🐛 COMMON VULNERABILITIES AND EXPOSURES 8[−]
21 MarAtlassian Releases Fixes for Over 2 Dozen Flaws, Including Critical Bamboo BugAtlassian has released patches for more than two dozen security flaws, including a critical bug impacting Bamboo Data Center and Server that could be exploited without requiring user interaction. Tracked as CVE-2024-1597, the vulnerability carries a CVSS score of 10.0, …THEHACKERNEWS.COM
21 MarIvanti Releases Urgent Fix for Critical Sentry RCE VulnerabilityIvanti has disclosed details of a critical remote code execution flaw impacting Standalone Sentry, urging customers to apply the fixes immediately to stay protected against potential cyber threats. Tracked as CVE-2023-41724, the vulnerability carries a CVSS score of 9.6. "An…THEHACKERNEWS.COM
21 MarUDP-based network communications face critical denial-of-service attacksA novel attack technique is found capable of launching a looped denial of service (DoS) attack between a pair of network applications, blocking legitimate access to their respective servers indefinitely. This is an application layer attack, targeted at systems running a vulnerabl…CSOONLINE.COM
21 MarMicrosoft Patches Xbox Vulnerability Following Public DisclosureMicrosoft patches Xbox Gaming Services vulnerability CVE-2024-28916 after initially saying it was not a security issue. The post Microsoft Patches Xbox Vulnerability Following Public Disclosure appeared first on SecurityWeek .SECURITYWEEK.COM
21 MarIvanti Releases Security Updates for Neurons for ITSM and Standalone SentryIvanti has released security advisories to address vulnerabilities in Ivanti Neurons for ITSM and Standalone Sentry. A cyber threat actor could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the follow…CISA.GOV
21 MarExploiting GLPI during a Red Team engagementThe following article explains how during a Red Team engagement we were able to develop a 1day for GLPI CVE-2023-43813 which later led to the identification of an arbitrary object instantiation leading to an SSRF referenced as CVE-2024-27098 as well as an SQL injection referenced…QUARKSLAB.COM
21 Mar KEVA Dive into Vulnerabilities and Compliance - PSW #821We discuss the always controversial Flipper Zero devices the hidden risks in the undersea cables, and the landscape of government oversight, revealing the intricacies of CVE, KEV, and NVD systems that are the linchpins of our digital safety. The conversation takes a turn to the p…YOUTUBE.COM
21 MarNIST's Vuln Database Downshifts, Prompting Questions About Its Futuresubmitted by Lanky_Pomegranate530 to cybersecurity 1 points | 0 comments https://www.darkreading.com/cybersecurity-operations/nist-vuln-database-downshifts-prompting-questions-about-its-future NVD may be in peril and while alternatives exist, enterprise security managers will nee…DARKREADING.COM
⚠️ VULNERABILITY DISCLOSURE 31[−]
21 MarWindows 11, Tesla, and Ubuntu Linux hacked at Pwn2Own VancouverOn the first day of Pwn2Own Vancouver 2024, contestants demoed Windows 11, Tesla, and Ubuntu Linux zero-day vulnerabilities and exploit chains to win $732,500 and a Tesla Model 3 car. [...]BLEEPINGCOMPUTER.COM
21 MarSurviving the “Quantum Apocalypse” With Fully Homomorphic EncryptionQuantum computing has the potential to break cryptosystems that are the foundations of the technology protecting the privacy of data and information created and shared every day.HELPNETSECURITY.COM
21 MarWhite House and EPA Warn of Hackers Breaching Water SystemsThe NSC and the EPA have invited governors to a virtual meeting on March 21 to strengthen collaboration between government entities and water systems and establish a Water Sector Cybersecurity Task Force.BLEEPINGCOMPUTER.COM
21 MarStudy: Cybersecurity burnout impacts 88% of cybersecurity and IT roles in Singapore. What can you do as an MSP to help?Cybersecurity is now a top priority for businesses in Singapore as IT and business leaders understand the financial and reputational damage that cyberattacks can inflict. However, relentless pressure from ever-evolving cyber attacks is leading to burnout among cybersecurity profe…CSOONLINE.COM
21 MarRecent Windows Server Updates Trigger Domain Controller Reboots & CrashRecent updates for Windows Server have been linked to significant disruptions in IT infrastructure, with numerous reports of domain controllers experiencing crashes and forced reboots. The issues have been traced back to the March 2024 cumulative updates for Windows Server 2016 a…GBHACKERS.COM
