🚨 CISA KEV 1[−]
6 Feb KEVCISA Adds One Known Exploited Vulnerability to CatalogCISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog , based on evidence of active exploitation. CVE-2023-4762 Google Chromium V8 Type Confusion Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and …CISA.GOV
🐛 COMMON VULNERABILITIES AND EXPOSURES 2[−]
6 FebRecent SSRF Flaw in Ivanti VPN Products Undergoes Mass ExploitationA recently disclosed server-side request forgery (SSRF) vulnerability impacting Ivanti Connect Secure and Policy Secure products has come under mass exploitation. The Shadowserver Foundation said it observed exploitation attempts originating from more than 170 unique IP…THEHACKERNEWS.COM
6 FebFortinet FortiSIEM Hit by Two 10/10 Severity VulnerabilitiesThe FortiSIEM product from Fortinet has been found to have two new critical vulnerabilities, CVE-2024-23108 and CVE-2024-23109, which allow for remote code execution by unauthenticated attackers.THEREGISTER.COM
⚠️ VULNERABILITY DISCLOSURE 35[−]
6 FebNewest Ivanti SSRF Zero-Day Now Under Mass ExploitationThe flaw allows attackers to bypass authentication and access restricted resources on vulnerable devices. The exploitation volume is high, with over 170 distinct IP addresses attempting to exploit the vulnerability.BLEEPINGCOMPUTER.COM
6 Feb142: AxactAxact sells fake diplomas and degrees. What could go wrong with this business plan? Sponsors Support for this episode comes from NetSuite. NetSuite gives you visibility and control of your financials, planning, budgeting, and of course - inventory - so you can manage risk, get re…DARKNETDIARIES.COM
6 FebJudge Allows Case Against Geolocation Data Broker Kochava To ProceedThe court ruling allows the FTC to continue its enforcement action against data broker Kochava for selling non-anonymized, granular location data, setting the stage for potential limitations on data brokers' activities.THERECORD.MEDIA
6 FebUS announces visa ban on those linked to commercial spywareThe Commerce Department has sanctioned several European, Israeli, Russian, and Singaporean companies involved in the trafficking and development of spyware tools used for repression and human rights abuses.BLEEPINGCOMPUTER.COM
6 FebHackers Exploit Job Boards in APAC, Steal Data of Millions of Job SeekersEmployment agencies and retail companies chiefly located in the Asia-Pacific (APAC) region have been targeted by a previously undocumented threat actor known as ResumeLooters since early 2023 with the goal of stealing sensitive data. Singapore-headquartered Group-IB sai…THEHACKERNEWS.COM
6 FebGoogle Links Over 60 Zero-Days to Commercial Spyware VendorsMore than 60 of the Adobe, Google, Android, Microsoft, Mozilla and Apple zero-days that have come to light since 2016 attributed to spyware vendors. The post Google Links Over 60 Zero-Days to Commercial Spyware Vendors appeared first on SecurityWeek .SECURITYWEEK.COM
6 FebHow a $10B Enterprise Customer Drastically Increased their SaaS Security Posture with 201% ROI by Using SSPMSaaS applications are the darlings of the software world. They enable work from anywhere, facilitate collaboration, and offer a cost-effective alternative to owning the software outright. At the same time, the very features that make SaaS apps so embraced – access from anywhere a…THEHACKERNEWS.COM
6 FebCritical Remote Code Execution Vulnerability Patched in AndroidAndroid’s February 2024 security patches resolve 46 vulnerabilities, including a critical remote code execution bug. The post Critical Remote Code Execution Vulnerability Patched in Android appeared first on SecurityWeek .SECURITYWEEK.COM
6 FebCisco’s identity and access security offerings to receive AI upgradesCisco has announced plans to infuse new security and AI capabilities within Cisco Security Cloud, the company’s integrated, cloud-based security platform designed to secure on-premise, cloud, and hybrid environments, using in-house as well as third-party telemetry. New capabili…CSOONLINE.COM
6 FebGovernment hackers targeted iPhones owners with zero-days, Google saysGovernment hackers last year exploited three unknown vulnerabilities in Apple’s iPhone operating system to target victims with spyware developed by a European startup, according to Google. On Tuesday, Google’s Threat Analysis Group, the company’s team that investigates nati…TECHCRUNCH.COM
