⚠️ VULNERABILITY DISCLOSURE 22[−]
19 JunIs it time to split the CISO role?Cybersecurity has gained a lot of space and attention in recent years and with that attention came legislations, regulations and a lot more scrutiny. One of the results of this is that CISOs have now more responsibilities that go beyond the technical aspects of defending enterpri…CSOONLINE.COM
19 JunMailcow Mail Server Flaws Expose Servers to Remote Code ExecutionTwo security vulnerabilities have been disclosed in the Mailcow open-source mail server suite that could be exploited by malicious actors to achieve arbitrary code execution on susceptible instances. Both shortcomings impact all versions of the software prior to version 2024-04, …THEHACKERNEWS.COM
19 JunBeware of Nevermore Actor Promoting Ransomware BuilderA prominent figure from the dark web, known by the alias “Nevermore,” has been found promoting a sophisticated ransomware builder. This alarming development has raised concerns among cybersecurity experts and law enforcement agencies worldwide. The Rise of Nevermore N…GBHACKERS.COM
19 JunThreat Actors Claiming Breach of AMD Source Code on Hacking ForumsA threat actor named ” IntelBroker ” claims to have breached AMD in June 2024 and is now selling the allegedly stolen data on hacking forums. The compromised information reportedly includes sensitive data such as future AMD product plans, specification sheets, employe…GBHACKERS.COM
19 JunCISA Warns of PoC Exploit for Vulnerability in RAD SecFlow-2 Industrial SwitchCISA has notified RAD after finding a PoC exploit targeting a high-severity vulnerability in an outdated industrial switch. The post CISA Warns of PoC Exploit for Vulnerability in RAD SecFlow-2 Industrial Switch appeared first on SecurityWeek .SECURITYWEEK.COM
19 JunChrome 126 Update Patches Vulnerability Exploited at Hacking CompetitionGoogle has released a Chrome 126 security update with six fixes, including four for externally reported high-severity flaws. The post Chrome 126 Update Patches Vulnerability Exploited at Hacking Competition appeared first on SecurityWeek .SECURITYWEEK.COM
19 JunStuxnet, The Malware That Propagates To Air-Gapped NetworksStuxnet, a complex worm discovered in 2010, targeted Supervisory Control and Data Acquisition (SCADA) systems used in industrial facilities. By exploiting multiple vulnerabilities, including zero-days, it breached air-gapped networks (isolated systems) and disrupted Iranian nucle…GBHACKERS.COM
19 JunHackers are selling stolen AMD data on the dark web in exchange for cryptoChipmaker AMD is investigating a data breach after the notorious BreachForum hacker IntelBroker claimed possession of stolen internal data from the leading gaming and computing chipmaker. The development comes days after the revival of BreachForums, seized briefly in May by law e…CSOONLINE.COM
19 JunHackers Using VPNs To Exploit Restrictions & Steal Mobile DataHackers are offering “free” mobile data access on Telegram channels by exploiting loopholes in telecom provider policies, which target users in Africa and Asia and involve sharing configuration files to mimic zero-rated traffic. The channels function as technica…GBHACKERS.COM
19 Jun"Researchers" exploit Kraken exchange bug, steal $3 million in cryptoThe Kraken crypto exchange disclosed today that alleged security researchers exploited a zero-day website bug to steal $3 million in cryptocurrency and then refused to return the funds. [...]BLEEPINGCOMPUTER.COM
19 JunAmtrak Data Breach: Hackers Accessed User’s Email AddressAmtrak notified its customers regarding a significant security breach involving its Amtrak Guest Rewards accounts. The breach between May 15, 2024, and May 18, 2024, allowed unauthorized parties to access users’ accounts. The company believes the hackers obtained login cred…GBHACKERS.COM
19 JunChinese Cyber Espionage Group Exploits Fortinet, Ivanti and VMware Zero-DaysThe China-nexus cyber espionage actor linked to the zero-day exploitation of security flaws in Fortinet, Ivanti, and VMware devices has been observed utilizing multiple persistence mechanisms in order to maintain unfettered access to compromised environments. "Persistence mechani…THEHACKERNEWS.COM