21 MarAuthorities Dismantle Grandoreiro Banking Malware OperationGroup-IB, a cybersecurity firm, helped INTERPOL and Brazil dismantle the Grandoreiro banking trojan operation, as their expertise in threat intelligence and investigation was key. Malware samples collected during independent investigations in Brazil and Spain (2020-2022) we…GBHACKERS.COM
21 MarWhy more women aren’t CISOs and how to change thatCybersecurity has been a male-dominated area and the reasons behind this include fewer women pursuing STEM careers and conscious or unconscious bias when hiring and promoting. The number of women taking on the CISO job is increasing and CSO spoke to four women who shared their ex…CSOONLINE.COM
21 MarUsing MITRE ATT&CK Framework to Thwart Active AdversariesExploited vulnerabilities and compromised credentials are the primary ways active adversaries breach organizations, making patch management and credential security crucial defenses.SCMAGAZINE.COM
21 MarOPM Pitches Congress on a Federal Cyber Workforce RevampThe Office of Personnel Management proposed a legislative proposal to give federal agencies new authority and flexibility in how they hire and pay cybersecurity workers to members of Congress, but so far no member has stepped up to sponsor the bill.NEXTGOV.COM
21 MarAndroxgh0st Exploits SMTP Services to Extract Critical DataAndroxGh0st is a malware that specifically targets Laravel applications. The malware scans and extracts login credentials linked to AWS and Twilio from environment files.BLOGS.JUNIPER.NET
21 MarUkrainian Police Arrest Suspected Brute Force Account HijackersOperating as part of a cybercrime group, they are said to have used brute-force techniques to hijack victims’ email and Instagram accounts that were protected by easy-to-guess passwords.INFOSECURITY-MAGAZINE.COM
21 MarNew Application-Layer Loop DoS Attack – 300,000 Online Systems At RiskDenial-of-service (DoS) attacks are usually exploited by hackers to interrupt regular network and website functioning, with motives of making money or for political reasons or simply to create a mess. The websites or networks can be made unavailable through the Denial of Se…GBHACKERS.COM
21 MarNorth Korea’s Kimsuky Group Equipped to Exploit Windows Help filesCybersecurity experts have uncovered a sophisticated cyber espionage campaign orchestrated by the North Korean threat actor group Kimsuky, Black Banshee, or Thallium. This group, notorious for its intelligence-gathering missions, has been active since at least 2012. It has primar…GBHACKERS.COM
21 MarSpa Grand Prix Email Account Hacked to Phish Banking Information From FansIn a press release sent to BleepingComputer, the race organizer explained that the email account was hijacked on Sunday, March 17, 2024, and was followed by the threat actor sending fraudulent emails to an undisclosed number of people.BLEEPINGCOMPUTER.COM
21 MarIvanti Urges Customers to Fix Critical RCE Flaw in Standalone SentryThis vulnerability affects all supported versions 9.17.0, 9.18.0, and 9.19.0. Older versions are also impacted. The company urge customers to install the available versions 9.17.1, 9.18.1, and 9.19.1, which address the issue.SECURITYAFFAIRS.COM
21 MarCISA, FBI, and MS-ISAC Release Update to Joint Guidance on Distributed Denial-of-Service TechniquesToday, CISA, the Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released an updated joint guide, Understanding and Responding to Distributed Denial-Of-Service Attacks , to address the specific needs and challenges face…CISA.GOV
21 MarVulnerability Allowed One-Click Takeover of AWS Service AccountsAWS patches vulnerability that could have been used to hijack Managed Workflows Apache Airflow (MWAA) sessions via FlowFixation attack. The post Vulnerability Allowed One-Click Takeover of AWS Service Accounts appeared first on SecurityWeek .SECURITYWEEK.COM
21 MarAndroxGh0st Malware Targets Laravel Apps to Steal Cloud CredentialsCybersecurity researchers have shed light on a tool referred to as AndroxGh0st that's used to target Laravel applications and steal sensitive data. "It works by scanning and taking out important information from .env files, revealing login details linked to AWS and Twil…THEHACKERNEWS.COM
21 MarIt's 2024 And North Korea's Kimsuky Gang Is Exploiting Windows Help FilesPACKETSTORMSECURITY.COM
