caused by layer 7 DDoS attacks by a threat group it identified as Storm-1359.

By Arielle Waldman • June 19, 2023

Chinese nation-state actor behind Barracuda ESG attacks

Mandiant said the zero-day attacks on Barracuda Email Security Gateway appliances were part of a 'wide-ranging campaign in support of the People's Republic of China.'

By Arielle Waldman • June 15, 2023

Fortinet warns critical VPN vulnerability ‘may’ be under attack

Fortinet said the heap buffer overflow flaw might have been exploited already and warned that Chinese nation-state threat group Volt Typhoon would likely attack the vulnerability.

By Arielle Waldman • June 13, 2023

Mandiant: New VMware ESXi zero-day used by Chinese APT

VMware said the ESXi flaw was 'low severity' despite being under active exploitation because it requires the attacker to already have gained root access on the target's system.

By Alexander Culafi • June 13, 2023

MoveIT Transfer attacks highlight SQL injection risks

Security vendors say SQL injection flaws, like the zero-day vulnerability recently disclosed by Progress Software, can be challenging for companies to identify and resolve.

By Arielle Waldman • June 12, 2023

Barracuda: Replace vulnerable ESG devices ‘immediately’

Customers with email security gateway appliances affected by a recent zero-day flaw, CVE-2023-2868, are being urged to replace devices, even if the hardware has been patched.

By Arielle Waldman • June 8, 2023

Top blockchain attacks, hacks and security issues explained

Blockchain is an attractive target for malicious actors. From blockchain-specific attacks to human vulnerabilities to lack of regulations, these are the top blockchain issues.

By Jessica Groopman • June 7, 2023

Ransomware takes down multiple municipalities in May

City and local governments experienced severe disruptions to public services due to ransomware attacks in May, particularly from the Royal ransomware group.

By Arielle Waldman • June 6, 2023

Verizon 2023 DBIR: Ransomware remains steady but complicated

Chris Novak, managing director of cybersecurity consulting at Verizon Business, said 2023 was a "retooling year" for ransomware threat actors adapted to improved defenses.

By Alexander Culafi • June 6, 2023

Ransomware actors exploiting MoveIt Transfer vulnerability

Microsoft said the recently disclosed zero-day flaw in Progress Software's managed file transfer product is being exploited by threat actors connected to the Clop ransomware gang.

By Rob Wright • June 5, 2023

Zyxel vulnerability under ‘widespread exploitation’

Researchers warn that threat actors are widely exploiting an unauthenticated command injection vulnerability to target multiple Zyxel network devices.

By Alexis Zacharakos • June 1, 2023

Zero-day vulnerability in MoveIt Transfer under attack

Rapid7 observed exploitation of a SQL injection vulnerability in Progress Software's managed file transfer product, which was disclosed this week but has not been patched.

By Rob Wright • June 1, 2023

Barracuda zero-day bug exploited months prior to discovery

Barracuda said a zero-day flaw used to target its email security gateway appliance customers is a remote command injection vulnerability exploited since at least October 2022.

By Alexander Culafi • May 31, 2023

Many Gigabyte PC models affected by major supply chain issue

Eclypsium researchers say the insecure implementation of PC hardware manufacturer Gigabyte's App Center could potentially result in supply chain attacks.

By Alexander Culafi • May 31, 2023

Chinese hackers targeting U.S. critical infrastructure

Microsoft uncovered a Chinese nation-state threat group that is compromising Fortinet FortiGuard devices to gain access to critical infrastructure entities in the U.S. and Guam.

By Arielle Waldman • May 25, 2023

Barracuda discloses zero-day flaw affecting ESG appliances

Barracuda Networks said threat actors exploited the zero-day to gain 'unauthorized access to a subset of email gateway appliances,' though it did not say how many.

By Alexander Culafi • May 24, 2023

Threat actors leverage kernel drivers in new attacks

Fortinet detailed a campaign using a malicious driver in attacks against organizations in the Middle East, and Trend Micro detailed a driver-based attack by BlackCat ransomware.

By Alexander Culafi • May 23, 2023

Dish ‘received confirmation’ ransomware gang deleted stolen data

A line in Dish Network's breach notification sent to affected employees this week suggested the satellite TV provider had paid a ransomware gang to delete stolen data.

By Alexander Culafi • May 19, 2023

The potential danger of the new Google .zip top-level domain

How much should the average end user be concerned about the new .zip and .mov TLDs? They aren't as bad as some make them out to be, but it's still worth doing something about them.

By Kyle Johnson • May 19, 2023

Chinese APT exploits TP-Link router firmware via implant

Check Point Software Technologies said the malicious implant, which it attributed to Chinese APT "Camaro Dragon," was firmware agnostic and could be used against other vendors.

By Alexander Culafi • May 16, 2023

Protect against current and future threats with encryption

Current and future cyber threats, such as ransomware, generative AI, quantum computing and an increase in surveillance, are driving the need to secure all data with encryption.

By Jack Poller • May 16, 2023

CrowdStrike warns of rise in VMware ESXi hypervisor attacks

As enterprise adoption of virtualization technology increases, CrowdStrike has observed a rise in ransomware attacks on servers running VMware's ESXi bare-metal hypervisors.

By Arielle Waldman • May 15, 2023

Bl00dy ransomware gang targets schools via PaperCut flaw

The Bl00dy ransomware gang is targeting schools via a critical remote code execution flaw present in unpatched instances of PaperCut MF and NG print management software.

By Alexander Culafi • May 12, 2023