6 FebMFA adoption peaks despite lower remote access authenticationsMulti-factor authentication (MFA) recorded a considerable jump in 2023 even as remote access authentications fell drastically with return-to-office becoming the new reality, according to a Cisco report. The report, which was based on data from 16 billion Duo authentications globa…CSOONLINE.COM
6 FebA Chicago Children’s Hospital Has Taken Its Networks Offline After a CyberattackChicago children’s hospital forced to take networks offline after cyberattack, limiting access to medical records and hampering communication. The post A Chicago Children’s Hospital Has Taken Its Networks Offline After a Cyberattack appeared first on SecurityWeek .SECURITYWEEK.COM
6 FebCanon Patches 7 Critical Vulnerabilities in Small Office PrintersCanon announces patches for seven critical-severity remote code execution flaws impacting small office printer models. The post Canon Patches 7 Critical Vulnerabilities in Small Office Printers appeared first on SecurityWeek .SECURITYWEEK.COM
6 FebAirbus NAVBLUE Flysmart+ Manager Susceptible to Data Manipulation AttacksAirbus Navblue Flysmart+ Manager had a vulnerability that allowed attackers to tamper with engine performance calculations and intercept data, posing a serious risk to flight safety.SECURITYAFFAIRS.COM
6 FebExperts Detail New Flaws in Azure HDInsight Spark, Kafka, and Hadoop ServicesThree new security vulnerabilities have been discovered in Azure HDInsight's Apache Hadoop, Kafka, and Spark services that could be exploited to achieve privilege escalation and a regular expression denial-of-service (ReDoS) condition. "The new vulnerabilities…THEHACKERNEWS.COM
6 FebCombat Phishing Attacks With AI-Powered Email Threat Protection: Packet Guide 2024Cybercriminals use email phishing as one form of cybercrime to deceive victims into disclosing personal information like passwords, credit card details, or Social Security numbers. To accomplish this, they send emails that seem to be from reliable sources, like banks, credi…GBHACKERS.COM
6 FebStarting an OWASP Project (That's Not a List!) - Grant Ongers - ASW #272We can't talk about OWASP without talking about lists, but we go beyond the lists to talk about a product security framework. Grant shares his insights on what makes lists work (and not work). More importantly, he shares the work he's doing to spearhead a new OWASP project to hel…YOUTUBE.COM
6 FebBritain, France Lead 35 Nation Agreement On Controlling Spyware, Mercenary HackersPACKETSTORMSECURITY.COM
6 FebVerizon insider data breach hits over 63,000 employeesVerizon Communications is warning that an insider data breach impacts almost half its workforce, exposing sensitive employee information. [...]BLEEPINGCOMPUTER.COM
6 FebOv3r_Stealer Malware Spreads via Phishing and Facebook AdvertisingThe malware is distributed through a multi-stage infection chain involving weaponized PDF files, internet shortcuts, and PowerShell loaders, with similarities to the previously disclosed Phemedrone Stealer.TRUSTWAVE.COM
6 FebCISA Releases Two Industrial Control Systems AdvisoriesCISA released two Industrial Control Systems (ICS) advisories on February 6, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-037-01 HID Global Encoders ICSA-24-037-02 HID Global Reader Configu…CISA.GOV
6 FebWhy and How to Extract Malware Configurations in a SandboxIndicators of Compromise (IOCs) are the fuel that powers our cybersecurity defenses and keeps them effective. The most sought-after source of these indicators is malware configurations. Accessing them is equal to exposing the attacker’s playbook. Hence, thousands of analyst…GBHACKERS.COM
6 FebJetBrains warns of new TeamCity auth bypass vulnerabilityJetBrains urged customers today to patch their TeamCity On-Premises servers against a critical authentication bypass vulnerability that can let attackers take over vulnerable instances with admin privileges. [...]BLEEPINGCOMPUTER.COM
6 FebGoogle says spyware vendors behind most zero-days it discoversCommercial spyware vendors (CSV) were behind 80% of the zero-day vulnerabilities Google's Threat Analysis Group (TAG) discovered in 2023 and used to spy on devices worldwide. [...]BLEEPINGCOMPUTER.COM