21 MarCISA Releases One Industrial Control Systems AdvisoryCISA released one Industrial Control Systems (ICS) advisory on March 21, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-081-01 Advantech WebAccess/SCADA CISA encourages users and administrato…CISA.GOV
21 MarCritical Flaw in Atlassian Bamboo Data Center and Server Must Be Fixed ImmediatelyThe vulnerability allows unauthenticated attackers to expose assets in the environment, with a high impact on confidentiality, integrity, and availability, without requiring user interaction.SECURITYAFFAIRS.COM
21 MarOver 800 npm Packages Found with Discrepancies, 18 Exploitable to 'Manifest Confusion'New research has discovered over 800 packages in the npm registry which have discrepancies from their registry entries, out of which 18 have been found to exploit a technique called manifest confusion. The findings come from cybersecurity firm JFrog, which said the issue cou…THEHACKERNEWS.COM
21 Mar KEVExploit released for Fortinet RCE bug used in attacks, patch nowSecurity researchers have released a proof-of-concept (PoC) exploit for a critical vulnerability in Fortinet's FortiClient Enterprise Management Server (EMS) software, which is now actively exploited in attacks. [...]BLEEPINGCOMPUTER.COM
21 MarSecuring All The Things - Josh Corman - PSW #821Josh Corman joins us to explore how we can make things more secure, making companies make things more secure, and making regulations that make us make things more secure! We will also touch on supply chain security and the state of vulnerability tracking and scoring. Visit https:…YOUTUBE.COM
21 MarWater Sector Lacks Support to Meet White House Cyber DemandsExperts Say Water Sector Lacks Technical Resources to Comply With Federal Requests The White House convened state environmental, health and homeland security agencies Thursday as experts told ISMG water utilities across the country - particularly those in small, under-resourced c…DATABREACHTODAY.CO.UK
21 MarNew phishing campaign targets US organizations with NetSupport RATHundreds of US employees have been targeted in a new email attack that uses accounting lures to distribute malicious documents that deploy a malicious remote access tool known as NetSupport RAT. The attackers use a combination of detection evasion techniques including Office Obje…CSOONLINE.COM
21 MarIvanti Keeps Security Teams Scrambling With 2 More Vulnssubmitted by Lanky_Pomegranate530 to cybersecurity 1 points | 0 comments https://www.darkreading.com/vulnerabilities-threats/ivanti-security-teams-scrambling-2-vulns Since the beginning of this year, the company has disclosed some seven critical bugs so far, almost all of which a…DARKREADING.COM
21 MarDenial-of-Service Attack Could Put Servers in Perpetual LoopResearchers Spot Vulnerability in Application-Layer Communication Protocol A new type of denial-of-service threat can disrupt an estimated 300,000 internet hosts that are at risk of exploitation. Researchers at the CISPA Helmholtz Center for Information Security say attackers are…DATABREACHTODAY.CO.UK
21 MarUK Official: AI in Defense Sector Is Not About Killer RobotsIt Will Do Low-Level Tasks to Free Up Pros to Make Decisions, Say Researchers The current use of artificial intelligence in the U.K. defense sector is not about creating killer robots. It is focused on optimizing resources and increasing the efficiency of military operations, exp…DATABREACHTODAY.CO.UK
📋 SECURITY BULLETINS 1[−]
21 MarMicrosoft confirms Windows Server issue behind domain controller crashesMicrosoft confirmed that a memory leak introduced with the March 2024 Windows Server security updates is behind a widespread issue causing Windows domain controllers to crash. [...]BLEEPINGCOMPUTER.COM
📢 SECURITY ADVISORIES 4[−]
21 MarCISA Recommends Continuous Cybersecurity TrainingIn an age when 70% - 90% of successful data breaches involve social engineering (which gets past all other defenses), sufficient training is needed to best reduce human-side cybersecurity risk. Everyone should be trained in how to recognize social engineering attempts, how to mit…KNOWBE4.COM
21 MarRisk and Regulation: Preparing for the Era of Cybersecurity ComplianceThe next twelve months will see the implementation of several regulations designed to improve cybersecurity standards across various industries. The post Risk and Regulation: Preparing for the Era of Cybersecurity Compliance appeared first on SecurityWeek .SECURITYWEEK.COM