19 JunKraken Crypto Exchange Hit by $3 Million Theft Exploiting Zero-Day FlawCrypto exchange Kraken revealed that an unnamed security researcher exploited an "extremely critical" zero-day flaw in its platform to steal $3 million in digital assets and refused to return them. Details of the incident were shared by Kraken's Chief Security Officer, Nick Perco…THEHACKERNEWS.COM
19 JunChat apps’ end-to-end encryption threatened by EU legislationA European Union legislative body is closing in on a final proposal for chat surveillance controls, despite growing opposition from industry groups and privacy advocates. Last November the Civil Liberties Committee of the European Parliament voted to exclude bans on end-to-end en…CSOONLINE.COM
19 JunPegasus can target government and military officialsThe controversial spyware Pegasus and its operator, the Israeli NSO Group, is once again in the news. Last week, in documents filed in a judgment between NSO and WhatsApp, they admitted that any of their clients can target anyone with their spyware, including government or milita…CSOONLINE.COM
19 JunPopular Chatbots Spout Russian Misinformation, Finds StudyOpenAI, Meta and 8 Other Chatbots Use Disinformation Network as Source Popular artificial intelligence chatbots are rife with Russian disinformation, warns NewsGuard, the rating system for news and information websites. The chatbots failed to recognize that sites such as "The Bos…DATABREACHTODAY.CO.UK
19 JunPentagon Cybersecurity, Workforce Woes Threaten Tech RolloutNew Report Says DOD Is Lagging in Procuring New Tech Amid Cybersecurity Failures The U.S. Department of Defense is struggling to rapidly test and deploy emerging technologies due to a series of cybersecurity and workforce challenges that hinder the Pentagon's process of acquiring…DATABREACHTODAY.CO.UK
19 JunNew Blog Moderation PolicyThere has been a lot of toxicity in the comments section of this blog. Recently, we’re having to delete more and more comments. Not just spam and off-topic comments, but also sniping and personal attacks. It’s gotten so bad that I need to do something. My options are …SCHNEIER.COM
19 JunSmashing Security podcast #377: An unhealthy data dump, railway surveillance, and a cheater sues AppleThere's a wee data breach with unhealthy implications in Scotland, privacy has gone off the rails in the UK, and a cheater blames Apple for his expensive divorce. All this and much more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veteran…GRAHAMCLULEY.COM
19 JunChinese Hackers Used Open-Source Rootkits for EspionageUNC3886 Targeted Edge Devices for Persistence, Mandiant Says A suspected Chinese hacking group used open-source rootkits to ensure persistence on compromised edge devices such as VMware ESXi servers for espionage campaigns, Google Mandiant said. The hacking group, which Mandiant …DATABREACHTODAY.CO.UK
19 JunT-Mobile denies it was hacked, links leaked data to vendor breachT-Mobile has denied it was breached or that source code was stolen after a threat actor claimed to be selling stolen data from the telecommunications company. [...]BLEEPINGCOMPUTER.COM
📋 SECURITY BULLETINS 2[−]
19 JunCyber Security Today, June 19, 2024 - How an attacker hid on an IT network for three yearsThis episode reports on how outdated software played a role in a lengthy hack, the latest VMware security update, and moreCYBERSECURITYTODAY.LIBSYN.COM
19 JunChrome Security Update – Patch for 6 VulnerabilitiesGoogle has announced a new update for the Chrome browser, rolling out version 126.0.6478.114/115 for Windows and Mac and 126.0.6478.114 for Linux. This update, which will be distributed over the coming days and weeks, addresses several security vulnerabilities. Users are encourag…GBHACKERS.COM
📢 SECURITY ADVISORIES 5[−]
19 JunRussian State Hackers Target French Government for EspionageMidnight Blizzard Compromised Government Staff Emails for the Attack, French ANSSI Said A Russian foreign intelligence hacking group attempted to target the French Foreign Ministry using compromised emails of government staffers, the French cyber agency said. It said the group po…DATABREACHTODAY.CO.UK