6 FebDutch Intelligence Finds Chinese Hackers Spying on Secret Defence Ministry NetworkChinese state-sponsored hackers breached the internal computer network of the Dutch Ministry of Defence using a vulnerability in FortiGate devices. The breach was for espionage purposes and the malware was found in a compartmentalized network.THERECORD.MEDIA
6 FebCISA Announces Renewal of the Information and Communications Technology Supply Chain Risk Management Task ForceCISA.GOV
6 FebVerizon Insider Data Breach Hits Over 63,000 EmployeesVerizon Communications has reported an insider data breach affecting nearly half of its workforce, exposing sensitive employee information such as names, addresses, Social Security numbers, and compensation details.BLEEPINGCOMPUTER.COM
6 FebRansomware victim numbers rose by 50% in 2023The number of victims that ransomware groups posted on their data leak sites increased by 50% last year according to an analysis by researchers from Palo Alto Networks. Twenty-five new groups also appeared last year but some of them had a short life until they disbanded or rebran…CSOONLINE.COM
6 FebConfirmed: Entrust is buying AI-based ID verification startup Onfido, sources say for more than $400MOnfido, an early mover in the world of identity verification using computer vision and other AI tools, is getting acquired, TechCrunch has learned and confirmed. Entrust — the privately-held company that provides a range of certification and verification services around pay…TECHCRUNCH.COM
6 FebNew Banking Trojan Exploits Patched Windows SmartScreen FlawMispadu Trojan Is Compromising Windows Security, Posing Threat to Banking Systems The novel variant of the banking Trojan Mispadu is targeting Latin American countries, especially Mexico, by exploiting a flaw in Windows SmartScreen. In this latest distribution method, the attacke…DATABREACHTODAY.CO.UK
6 FebChinese Hackers Penetrated Unclassified Dutch NetworkBeijing Used FortiGate Vulnerability to Install Trojan Chinese espionage hackers penetrated Dutch military systems in early 2023, using a zero-day exploit in a Fortinet virtual private network to obtain access, Netherlands intelligence agencies disclosed Tuesday. They attributed …DATABREACHTODAY.CO.UK
6 FebMAR-10448362-1.v1 Volt TyphoonNotification This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in…CISA.GOV
6 FebPiloting new ways of protecting Android users from financial fraudPosted by Eugene Liderman, Director of Mobile Security Strategy, Google From its founding , Android has been guided by principles of openness, transparency, safety, and choice. Android gives you the freedom to choose which device best fits your needs, while also providing the fle…SECURITY.GOOGLEBLOG.COM
📋 SECURITY BULLETINS 1[−]
6 FebCyber Trust Mark concept gains momentum with smart device and IoT manufacturersA big part of the discussion around cybersecurity in the last several years has centered around the need for more transparency to help address what many consider to be a market failure of cybersecurity: the lack of a system to reassure consumers that products are safe. On the ent…CSOONLINE.COM
📢 SECURITY ADVISORIES 6[−]
6 FebUpdate: Classified Japanese Diplomatic Documents Leaked in Chinese CyberattacksThe leak compromised highly confidential documents exchanged between the Ministry of Foreign Affairs and its international diplomatic missions, prompting discussions between Tokyo and Washington on countermeasures.EFE.COM
6 FebPennsylvania Courts’ Website Disrupted by DoS AttackThe Pennsylvania Courts system has been hit by a cyberattack, taking down parts of its website. The Administrative Office of Pennsylvania Courts revealed via social media that the service had suffered a denial of service (DoS) attack.INFOSECURITY-MAGAZINE.COM
6 FebChinese hackers infect Dutch military network with malwareA Chinese cyber-espionage group breached the Dutch Ministry of Defence last year and deployed malware on compromised devices, according to the Military Intelligence and Security Service (MIVD) of the Netherlands. [...]BLEEPINGCOMPUTER.COM
6 FebCISA's Flagship Cyber Collaborative Faces Growing CriticismUS Joint Cyber Defense Collaborative Suffering From 'Growing Pains,' Experts Say The Cybersecurity and Infrastructure Security Agency launched a public-private sector collaborative in 2021 to help unify cyber defenses between government and industry, but experts testified Tuesday…DATABREACHTODAY.CO.UK