21 MarTax Hackers Blitz Small Business With Phishing EmailsWorryingly, the social engineering scammers are likely operating with little more than a cheap email list of self-employed US residents, according to the latest advisory from Malwarebytes Labs.DARKREADING.COM
21 MarNew Bipartisan Bill Would Require Online Identification, Labeling of AI-Generated Videos and AudioKey provisions in the legislation would require AI developers to identify content created using their products with digital watermarks or metadata. The post New Bipartisan Bill Would Require Online Identification, Labeling of AI-Generated Videos and Audio appeared first on Securi…SECURITYWEEK.COM
🔥 INCIDENT REPORTING 19[−]
21 MarSmashing Security podcast #364: Bing pop-up wars, and the British Library ransomware scandalThere's a Bing ding dong, after Microsoft (over?) enthusiastically encourages Chrome users to stop using Google, and silence hits the British Library as it shares its story of a ransomware attack. All this and more is discussed in the latest edition of the “Smashing Security” pod…GRAHAMCLULEY.COM
21 MarVans warns customers of fraud risk after data breachsubmitted by Lanky_Pomegranate530 to cybersecurity 3 points | 0 comments https://cybernews.com/news/vans-data-breach-fraud-risk/CYBERNEWS.COM
21 MarHackers Claimed to have Breached the Israeli Nuclear Facility’s NetworksAn Iranian hacker group has claimed to have infiltrated the networks of the Dimona nuclear facility located in Israel’s Negev desert. Israeli cybersecurity teams are diligently working to verify the authenticity of the documents allegedly leaked during this cyber incident. …GBHACKERS.COM
21 Mar'Fluffy Wolf' Spreads Meta Stealer in Corporate Phishing CampaignMeta Stealer is launched via Remote Utilities, a legitimate remote access tool, allowing threat actors to gain complete control over compromised devices and steal sensitive data.DARKREADING.COM
21 MarHackers Claim to Have Breached Israeli Nuclear Facility’s Computer NetworkAn Iran-linked hacking group claims to have breached the computer network of a sensitive Israeli nuclear installation in an incident declared by the ‘Anonymous’ hackers as a protest against the war in Gaza.THERECORD.MEDIA
21 MarHackers Posing as Law Firms Phish Global Orgssubmitted by kid to cybersecurity 1 points | 0 comments https://www.darkreading.com/cyberattacks-data-breaches/hackers-posing-law-firms-phish-global-orgs-multiple-languagesDARKREADING.COM
21 MarHow I got started: Ransomware negotiatorSpecialized roles in cybersecurity are proliferating, which isn’t surprising given the evolving threat landscape and the devastating impact of ransomware on many businesses. Among these roles, ransomware negotiators are becoming more and more crucial. These negotiators oper…SECURITYINTELLIGENCE.COM
21 MarHacker Pleads Guilty For Stealing 132,000+ Users DataRobert Purbeck, a hacker known as “Lifelock” and “Studmaster,” hacked into the computer servers of the City of Newnan, a medical clinic in Griffin, and at least 17 other victims across the US. He stole the personal information of more than 132,…GBHACKERS.COM
21 MarNemesis Market: Leading Darknet Market SeizedThe infamous Nemesis Market, a leading figure in the darknet marketplace ecosystem, has been successfully seized. This operation dismantles a major hub of illegal online trade, ranging from narcotics to stolen data, affecting thousands of users worldwide. The Rise of Nemesis Mark…GBHACKERS.COM
21 MarWhat the Latest Ransomware Attacks Teach About Defending NetworksRecent ransomware attacks have shared valuable lessons on how to limit risk to your own networks. Learn from Blink Ops about how organizations can limit their ransomware risk. [...]BLEEPINGCOMPUTER.COM
21 MarRansomware Group “RA World” Changes Its’ Name and Begins Targeting Countries Around the GlobeThe threat group "RA World" (formerly RA Group) has shifted from country-specific ransomware attacks to include specific industries via a new - not previously seen - method of extortion.KNOWBE4.COM
21 MarOnDemand | Identity Under Siege in the EU: How to Combat Data Breaches with Proactive MeasuresDATABREACHTODAY.CO.UK
