Threats & Vulnerabilities: Page

How attackers counter incident response after a data breach

It's not over until it's over. Explore how attackers use backdoors and evasion techniques to counter incident response measures even long after a data breach is disclosed.

By Andrew Kempster • March 16, 2021

DearCry ransomware impacting Microsoft Exchange servers

While only a small number of DearCry ransomware victims have been reported at this time, the infections have hit organizations in the U.S., Canada, Australia and beyond.

By Alexander Culafi • March 12, 2021

How security teams can prepare for advanced persistent threats

Daniel Clayton explains how any organization can devise its cybersecurity strategy to account for advanced persistent threats, which have started changing the threat landscape.

By Daniel Clayton • March 11, 2021

After Oldsmar: How vulnerable is US critical infrastructure?

Following the highly publicized breach of a water treatment plant in Oldsmar, Fla., industrial security experts discuss the state of critical infrastructure risk in 2021.

By Alexander Culafi • March 11, 2021

Cisco found cryptomining activity within 69% of customers

Cisco found cryptomining malware affected a vast majority of customers in 2020, generating massive amounts of malicious DNS traffic while sucking up precious computing resources.

By Arielle Waldman • March 11, 2021

Microsoft releases tools as Exchange Server attacks increase

Microsoft said it's seen increased Exchange Server attacks, as well as more threat actors beyond the Chinese state-sponsored Hafnium group conducting attacks.

By Alexander Culafi • March 8, 2021

Microsoft Exchange Server zero-days exploited in the wild

Both the Cybersecurity and Infrastructure Security Agency and National Security Agency advise patching the Exchange Server zero-days immediately.

By Alexander Culafi • March 3, 2021

Accellion FTA attacks claim more victims

More details have emerged about the Accellion FTA attacks since the December disclosure, including possible threat groups behind the breach and a growing list of victims.

By Arielle Waldman • March 3, 2021

3 ransomware distribution methods popular with attackers

To prevent cyber attacks, understanding how they work is half the battle. Explore the most common ransomware distribution methods in this excerpt of 'Preventing Ransomware.'

By Packt Publishing, Katie Donegan • March 1, 2021

Chinese threat group ‘RedEcho’ targeting Indian power grid

The Chinese nation-state actor's targets include 10 different Indian power sector organizations, but Recorded Future said there's no evidence RedEcho triggered blackouts.

By Alexander Culafi • March 1, 2021

Malware researcher speculates on the future of ransomware

Abhijit Mohanta, author of 'Preventing Ransomware,' opines on the future of ransomware and discusses why this attack is favored among cybercriminals.

By Katie Donegan • March 1, 2021

Healthcare security services firms tackle ransomware spike

As healthcare organizations face an onslaught of ransomware attacks, channel partners can assist with security initiatives such as zero-trust architectures to prevent breaches.

By Kristen Putch • Feb. 26, 2021

Vastaamo breach, bankruptcy indicate troubling trend

The blackmailing of patients directly, as well as the resulting bankruptcy of Vastaamo Psychotherapy Centre, could single a shift in cyber crime tactics.

By Arielle Waldman • Feb. 25, 2021

Senate hearing: SolarWinds evidence points to Russia

Executives from Microsoft and FireEye said that there was substantial evidence pointing to Russia's role in the SolarWinds attack and no evidence found leading anywhere else.

By Alexander Culafi • Feb. 24, 2021

Dragos: ICS security threats grew threefold in 2020

A new report highlights the challenges facing ICS vendors today, including practices that are geared toward traditional IT and not designed for ICS security.

By Arielle Waldman • Feb. 24, 2021

Chinese APT used stolen NSA exploit for years

Check Point's report details how a zero-day exploit credited to a Chinese nation-state threat group "is in fact a replica of an Equation Group exploit code-named 'EpMe.'"

By Alexander Culafi • Feb. 22, 2021

White House: 100 companies compromised in SolarWinds hack

The White House discussed its response to the SolarWinds attacks, which so far have compromised nine federal agencies and approximately 100 private sector companies.

By Alexander Culafi • Feb. 18, 2021

Wide net cast on potential Accellion breach victims

While Accellion fixed the zero-day vulnerability within 72 hours and said the breach affected 'less than 50 customers,' the attack's impact has expanded two weeks after the disclosure.

By Alexander Culafi • Feb. 17, 2021

DOJ indicts additional WannaCry conspirators

The unsealed indictments accuse three individuals of being part of a hacking group, known as APT38 or Lazarus Group, within a North Korean military intelligence agency.

By Arielle Waldman • Feb. 17, 2021

Malware quiz: Test your knowledge of types and terms

Malware trends are constantly evolving, but older techniques are still often used in cyber attacks today. Test your knowledge of existing and emerging threats in this malware quiz.

By Katie Donegan • Feb. 17, 2021

Researcher used open source supply chain to breach tech giants

Security researcher Alex Birsan breached several major tech companies, including Microsoft and Apple, through a novel technique that manipulated open source supply chains.

By Arielle Waldman • Feb. 10, 2021

Florida city’s water nearly poisoned in TeamViewer attack

The intruder increased the quantity of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million briefly before a water plant operator fixed it.

By Alexander Culafi • Feb. 9, 2021

Ninety percent of dark web hacking forum posts come from buyers

Positive Technologies built a picture of dark web hacking forums via data from the 10 active forums and over 8 million users, though the veracity of such posts remains unclear.

By Alexander Culafi • Feb. 9, 2021

Microsoft, SolarWinds in dispute over nation-state attacks

The latest investigation updates from SolarWinds and Microsoft offer differing views on how nation-state threat actors compromised SolarWinds' environment.

By Arielle Waldman • Feb. 8, 2021

SolarWinds Office 365 environment compromised

SolarWinds CEO Sudhakar Ramakrishna said nation-state threat actors first compromised a single email account and later gained access to the company's Orion platform environment.

By Arielle Waldman • Feb. 4, 2021