🔥 INCIDENT REPORTING 15[−]
6 FebUK, France Host Conference to Tackle ‘Hackers for Hire’Britain and France will host 35 nations alongside business and technology firm leaders at an inaugural conference in London to tackle "hackers for hire" and the market for cyberattack tools. The post UK, France Host Conference to Tackle ‘Hackers for Hire’ appeared fir…SECURITYWEEK.COM
6 FebUpdate: Clorox Says Cyberattack Caused $49 Million in ExpensesThe cyberattack led to disruption in Clorox's business operations, requiring expenses for IT recovery, forensic experts, and professional services to investigate and remediate the attack.BLEEPINGCOMPUTER.COM
6 FebUS Sanctions Iranian Officials Over Cyberattacks on Water PlantsThe cyberattacks targeted water systems in Pennsylvania and were carried out by an Iranian-backed militia group, exposing vulnerabilities in America's water infrastructure.BBC.COM
6 FebPhilippine Lawmakers Demand Briefing Following China-Linked CyberattackThe Philippines repelled a cyberattack from hackers suspected to be based in China, targeting multiple government departments. The attackers used IP addresses located in China, prompting lawmakers to demand an urgent briefing on national securityTHERECORD.MEDIA
6 FebReport: Ethical Hackers Reported 835 Vulnerabilities, Earned $450K in 2023Collaboration between organizations and ethical hackers is essential as cyberattacks become more sophisticated, and bug bounty programs play a significant role in promoting online security.HACKREAD.COM
6 FebCyberattack Targets Maine Healthcare Provider’s Computer ServersA cyberattack over the weekend targeted the computer servers of Northern Light Health, a major Maine healthcare provider. As a precaution, it temporarily took all patient records offline, although the records were not on the affected servers.NECN.COM
6 FebHPE Investigates New Breach After Data for Sale on Hacking ForumHewlett Packard Enterprise (HPE) is investigating a potential breach after a threat actor claimed to have stolen HPE credentials and sensitive data and put it up for sale on a hacking forum.BLEEPINGCOMPUTER.COM
6 FebResumeLooters Gang Steals User Information from Retail and Job SitesThe stolen data, including over two million unique email addresses, was put up for sale in Chinese-speaking hacking-themed Telegram groups, with the majority of the focus on India, Taiwan, Thailand, and Vietnam.INFOSECURITY-MAGAZINE.COM
6 FebResearchers Unvield the Sophisticated Ransomware Used by Black HuntThe Black Hunt ransomware has recently become a significant threat to the cybersecurity landscape. This malicious software has already wreaked havoc on around 300 companies in Paraguay, causing significant damage and disruption to their operations. The impact of this ransomware a…GBHACKERS.COM
6 FebThird-party breaches hit 90% of top global energy companiesA new report from SecurityScorecard reveals a startling trend among the world’s top energy companies, with 90% suffering from data breaches through third parties over the last year. This statistic is particularly concerning given the crucial function these companies serve i…SECURITYINTELLIGENCE.COM
6 FebCloudflare Server Compromised Due to Leaked Access Token in Okta BreachOn November 23, 2023, Cloudflare detected a threat actor on the self-hosted Atlassian server. The attack was initiated using a single stolen access token and three compromised service account credentials, which were kept the same after the Okta compromise in October 2023. The sec…GBHACKERS.COM
6 FebSynthetic Data: The New Frontier in Cyber ExtortionOrganizations are increasingly facing cyber attacks resulting in data breaches, and part of their post-incident responsibilities includes adhering to mandatory reporting requirements.KNOWBE4.COM
6 FebGenerative AI Used to Launch Phishing AttacksCriminal threat actors are increasingly utilizing generative AI tools like ChatGPT to launch social engineering attacks, according to researchers at Check Point.KNOWBE4.COM
6 FebData breach at French healthcare services firm puts millions at riskFrench healthcare services firm Viamedis suffered a cyberattack that exposed the data of policyholders and healthcare professionals in the country. [...]BLEEPINGCOMPUTER.COM