21 MarRussia Hackers Using TinyTurla-NG to Breach European NGO's SystemsThe Russia-linked threat actor known as Turla infected several systems belonging to an unnamed European non-governmental organization (NGO) in order to deploy a backdoor called TinyTurla-NG. "The attackers compromised the first system, established persistence and added exclu…THEHACKERNEWS.COM
21 MarInternational Freight Tech Firm Isolates Canada Operations After CyberattackIn documents filed with U.S. regulators, the company explained that on March 14 it detected “the initial stages of a cybersecurity incident related to its Canadian operations.”THERECORD.MEDIA
21 MarBreach Roundup: Flipper Pushes Back on Proposed Canada BanAlso: UnitedHealth Group, Nemesis Market, Phishing Tricks and AceCryptor This week, Flipper Devices petitioned Canada, UnitedHealth Group dealt with its attack, Nemesis Market was seized, phishers fooled ML, AceCryptor returned to Europe, Brazil and Ukraine made arrests, another …DATABREACHTODAY.CO.UK
21 MarRevenue Cycle Firm Settles GitHub PHI Breach Lawsuit for $7MClass Action Settlement Also Calls for MedData to Enhance Its Security Program Revenue cycle management firm MedData has agreed to a $7 million settlement in a class action lawsuit filed after an employee inadvertently uploaded and exposed the health and personal information of a…DATABREACHTODAY.CO.UK
21 MarCryptohack Roundup: Ray Eviscerates Bankman-FriedAlso: CryptoFX Ponzi Scheme, North Korean Hackers Gonna Hack This week, FTX emergency CEO John Ray filleted previous CEO Sam Bankman-Fried, the SEC charged 17 members in a $300 million Ponzi scheme, Hong Kong warned against Bybit, reports said North Korea made half of its revenue…DATABREACHTODAY.CO.UK
21 MarHow Microsoft Incident Response and Microsoft Defender for Identity work together to detect and respond to cyberthreatsLearn how Microsoft Incident Response works together with Microsoft Defender for Identity to give customers fast, flexible service—before, during, or after a cybersecurity incident occurs. The post How Microsoft Incident Response and Microsoft Defender for Identity work together …MICROSOFT.COM
🕵️ THREAT INTELLIGENCE 23[−]
21 MarISC Stormcast For Thursday, March 21st, 2024 https://isc.sans.edu/podcastdetail/8904, (Thu, Mar 21st)(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.ISC.SANS.EDU
21 MarGitHub’s New AI Tool that Fixes Your Code AutomaticallyGitHub has leaped application security by introducing a new feature that promises to revolutionize how developers address code vulnerabilities. The new tool, code scanning autofix, is now available in public beta for all GitHub Advanced Security customers, harnessing the power of…GBHACKERS.COM
21 Mar$200,000 Awarded at Pwn2Own 2024 for Tesla HackParticipants earned a total of $732,500 on the first day of Pwn2Own Vancouver 2024 for hacking a Tesla, operating systems, and other software. The post $200,000 Awarded at Pwn2Own 2024 for Tesla Hack appeared first on SecurityWeek .SECURITYWEEK.COM
21 MarPublic AI as an Alternative to Corporate AIThis mini-essay was my contribution to a round table on Power and Governance in the Age of AI . It’s nothing I haven’t said here before, but for anyone who hasn’t read my longer essays on the topic, it’s a shorter introduction. The increasingly cent…SCHNEIER.COM
21 MarGitHub Rolls Out ‘Code Scanning Autofix’ in Public BetaGitHub’s code scanning autofix delivers remediation suggestions for two-thirds of the identified vulnerabilities. The post GitHub Rolls Out ‘Code Scanning Autofix’ in Public Beta appeared first on SecurityWeek .SECURITYWEEK.COM
21 MarThe most prevalent malware behaviors and techniques - Help Net Securitysubmitted by kid to cybersecurity 1 points | 0 comments https://www.helpnetsecurity.com/2024/03/20/malware-behaviors-techniques/HELPNETSECURITY.COM
21 Mar[Heads-Up] Phishing Campaign Delivers VCURMS RATResearchers at Fortinet are tracking a phishing campaign that’s distributing a new version of the VCURMS remote access Trojan (RAT).KNOWBE4.COM
21 MarA Decade of Trust — Meeting the Needs of the DoDOut of 132 core Zero Trust activities for the DoD, Palo Alto Networks addresses a staggering 118 through our products and integrations. The post A Decade of Trust — Meeting the Needs of the DoD appeared first on Palo Alto Networks Blog .PALOALTONETWORKS.COM