🔥 INCIDENT REPORTING 11[−]
19 JunAMD Investigating Breach Claims After Hacker Offers to Sell DataAMD has launched an investigation after a notorious hacker announced selling sensitive data allegedly belonging to the company. The post AMD Investigating Breach Claims After Hacker Offers to Sell Data appeared first on SecurityWeek .SECURITYWEEK.COM
19 JunVoid Arachne Uses Deepfakes and AI to Deliver Malicious VPNs to Chinese UsersChinese-speaking users are the target of a never-before-seen threat activity cluster codenamed Void Arachne that employs malicious Windows Installer (MSI) files for virtual private networks (VPNs) to deliver a command-and-control (C&C) framework called Winos 4.0. "The campaig…THEHACKERNEWS.COM
19 JunUK Pathology Lab Ransomware Attackers Demanded $50 MillionRussian-Speaking Gang Follows Typical Playbook; Critical Services Still Disrupted The ransomware attack that disrupted U.K. pathology services provider Synnovis, continuing to cause thousands of canceled and delayed operations and appointments across London, reportedly featured a…DATABREACHTODAY.CO.UK
19 JunHackers Weaponize Windows Installer (MSI) Files to Deliver MalwareCybersecurity researchers have uncovered a sophisticated malware campaign orchestrated by a threat actor group, Void Arachne. This group has targeted Chinese-speaking users by distributing malicious Windows Installer (MSI) files. The campaign leverages popular software and AI tec…GBHACKERS.COM
19 JunAmtrak Says Guest Rewards Accounts Hacked in Credential Stuffing AttacksNational passenger railroad company Amtrak is notifying customers that hackers have breached their Guest Rewards Accounts. The post Amtrak Says Guest Rewards Accounts Hacked in Credential Stuffing Attacks appeared first on SecurityWeek .SECURITYWEEK.COM
19 JunCDK Global cyberattack shuts down most auto dealership systems nationwidesubmitted by return2ozma to cybersecurity 2 points | 0 comments https://www.autonews.com/retail/cdk-cyberattack-shuts-down-most-systems-nationwideAUTONEWS.COM
19 JunCDK Global cyberattack impacts thousands of US car dealershipsCar dealership software-as-a-service provider CDK Global was hit by a massive cyberattack, causing the company to shut down its systems and leaving clients unable to operate their business normally. [...]BLEEPINGCOMPUTER.COM
19 JunAdvance Auto Parts confirms data breach exposed employee informationAdvance Auto Parts has confirmed it suffered a data breach after a threat actor attempted to sell stolen data on a hacking forum earlier this month. [...]BLEEPINGCOMPUTER.COM
19 JunCrown Equipment confirms a cyberattack disrupted manufacturingForklift manufacturer Crown Equipment confirmed today that it suffered a cyberattack earlier this month that disrupted manufacturing at its plants. [...]BLEEPINGCOMPUTER.COM
19 JunRadiology Practice Hack Affects Sensitive Data of 512,000Breach Is Latest Major Cyber Incident Reported by a Medical Imaging Provider A Minnesota-based radiology practice is notifying more than 500,000 individuals that their information was accessed and potentially acquired by hackers. The incident is one of several major health data b…DATABREACHTODAY.CO.UK
🕵️ THREAT INTELLIGENCE 20[−]
19 JunBehind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C FrameworkWe recently discovered a new threat actor group that we dubbed Void Arachne. This group targets Chinese-speaking users with malicious Windows Installer (MSI) files in a recent campaign. These MSI files contain legitimate software installer files for AI software and other popular …TRENDMICRO.COM
19 JunBeware Of Fake Microsoft Teams Website That Installs Oyster MalwareFake websites of authoritative and popular companies claiming to be genuine sites make users believe that the site belongs to that specific company and is safe to use. Besides this, hackers can more easily lure victims into entering sensitive information or downloading malware by…GBHACKERS.COM
19 JunHandling BOM MIME Files, (Wed, Jun 19th)A reader contacted me with an eml file (which turned out to be benign) that emldump.py could not parse correctly.