6 FebMedical Center Fined $4.75M in Insider ID Theft IncidentHHS OCR Says a Malicious Worker Stole and Sold Patient Information in 2013 HHS has fined a New York City medical center $4.75 million to settle potential HIPAA violations discovered during an investigation into a hospital insider who sold patient data to identity thieves in 2013.…DATABREACHTODAY.CO.UK
🕵️ THREAT INTELLIGENCE 25[−]
6 FebISC Stormcast For Tuesday, February 6th, 2024 https://isc.sans.edu/podcastdetail/8840, (Tue, Feb 6th)(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.ISC.SANS.EDU
6 FebWhat is SaaS Sprawl? Guide to Combating SaaS Security RisksWhen we talk about the cloud, it’s not just a matter of data drifting weightlessly in some digital ether. The cloud environment is more like a bustling cityscape, with new buildings popping up every day. This expansion is often referred to as the rapid growth of cloud servi…GBHACKERS.COM
6 FebComputer viruses are celebrating their 40th birthday (well, 54th, really), (Tue, Feb 6th)Although "cyber security" is a relatively new field, it already has quite an interesting history, and it is worthwhile to look back at it from time to time. One historical event, that took place in February of the Orwellian year 1984, and which – therefore &#…ISC.SANS.EDU
6 FebMultiple Container Flaws Allow Attackers to Access the Host OSFour new vulnerabilities have been identified in containers that could allow a threat actor to escape the container and gain access to the host system. These vulnerabilities have been named “Leaky Vessels” by researchers that could potentially enable a threat actor to access sens…GBHACKERS.COM
6 FebDarknet Diaries 142: Axactsubmitted by ashar to security_cpe 1 points | 0 comments https://infosec.pub/pictrs/image/5ba76e89-90b5-414b-97e5-c2a284ca5599.png Darknet Diaries 142: Axact Axact sells fake diplomas and degrees. What could go wrong with this business plan?INFOSEC.PUB
6 FebHacker Conversations: Rob Dyke on Legal Bullying of Good Faith ResearchersSecurityWeek talks to Rob Dyke, discussing corporate legal bullying of good faith researchers. The post Hacker Conversations: Rob Dyke on Legal Bullying of Good Faith Researchers appeared first on SecurityWeek .SECURITYWEEK.COM
6 FebBeware: Fake Facebook Job Ads Spreading 'Ov3r_Stealer' to Steal Crypto and CredentialsThreat actors are leveraging bogus Facebook job advertisements as a lure to trick prospective targets into installing a new Windows-based stealer malware codenamed Ov3r_Stealer. "This malware is designed to steal credentials and crypto wallets and send those to a Telegram ch…THEHACKERNEWS.COM
6 FebCyberheistNews Vol 14 #06 [New Threat] Attackers Are Now Using MS Teams to Phish Your UsersKNOWBE4.COM
6 FebSorting Out Glibc Vulns, Apple's Security Research Device, BoringSSL, Old C Vulns - ASW #272Qualys discloses syslog and qsort vulns in glibc, Apple's jailbroken iPhone for security researchers, moving away from OpenSSL, what an ancient vuln in image parsing can teach us today, and more! Visit https://www.securityweekly.com/asw for all the latest episodes! Show Notes: ht…YOUTUBE.COM
6 FebCriminal IP ASM: A new cybersecurity listing on Microsoft AzureAI SPERA, a leader in Cyber Threat Intelligence (CTI)-based solutions, today announced that Criminal IP ASM (Attack Surface Management) is now available on the Microsoft Azure Marketplace. [...]BLEEPINGCOMPUTER.COM
6 FebGenerative AI and Corporate Security – Getting it Right - Bill Franks - CSP #160Generative AI has hit the world by storm, but unfortunately is widely misunderstood. While it brings great promise for companies, it also has risks. As employees and corporate applications begin making use of generative AI, it is important to ensure that proper safety and securit…YOUTUBE.COM
6 FebZeroFox to be Taken Private in $350 Million DealZeroFox agrees to be acquired by PE firm Haveli Investments for $350 million and become a privately held company. The post ZeroFox to be Taken Private in $350 Million Deal appeared first on SecurityWeek .SECURITYWEEK.COM
6 FebTech Giants Form Post-Quantum Cryptography AllianceThe Linux Foundation, AWS, Cisco, IBM, and other tech companies establish the Post-Quantum Cryptography Alliance. The post Tech Giants Form Post-Quantum Cryptography Alliance appeared first on SecurityWeek .SECURITYWEEK.COM