21 MarIvanti Patches Critical Vulnerabilities in Standalone Sentry, Neurons for ITSMIvanti has released patches for two critical-severity vulnerabilities leading to arbitrary command execution. The post Ivanti Patches Critical Vulnerabilities in Standalone Sentry, Neurons for ITSM appeared first on SecurityWeek .SECURITYWEEK.COM
21 MarA Recognized Leader in SSEPalo Alto Networks is taking charge in cybersecurity, being acknowledged as a leader in The Forrester Wave™: Security Service Edge Solutions, Q1 2024. The post A Recognized Leader in SSE appeared first on Palo Alto Networks Blog .PALOALTONETWORKS.COM
21 MarHouse Passes Bill Barring Sale of Personal Information to Foreign AdversariesH.R. 7520 prohibits data brokers from selling Americans’ data to foreign adversary countries or entities controlled by them. The post House Passes Bill Barring Sale of Personal Information to Foreign Adversaries appeared first on SecurityWeek .SECURITYWEEK.COM
21 MarTarsal Raises $6 Million for Security Data Movement PlatformTarsal raises $6 million in a seed funding round led by Harpoon Ventures and Mango Capital and appoints new CTO. The post Tarsal Raises $6 Million for Security Data Movement Platform appeared first on SecurityWeek .SECURITYWEEK.COM
21 MarSocial Engineering The #1 Root Cause Behind Most Cyber Crimes In FBI ReportThe following paragraphs were cited directly from my recent article highlighting social engineering . " Social engineering and phishing are involved in 70% to 90% of all successful cybersecurity attacks . No other initial root hacking cause comes close.KNOWBE4.COM
21 MarDymium Snags $7M to Build Data Security Platform with Secure AI ChatTwo Bear Capital leads a venture capital bet on Dymium, a California startup building data protection technologies. The post Dymium Snags $7M to Build Data Security Platform with Secure AI Chat appeared first on SecurityWeek .SECURITYWEEK.COM
21 MarMicrosoft Warns of New Tax Returns Phishing Scams Targeting YouThese attachments, as per Microsoft Threat Intelligence’s blog post, contain malware that steals your login credentials, or they might redirect you to a fake website that looks like a legitimate tax platform designed to capture your information.HACKREAD.COM
21 MarCurious Serpens’ FalseFont Backdoor: Technical Analysis, Detection and PreventionCurious Serpens has been active since at least 2013. This threat actor is associated with espionage and has targeted organizations in the Middle East, the United States, and Europe.UNIT42.PALOALTONETWORKS.COM
21 MarSign1 Malware: Analysis, Campaign History & Indicators of CompromiseThe malware injects JavaScript to perform unwanted redirects by using sophisticated obfuscation techniques, including time-based randomization and XOR encoding, to evade detection.SUCURI.NET
21 MarSynopsys Greenlights Sale of $525M Application Security UnitSoftware Integrity Business Could Fetch More Than $3B, Attract Private Equity Firms Synopsys' board of directors signed off Wednesday on selling the company's $525 million application security testing business to focus exclusively on design automation and IP. The systems design b…DATABREACHTODAY.CO.UK
21 MarProof of Concept: Opening Up the AI 'Black Box'Panelists Make Case for Explainability, Trust in Areas Such as Healthcare, Banking In the latest "Proof of Concept," panelists Sam Curry of Zscaler and Heather West of Venable LLP discuss the crucial role of explainability and transparency in artificial intelligence, especially i…DATABREACHTODAY.CO.UK
21 MarLost Crypto Wallet? New Firm Promises Ethical, Transparent and Inexpensive RecoveryPraefortis is a new company pushing ethical and transparent recovery of lost or forgotten crypto wallet passwords. The post Lost Crypto Wallet? New Firm Promises Ethical, Transparent and Inexpensive Recovery appeared first on SecurityWeek .SECURITYWEEK.COM
21 MarAI Is Making Payment Fraud Better, Faster and EasierAI Is Also Making Traditional Scams More Convincing, Warns Visa Artificial intelligence technologies such as generative AI are not helping fraudsters create new types of scams. They are doing just fine relying on the traditional scams, but the advent of AI is helping them scale u…DATABREACHTODAY.CO.UK
21 MarUN Adopts US-Led International AI Safety ResolutionThe Non-Binding Resolution Calls for 'Safe, Secure, and Trustworthy AI Systems' The United Nations on Thursday unanimously adopted a U.S.-brokered first-ever international resolution promoting the safe use of artificial intelligence. The adoption of the resolution comes at a time…DATABREACHTODAY.CO.UK
