Threats & Vulnerabilities: Page

FireEye ties Russia to Triton malware attack in Saudi Arabia

FireEye security researchers claimed the Russian government was 'most likely' behind the Triton malware attack on an industrial control system in Saudi Arabia last year.

By Michael Heller • Oct. 25, 2018

Does pcAnywhere put election management systems at risk?

ES&S admitted it installed the insecure remote access program pcAnywhere on election management systems. Learn what pcAnywhere is and what this risk means for election systems.

By Judith Myerson • Oct. 25, 2018

Siemens Siclock: How do threat actors exploit these devices?

Siemens disclosed six Siclock flaws that were found within its central plant clocks. Discover why three flaws have been rated critical and how threat actors can exploit devices.

By Judith Myerson • Oct. 24, 2018

Zero-day jQuery plugin vulnerability exploited for 3 years

A zero-day in jQuery File Upload could affect thousands of projects because the jQuery plugin vulnerability has existed for eight years and actively exploited for at least three years.

By Michael Heller • Oct. 22, 2018

Facebook hack the work of spammers, not foreign adversary

News roundup: The Facebook hack was the work of spammers, according to The Wall Street Journal. Plus, 35 million voter records are for sale on the dark web, and more.

By Madelyn Bacon • Oct. 19, 2018

GreyEnergy threat group detected attacking high-value targets

Researchers claim a new threat group called GreyEnergy is the successor to BlackEnergy, but experts are unsure if the evidence supports the claims or warnings of future attacks.

By Michael Heller • Oct. 19, 2018

The implications of the NetSpectre vulnerability

The NetSpectre vulnerability could enable a slow leak of data remotely via side channels. Expert Michael Cobb explains why data on secure microprocessors is not actually safe.

By Michael Cobb • Oct. 18, 2018

How did the IcedID and TrickBot banking Trojans join forces?

The TrickBot banking Trojan joined forces with IcedID to form a dual threat that targets victims for money. Discover how this union occurred and how it has changed their behaviors.

By Nick Lewis • Oct. 17, 2018

How does the APT attack Double Kill work in Office documents?

The Qihoo 360 Core Security team found a Microsoft vulnerability -- named Double Kill -- that affects applications via Office documents. Learn how this is possible with Nick Lewis.

By Nick Lewis • Oct. 16, 2018

How does the MnuBot banking Trojan use unusual C&C servers?

IBM X-Force found MnuBot -- a new banking Trojan -- manipulating C&C servers in an unusual way. Learn how this is possible and how this malware differs from those in the past.

By Nick Lewis • Oct. 15, 2018

Facebook breach affected 20 million fewer than thought

The recent Facebook breach affected 20 million fewer accounts than was previously thought. The company now says 29 million accounts had data exposed to attackers.

By Michael Heller • Oct. 12, 2018

Mozilla delays distrust of Symantec TLS certificates, Google doesn’t

Mozilla delays plans to distrust Symantec TLS certificates in Firefox because despite more than one year's notice, approximately 13,000 websites still use the insecure certificates.

By Michael Heller • Oct. 12, 2018

Industroyer, NotPetya linked to TeleBots group by ESET researchers

News roundup: An APT group called TeleBots group was linked to Industroyer malware and NotPetya ransomware, according to researchers. Plus, Imperva is acquired by Thoma Bravo and more.

By Madelyn Bacon • Oct. 12, 2018

Paul Vixie wants to stop malicious domains before they’re created

Farsight Security's Paul Vixie says his company's new research into domain name lifespans and causes of death shows the need for new policies and action to curb malicious domains.

By Rob Wright • Oct. 11, 2018

U.S. weapon systems cybersecurity failing, GAO report says

A U.S. Government Accountability Office report gave failing grades to military weapon systems cybersecurity, but some experts say the report should be a source of encouragement.

By Michael Heller • Oct. 11, 2018

Patched MikroTik router vulnerability worse than initially thought

Tenable Research finds new exploits of an already patched MikroTik router vulnerability that could enable hackers to launch remote code execution attacks.

By Madelyn Bacon • Oct. 11, 2018

GRU indictment accuses 7 Russians in global cyberattacks

The U.S., U.K. and other allies accused seven Russian military officers in cybercrimes around the world, and the GRU indictment from the U.S. formally pressed charges.

By Michael Heller • Oct. 5, 2018

Compromised Supermicro chips reportedly infiltrated US

News roundup: A Bloomberg report claimed China infiltrated U.S. companies and government agencies through tiny Supermicro chips on motherboards. Plus, a new Telegram flaw and more.

By Madelyn Bacon • Oct. 5, 2018

How does FacexWorm malware use Facebook Messenger to spread?

Researchers at Trend Micro found a new strain of malware -- dubbed FacexWorm -- that targets users via a malicious Chrome extension. Discover how this attack works with Nick Lewis.

By Nick Lewis • Oct. 5, 2018

North Korean cybertheft of $100-plus million attributed to APT38

Security researchers tracked an aggressive cybertheft campaign -- attributed to North Korean APT38 -- in which threat actors attempted to steal more than $1 billion and destroy all evidence along the way.

By Michael Heller • Oct. 4, 2018

How does stegware malware exploit steganography techniques?

Researchers at the 2018 RSA Conference discussed the increasing availability of malware that uses steganography, dubbed stegware. Discover how this works with expert Nick Lewis.

By Nick Lewis • Oct. 4, 2018

How is Android Accessibility Service affected by a banking Trojan?

ThreatFabric researchers uncovered MysteryBot, Android malware that uses overlay attacks to avoid detection. Learn how this malware affects Google's Android Accessibility Service.

By Nick Lewis • Oct. 4, 2018

Beware of the gray hat hacker, survey warns

Close to 40% of security professionals either know, or have known, a legitimate security practitioner who has participated at some point in black hat activities.

By Kathleen Richards • Oct. 2, 2018

How does MassMiner malware infect systems across the web?

Researchers from AlienVault found a new cryptocurrency mining malware -- dubbed MassMiner -- that infects systems across the web. Learn how this malware operates with Nick Lewis.

By Nick Lewis • Oct. 2, 2018

SamSam ransomware: How is this version different from others?

Sophos recently discovered a SamSam extortion code that performs company-wide attacks using a range of vulnerability exploits. Discover how this version differs from past variants.

By Nick Lewis • Oct. 1, 2018