6 FebMillions of User Records Stolen From 65 Websites via SQL Injection AttacksThe ResumeLooters hackers compromise recruitment and retail websites using SQL injection and XSS attacks. The post Millions of User Records Stolen From 65 Websites via SQL Injection Attacks appeared first on SecurityWeek .SECURITYWEEK.COM
6 FebIonix Adds $15M to Series A Funding RoundIonix, formerly known as Cyperpion, has attracted $15 million in new capital to complete a $42 million Series A funding round. The post Ionix Adds $15M to Series A Funding Round appeared first on SecurityWeek .SECURITYWEEK.COM
6 FebDocuments about the NSA’s Banning of Furby Toys in the 1990sVia a FOIA request, we have documents from the NSA about their banning of Furby toys.SCHNEIER.COM
6 FebPython Info-stealer Distributed by Malicious Excel DocumentThe threat actors behind the campaign utilized multiple stages and techniques, including obfuscation and leveraging open platforms, to carry out the attack and steal sensitive information.FORTINET.COM
6 FebTeens Gone Wild, Nintendo, Anydesk, RUST, Google, Deepfakes, Jason Wood, and more – SWN #360Joins us live with Dough White at 12pm ET as we discuss Teens Gone Wild, #Nintendo, #Anydesk, #RUST, #Google, Deepfakes, Jason Wood, and more are on this edition of the Security Weekly News. →Watch live: https://securityweekly.com/live →Subscribe to our podcasts: https://security…YOUTUBE.COM
6 FebRobust Governance, Standards Needed for AI Adoption at ScaleIAPP's Ashley Casovan on Developing Training and Certification for Effective AI Governance The escalating adoption of generative AI has introduced concerns regarding data privacy, fake data and bias amplification. Ashley Casovan, managing director of IAPP AI Governance Center, di…DATABREACHTODAY.CO.UK
6 FebTrends in Phishing, Fraud, 'Dark AI Models', and how to better protect yourself.submitted by L4s to secops 1 points | 0 comments https://guardyourdomain.com/blog/trends-in-phishing-fraud/ Trends in Phishing, Fraud, ‘Dark AI Models’, and how to better protect yourself.::We guard your domain, so you have peace of mind. Threat Visibility Platform.GUARDYOURDOMAIN.COM
6 FebUS, UK and France Pressure Commercial Spyware IndustryThe United States ramped up pressure on the commercial surveillance industry shortly before the United Kingdom and France convened a two-day meeting dubbed the Pall Mall Process intended to culminate in an international agreement limiting the proliferation of advanced spyware.DATABREACHTODAY.CO.UK
6 FebTeens Gone Wild, Nintendo, Anydesk, RUST, Google, Deepfakes, Jason Wood, and more - SWN #360Teens Gone Wild, Nintendo, Anydesk, RUST, Google, Deepfakes, Jason Wood, and more are on this edition of the Security Weekly News. Visit https://www.securityweekly.com/swn for all the latest episodes! Show Notes: https://securityweekly.com/swn-360YOUTUBE.COM
6 FebCourt: FTC Privacy Suit Against Data Broker Can Move AheadJudge Denies Kochava's Motion to Dismiss Agency's Claim of Privacy Violations A federal judge has denied Kochava's latest attempt to ditch a Federal Trade Commission lawsuit alleging the firm is invading consumers' privacy and exposing them to risk by collecting and selling their…DATABREACHTODAY.CO.UK
6 FebGil Shwed to Step Down as Check Point CEOCompany Co-Founder Will Take Role as Executive Chairman After Appointing Successor Firewall maker Check Point Software in an earnings call touted a strong fourth quarter - and a future that won't involve co-founder Gil Shwed as company CEO. Shwed has headed the publicly traded, $…DATABREACHTODAY.CO.UK
6 FebMicrosoft Entra Verified ID introduces Face Check in previewFace Check is now in preview in Microsoft Entra Verified ID, unlocking high-assurance verifications for enterprises securely, simply, and at scale. The post Microsoft Entra Verified ID introduces Face Check in preview appeared first on Microsoft Security Blog .MICROSOFT.COM
🌐 CYBER THREAT LANDSCAPE 3[−]
6 FebU.S. Imposes Visa Restrictions on those Involved in Illegal Spyware SurveillanceThe U.S. State Department said it's implementing a new policy that imposes visa restrictions on individuals who are linked to the illegal use of commercial spyware to surveil civil society members. "The misuse of commercial spyware threatens privacy and freedoms of expr…THEHACKERNEWS.COM