21 MarApple Sued for Prioritizing Market Dominance Over SecurityLawsuit Says Apple Stifles Innovation, Degrades Security, Suppresses Protections The U.S. Department of Justice in a lawsuit filed Thursday is accusing Apple of discarding user security and privacy protections as part of a broader effort to maintain dominance in the national smar…DATABREACHTODAY.CO.UK
🌐 CYBER THREAT LANDSCAPE 7[−]
21 MarRussia-Linked Hackers Use Smokeloader Malware to Steal Funds From Ukrainian EnterprisesBetween May and November 2023, researchers identified 23 Smokeloader campaigns aimed at various targets in Ukraine, including financial institutions and government organizations.THERECORD.MEDIA
21 MarHackers Posing as Law Firms Phish Global OrganizationsEarlier this month, cybercriminals from the "Narwhal Spider" (aka TA544, Storm-0302) group masquerading as law firms tricked multiple companies into downloading initial access malware that may precede greater attacks down the line.DARKREADING.COM
21 MarHow to Accelerate Vendor Risk Assessments in the Age of SaaS SprawlIn today's digital-first business environment dominated by SaaS applications, organizations increasingly depend on third-party vendors for essential cloud services and software solutions. As more vendors and services are added to the mix, the complexity and potential vulnerabilit…THEHACKERNEWS.COM
21 MarThe Most Prevalent Malware Behaviors and TechniquesAn analysis of 100,000+ Windows malware samples has revealed the most prevalent techniques used by malware developers to successfully evade defenses, escalate privileges, execute the malware, and assure its persistence.HELPNETSECURITY.COM
21 MarEvasive Sign1 malware campaign infects 39,000 WordPress sitesA previously unknown malware campaign called Sign1 has infected over 39,000 websites over the past six months, causing visitors to see unwanted redirects and popup ads. [...]BLEEPINGCOMPUTER.COM
21 MarIndia's Android Users Hit by Malware-as-a-Service CampaignAccording to Broadcom, the campaign distributes malicious APK packages and seeks out banking information, SMS messages, and other sensitive information from a victim's device.DARKREADING.COM
21 MarWhat commercial spyware is, and what different types there are | Kaspersky official blogWe discuss commercial spyware — particularly the capabilities of the most well-known instances: Pegasus, DevilsTongue, Predator, Subzero, Heliconia, and Reign.KASPERSKY.COM
📡 INFOSEC NEWS 24[−]
21 MarThe Not-so-True People-Search Network from ChinaIt's not unusual for the data brokers behind people-search websites to use pseudonyms in their day-to-day lives (you would, too). Some of these personal data purveyors even try to reinvent their online identities in a bid to hide their conflicts of interest. But it's not every da…KREBSONSECURITY.COM
21 MarTracker Backtrack? Feds Revise HIPAA Guidance on Web ToolsThe updated guidance replaces prior guidance that HHS OCR issued in December 2022 which warned that the use of online trackers that collect and transmit certain individually identifiable health information, constituted potential HIPAA violations.BANKINFOSECURITY.COM
21 MarU.S. Sanctions Russians Behind 'Doppelganger' Cyber Influence CampaignThe U.S. Treasury Department's Office of Foreign Assets Control (OFAC) on Wednesday announced sanctions against two 46-year-old Russian nationals and the respective companies they own for engaging in cyber influence operations. Ilya Andreevich Gambashidze (Gambashidze), the found…THEHACKERNEWS.COM
21 MarMaking Sense of Operational Technology Attacks: The Past, Present, and FutureWhen you read reports about cyber-attacks affecting operational technology (OT), it’s easy to get caught up in the hype and assume every single one is sophisticated. But are OT environments all over the world really besieged by a constant barrage of complex cyber-attacks? Answeri…THEHACKERNEWS.COM
21 MarRegulatory Measures Boost Cybersecurity IndustryIn the UAE and Saudi Arabia, specifically, technology adoption has increased across the finance, healthcare, and manufacturing sectors, further boosting the need for cybersecurity and robust regulatory frameworks.HELPNETSECURITY.COM
21 MarSerial Data Thief Pleads Guilty to Cybercrime ChargesRobert Purbeck, adopting the aliases "Lifelock" and "Studmaster" during his time as a cybercriminal, according to the Department of Justice (DoJ), stole personal data belonging to more than 132,000 people.THEREGISTER.COM