ISC.SANS.EDU
19 JunWarning: Markopolo's Scam Targeting Crypto Users via Fake Meeting SoftwareA threat actor who goes by alias markopolo has been identified as behind a large-scale cross-platform scam that targets digital currency users on social media with information stealer malware and carries out cryptocurrency theft. The attack chains involve the use of a purported v…THEHACKERNEWS.COM
19 JunThe Perilous Role of the CISO: Navigating Modern MinefieldsAs organizations grapple with the implications of cybersecurity on their bottom line and reputation, the question of whether the CISO role is worth the inherent risks looms large. The post The Perilous Role of the CISO: Navigating Modern Minefields appeared first on SecurityWeek …SECURITYWEEK.COM
19 Junt2/2024 - Systems Alchemy: The Transmutation of Hacking (Thaddeus grugq)submitted by ashar to security_cpe 1 points | 0 comments https://t2.fi/wp-content/uploads/2020/07/cropped-t2_logo-content.png Systems Alchemy: The Transmutation of Hacking by Thaddeus grugqT2.FI
19 JunHackSpaceCon 2024 - 8 hour livestreamsubmitted by ashar to security_cpe 1 points | 0 comments https://static.wixstatic.com/media/95a21e_122496bc172a441984bdde2c21fc01cb~mv2.png/v1/fill/w_200,h_88,al_c,q_85,usm_0.66_1.00_0.01,enc_auto/95a21e_122496bc172a441984bdde2c21fc01cb~mv2.png HackSpaceCon 2024 Schedule HackSpac…STATIC.WIXSTATIC.COM
19 JunHappy 1st Birthday to Our KnowBe4 Community!Happy 1st birthday to our KnowBe4 Community! We’re so excited to celebrate our community's first anniversary. It’s been filled with so many wholesome moments and learning opportunities.KNOWBE4.COM
19 JunNew PhaaS Platform Lets Attackers Bypass Two-Factor AuthenticationSeveral phishing campaign kits have been used widely by threat actors in the past. One popular PhaaS (Phishing-as-a-Platform) was Caffeine, which was first identified and reported by Mandiant researchers. MRxC0DER, an Arabic-speaking threat actor, developed and maintained the caf…GBHACKERS.COM
19 JunInfo Stealing Campaign Uses DLL Sideloading Through Legitimate Cisco Webex’s Binaries for Initial Execution and Defense Evasionsubmitted by kid to cybersecurity 1 points | 0 comments https://www.trellix.com/blogs/research/how-attackers-repackaged-a-threat-into-something-that-looked-benign/TRELLIX.COM
19 JunSonicWall environment left open, exposing some data – customers safesubmitted by kid to cybersecurity 1 points | 0 comments https://cybernews.com/security/sonicwall-environment-left-open/CYBERNEWS.COM
19 JunUS, Allies Publish Guidance on Securing Network AccessGovernment agencies in the US, New Zealand, and Canada have published new guidance on improving network security. The post US, Allies Publish Guidance on Securing Network Access appeared first on SecurityWeek .SECURITYWEEK.COM
19 JunNEWS ANALYSIS Q&A: Striving for contextual understanding as digital transformation plays outThe tectonic shift of network security is gaining momentum, yet this transformation continues to lag far behind the accelerating pace of change in the operating environment. Related: The advance of LLMs For at least the past decade, the cybersecurity industry … (more…) The …LASTWATCHDOG.COM
19 JunCybersecurity M&A Roundup for First Half of June 2024Roundup of the cybersecurity-related merger and acquisition (M&A) deals announced in the first half of June 2024. The post Cybersecurity M&A Roundup for First Half of June 2024 appeared first on SecurityWeek .SECURITYWEEK.COM
19 JunSimpleX Chat Group about Privacy & Securitysubmitted by boredsquirrel to cybersecurity 1 points | 0 comments https://slrpnk.net/pictrs/image/e7d0a4a4-3bb8-4802-a8b6-291e03070d3a.webp If you want to join the group, please send me a PM with the reason you want to and your favourite animal.SLRPNK.NET