6 FebAttack surface management platform Ionix adds another $15M to its $27M Series A roundIonix (formerly Cyberpion) helps enterprises reduce their attack surface by giving them a better view of their overall security posture and software supply chain across on-premises, cloud and third-party platforms and services. The company today announced that it has added $15 mi…TECHCRUNCH.COM
6 FebCrypto wallet drainer: what it is and how to defend against it | Kaspersky official blogWhat a crypto wallet drainer is, what makes this type of malware dangerous for crypto owners, and how to defend against it.KASPERSKY.COM
📡 INFOSEC NEWS 16[−]
6 FebSafer Internet Day is as important as everUse this timely reminder to protect yourself on the internetSOPHOS.COM
6 FebEU Adopts First Cybersecurity Certification Scheme for Safer TechThe EUCC scheme is voluntary and aims to provide a common assessment process for ICT suppliers to certify products, based on the SOG-IS Common Criteria evaluation framework.HELPNETSECURITY.COM
6 FebResearchers Discover Exposed API Secrets, Impacting Major Tech TokensThe security research team at Escape scanned 189.5 million URLs and discovered over 18,000 exposed API secrets, with 41% of them being highly critical and posing financial risks.HELPNETSECURITY.COM
6 FebLatio Application Security Tester Uses AI to Scan Your CodeLatio Application Security Tester simplifies code scanning with OpenAI, offering easy code change submission and GitHub Actions templates. The tool's future plans include support for non-OpenAI models, improved handling of large files, and more.HELPNETSECURITY.COM
6 FebDJI - The ART of obfuscationStudy of an Android runtime (ART) hijacking mechanism for bytecode injection through a step-by-step analysis of the packer used to protect the DJI Pilot Android application.QUARKSLAB.COM
6 FebHackers steal data of 2 million in SQL injection, XSS attacksA threat group named 'ResumeLooters' has stolen the personal data of over two million job seekers after compromising 65 legitimate job listing and retail sites using SQL injection and cross-site scripting (XSS) attacks. [...]BLEEPINGCOMPUTER.COM
6 FebMozilla Monitor’s new service removes your personal info from data broker sites automaticallyMozilla today is introducing a new subscription service that will help people locate and remove their personal and sensitive information from data broker websites around the web. This includes the ability to remove your phone number, email, home address, and other information tha…TECHCRUNCH.COM
6 FebDouble Trouble For Fortinet Customers As Pair Of Critical Vulns Found in FortiSIEMPACKETSTORMSECURITY.COM
6 FebDeepfake Video Conference Convinces Employee To Send $25 Million To ScammersPACKETSTORMSECURITY.COM
6 FebUnifying Cloud Security Beyond SiloesAttacks don’t stay in siloes, and neither should your security solutions. Explore the benefits of a cybersecurity platform that consolidates security across multiple layers—including the cloud—for more proactive risk management.TRENDMICRO.COM
6 FebUnifying Cloud Security Beyond SiloesAttacks don’t stay in siloes, and neither should your security solutions. Explore the benefits of a cybersecurity platform that consolidates security across multiple layers—including the cloud—for more proactive risk management.TRENDMICRO.COM
6 FebHow to Win a Cyberwar: Use a Combined Intelligence StrategyIn times of conflict, such as the Israel-Hamas war, intelligence becomes even more important than it is in peacetime. Red Curry, chief marketing officer at Tautuk, and his brother, Sam Curry, CISO at Zscaler, discuss the need for a combined intelligence strategy and better resili…DATABREACHTODAY.CO.UK
6 FebUpdate: Equilend Back in Action as Ransom Payment Rumors SwirlWhile it is unclear whether a ransom was paid, the company stated that client transaction data was not accessed during the attack. The attack occurred amidst a major business deal, but experts predicted minimal disruption to EquiLend's operationsTHEREGISTER.COM
6 FebLeft to their own devices: Security for employees using personal devices for workAs personal devices within corporate networks make for a potentially combustible mix, a cavalier approach to BYOD security won’t cut itWELIVESECURITY.COM