21 MarGitHub Launches AI-Powered Autofix Tool to Assist Devs in Patching Security FlawsGitHub on Wednesday announced that it's making available a feature called code scanning autofix in public beta for all Advanced Security customers to provide targeted recommendations in an effort to avoid introducing new security issues. "Powered by GitHub Copilot&…THEHACKERNEWS.COM
21 MarThe best free Syslog serversThe Syslog message format is used by many applications and is associated with the Linux operating system. Discover the best free Syslog servers. [...]BLEEPINGCOMPUTER.COM
21 MarThe best network monitoring toolsDiscover the best network monitoring tools. Find a system that provides both network device monitoring and traffic analysis. [...]BLEEPINGCOMPUTER.COM
21 MarThe best RMM softwareThere are many RMM platforms available but not all of them are very good. Here, we look at the best RMM software in the business. [...]BLEEPINGCOMPUTER.COM
21 MarReport: Growing AceCryptor Attacks in EuropeIn recent months, researchers registered a significant change in how AceCryptor is used, namely that the attackers spreading Rescoms (also known as Remcos) started utilizing AceCryptor, which was not the case beforehand.HELPNETSECURITY.COM
21 MarAustralian Techie Jailed for Stealing From MuseumAs explained yesterday by the Australian Federal Police (AFP), the man "used his role as a contract IT support worker to access the Museum's accounts payable system and illegally change bank account details to his own."THEREGISTER.COM
21 MarDOT to investigate data security and privacy practices of top US airlinesThe U.S. Department of Transportation announced its first industry-wide review of data security and privacy policies across the largest U.S. airlines. The DOT said in a press release Thursday that the review will examine whether U.S. airline giants are properly protecting their c…TECHCRUNCH.COM
21 MarProtecting Model Updates in Privacy-Preserving Federated LearningIn our second post we described attacks on models and the concepts of input privacy and output privacy . ln our last post , we described horizontal and vertical partitioning of data in privacy-preserving federated learning (PPFL) systems. In this post, we explore the problem of p…NIST.GOV
21 MarNew ‘Loop DoS’ Attack May Impact up to 300,000 Online SystemsDevised by researchers at the CISPA Helmholtz-Center for Information Security, the attack uses the User Datagram Protocol (UDP) and impacts an estimated 300,000 host and their networks.BLEEPINGCOMPUTER.COM
21 MarExposed: Chinese Smartphone Farms That Run Thousands Of Barebone Mobes To Do CrimePACKETSTORMSECURITY.COM
21 MarSports Day Scores a HitSophos team members from the UK gathered at the Abingdon office for a sports day themed get-together.SOPHOS.COM
21 MarFake Obituary Sites Send Grievers to Adult Sites and Scareware PagesSecurity researchers have warned of a slew of fake obituaries designed to make money for their creators by redirecting visitors to adult entertainment sites and initiating antivirus (AV) popups.INFOSECURITY-MAGAZINE.COM
21 MarWhois "geofeed" Data, (Thu, Mar 21st)Attributing a particular IP address to a specific location is hard and often fails miserably. There are several difficulties that I have talked about before: Out-of-date whois data, data that is outright fake, or was never correct in the first place. Companies that have been allo…ISC.SANS.EDU
21 MarUnsaflok flaw can let hackers unlock millions of hotel doorsSecurity vulnerabilities in over 3 million Saflok electronic RFID locks deployed in 13,000 hotels and homes worldwide allowed researchers to easily unlock any door in a hotel by forging a pair of keycards. [...]BLEEPINGCOMPUTER.COM
21 MarKDE advises extreme caution after theme wipes Linux user's filesOn Wednesday, the KDE team warned Linux users to exercise "extreme caution" when installing global themes, even from the official KDE Store, because these themes run arbitrary code on devices to customize the desktop's appearance. [...]BLEEPINGCOMPUTER.COM
21 MarWindows 11 Notepad finally gets spellcheck and autocorrectMicrosoft continues to add new features to the Windows Notepad, today announcing a preview release with built-in spellchecking and an autocorrect feature. [...]BLEEPINGCOMPUTER.COM