19 Jun3 Tactics to Combat Threat Actors That Work Beyond the 9 to 5 | Live WebinarDATABREACHTODAY.CO.UK
19 JunMassachusetts 911 Outage Caused by Errant FirewallA statewide outage of the Massachusetts 911 system was the result of a firewall that blocked calls from reaching emergency responders. The post Massachusetts 911 Outage Caused by Errant Firewall appeared first on SecurityWeek .SECURITYWEEK.COM
19 JunISC2/CIISec Tips on Recruitment, Retention in CybersecurityAmanda Finch, Dwan Jones on Skills Gap, Diverse Hiring, AI, CISO Criminal Liability The cybersecurity skills gap has reached 4 million globally and only by taking a more innovative approach to identifying, recruiting and retaining candidates from the widest pools of talent can we…DATABREACHTODAY.CO.UK
19 JunMitre ATT&CK - Adam Pennington - BTS #32We discuss the various aspects of Mitre Att&ck, including tools, techniques, supply chain aspects, and more! This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them! Show Notes: https://securityweekly.com/bts-32YOUTUBE.COM
19 JunHacker Heroes - Dave Aitel - PSW VaultExploring the Strategic Minds in Cybersecurity: A Conversation with Dave Aitel Welcome to an enlightening episode of our podcast, where we sit down with Dave Aitel, a prominent figure in the cybersecurity landscape. With a robust background in offensive security and an extensive …YOUTUBE.COM
🌐 CYBER THREAT LANDSCAPE 2[−]
19 JunSophos Email awarded VBSpam+ certificationSophos Email was the only solution to block all the malware and phishing samples in the test.SOPHOS.COM
19 JunThe Hacking of Culture and the Creation of Socio-Technical DebtCulture is increasingly mediated through algorithms. These algorithms have splintered the organization of culture, a result of states and tech companies vying for influence over mass audiences. One byproduct of this splintering is a shift from imperfect but broad cultural narrati…SCHNEIER.COM
📡 INFOSEC NEWS 10[−]
19 JunNew Case Study: Unmanaged GTM Tags Become a Security NightmareAre your tags really safe with Google Tag Manager? If you've been thinking that using GTM means that your tracking tags and pixels are safely managed, then it might be time to think again. In this article we look at how a big-ticket seller that does business on every continent ca…THEHACKERNEWS.COM
19 JunWebinar | 2023 OT Cybersecurity Year in Review: Lessons Learned from the FrontlinesDATABREACHTODAY.CO.UK
19 JunHow phishing using progressive web apps (PWAs) works | Kaspersky official blogWe explain what progressive web apps (PWAs) are and how they can be used in phishing to steal passwords and then hijack accounts.KASPERSKY.COM
19 JunLive Webinar | Executive Insights: Transforming Threats into Opportunities with Cyber ResilienceDATABREACHTODAY.CO.UK
19 JunWebinar | Strengthening Security Defenses using AI-Powered Secrets ManagementDATABREACHTODAY.CO.UK
19 JunEver Tried to Report a Scam on Facebook? Good Luck!It's Time for Big Tech to Be Held Accountable for Rampant Online Fraud From account takeover threats to fake investment schemes, it doesn't take much time on social media to stumble upon a scam. But if you try to report these bad actors to social platforms such as Facebook, you m…DATABREACHTODAY.CO.UK
19 JunMaking the Move From Tech Expert to Cybersecurity Leader10 Practical Steps to Make Yourself Stand Out as 'Leadership Material' To obtain a leadership role, consistently show your commitment to the field, your willingness to help others and your ability to effectively communicate and solve problems. By doing so, you can build a reputat…DATABREACHTODAY.CO.UK
19 JunHacktivism is evolving – and that could be bad news for organizations everywhereHacktivism is nothing new, but the increasingly fuzzy lines between traditional hacktivism and state-backed operations make it a more potent threatWELIVESECURITY.COM