10 things to avoid posting on social media – and why

Do you often take to social media to broadcast details from your life? Here’s why this habit may put your privacy and security at risk.

Iran-Linked UNC1549 Hackers Target Middle East Aerospace & Defense Sectors

An Iran-nexus threat actor known as UNC1549 has been attributed with medium confidence to a new set of attacks targeting aerospace, aviation, and defense industries in the Middle East, including Israel and the U.A.E. Other targets of the cyber espionage activity likely include Turkey, India, and Albania, Google-owned Mandiant said in a new analysis. UNC1549 is said to overlap with&nbsp

FBI Warns U.S. Healthcare Sector of Targeted BlackCat Ransomware Attacks

The U.S. government is warning about the resurgence of BlackCat (aka ALPHV) ransomware attacks targeting the healthcare sector as recently as this month. "Since mid-December 2023, of the nearly 70 leaked victims, the healthcare sector has been the most commonly victimized," the government said in an updated advisory. "This is likely in response to the ALPHV/BlackCat administrator's

Enterprise security: Making hot desking secure and accessible on a global scale

Making hot desking secure and accessible on a global scale

The first rule of interviewing a CISO at the Australian division of Laing O’Rourke is this: You can’t dig deep into use cases or cli… Read more on Cisco Blogs

Building Your Privacy-Compliant Customer Data Platform (CDP) with First-Party Data

In today's digital era, data privacy isn't just a concern; it's a consumer demand. Businesses are grappling with the dual challenge of leveraging customer data for personalized experiences while navigating a maze of privacy regulations. The answer? A privacy-compliant Customer Data Platform (CDP). Join us for a transformative webinar where we unveil Twilio Segment's state-of-the-art CDP.

Superusers Need Super Protection: How to Bridge Privileged Access Management and Identity Management

Traditional perimeter-based security has become costly and ineffective. As a result, communications security between people, systems, and networks is more important than blocking access with firewalls. On top of that, most cybersecurity risks are caused by just a few superusers – typically one out of 200 users. There’s a company aiming to fix the gap between traditional PAM and IdM

TimbreStealer Malware Spreading via Tax-themed Phishing Scam Targets IT Users

Mexican users have been targeted with tax-themed phishing lures at least since November 2023 to distribute a previously undocumented Windows malware called TimbreStealer. Cisco Talos, which discovered the activity, described the authors as skilled and that the "threat actor has previously used similar tactics, techniques and procedures (TTPs) to distribute a banking trojan known

Cybersecurity Agencies Warn Ubiquiti EdgeRouter Users of APT28's MooBot Threat

In a new joint advisory, cybersecurity and intelligence agencies from the U.S. and other countries are urging users of Ubiquiti EdgeRouter to take protective measures, weeks after a botnet comprising infected routers was felled by law enforcement as part of an operation codenamed Dying Ember. The botnet, named MooBot, is said to have been used by a Russia-linked threat actor known as

Hacking Terraform state to gain code execution and privilege escalation

submitted by /u/dagrz-cloudsec
[link] [comments]

That home router botnet the Feds took down? Moscow's probably going to try again

Non-techies told to master firmware upgrades and firewall rules. For the infosec hardheads: have some IOCs

Authorities from eleven nations have delivered a sequel to the January takedown of a botnet run by Russia on compromised Ubiquiti Edge OS routers – in the form of a warning that Russia may try again, so owners of the devices should take precautions.…

APT29 adopts new TTPs, according to a bunch of agencies

submitted by /u/Betterworldguys
[link] [comments]

Change Healthcare Ransomware Attack: BlackCat Hackers Quickly Returned After FBI Bust

Two months ago, the FBI “disrupted” the BlackCat ransomware group. They're already back—and their latest attack is causing delays at pharmacies across the US.

LOTP - Living Off the Pipeline

submitted by /u/fproulx
[link] [comments]

Sandvine put on America's export no-fly list after Egypt used network tech for spying

Canadian network box maker floats in denial

The US Commerce Department has blacklisted Sandvine for selling its networking monitoring technology to Egypt, where the Feds say the gear was used to spy on political and human-rights activists.…

NIST updates Cybersecurity Framework after a decade of lessons

The original was definitely getting a bit long in the tooth for modern challenges

After ten years operating under the original model, and two years working to revise it, the National Institute of Standards and Technology (NIST) has released version 2.0 of its Cybersecurity Framework (CSF).…

Data Scientists Targeted by Malicious Hugging Face ML Models with Silent Backdoor

submitted by /u/SRMish3
[link] [comments]

New Server Side Prototype Pollution Gadgets Scanner from Doyensec

submitted by /u/ds_at
[link] [comments]

The UK Is GPS-Tagging Thousands of Migrants

Ankle tags that constantly log a person’s coordinates are part of a growing cadre of experimental surveillance tools that countries around the world are trying out on new arrivals.

NIST Cybersecurity Framework 2.0 Officially Released

Bitcoin Scorches Past $57,000 As Big Buyers Flock In

SubdoMailing Manipulates Subdomains To Send Spam

China Warns Of Fake Digital Currency Wallets Fleecing Netizens

LoanDepot Confirms SSNs Leaked In Breach Claimed By ALPHV/BlackCat

How the Pentagon Learned to Use Targeted Ads to Find Its Targets—and Vladimir Putin

Meet the guy who taught US intelligence agencies how to make the most of the ad tech ecosystem, "the largest information-gathering enterprise ever conceived by man."

Cybercrims: When we hit IT, they sometimes pay, but when we hit OT... jackpot

Or so says opsec firm, which confirms 70% of all industrial org ransomware in 2023 targeted manufacturers

Analysis Cybercriminals follow the money, and increasingly last year that led them to ransomware attacks against the manufacturing industry.…

Broadcom builds a SASE out of VMware VeloCloud and Symantec

First integration across properties, as end user compute division readies to leave home

Broadcom has delivered on its 2023 teaser of integration between VMware's SD-WAN and Symantec's Security Service Edge, by today debuting the "VMware VeloCloud SASE, Secured by Symantec" at Mobile World Congress in Barcelona.…

WordPress LiteSpeed Plugin Vulnerability Puts 5 Million Sites at Risk

A security vulnerability has been disclosed in the LiteSpeed Cache plugin for WordPress that could enable unauthenticated users to escalate their privileges. Tracked as CVE-2023-40000, the vulnerability was addressed in October 2023 in version 5.7.0.1. "This plugin suffers from unauthenticated site-wide stored [cross-site scripting] vulnerability and could allow any unauthenticated user

Open-Source Xeno RAT Trojan Emerges as a Potent Threat on GitHub

An "intricately designed" remote access trojan (RAT) called Xeno RAT has been made available on GitHub, making it easily accessible to other actors at no extra cost. Written in C# and compatible with Windows 10 and Windows 11 operating systems, the open-source RAT comes with a "comprehensive set of features for remote system management," according to its developer, who goes by the name

Benefits of Ingesting Data from Amazon Inspector into Cisco Vulnerability Management

Co-authored by Tejas Sheth, Sr. Security Specialist, Amazon Web Services – AISPL.

Risk-based Vulnerability Management (RBVM) represents a strategic approach to cyber security that focuses on… Read more on Cisco Blogs

From Alert to Action: How to Speed Up Your SOC Investigations

Processing alerts quickly and efficiently is the cornerstone of a Security Operations Center (SOC) professional's role. Threat intelligence platforms can significantly enhance their ability to do so. Let's find out what these platforms are and how they can empower analysts. The Challenge: Alert Overload The modern SOC faces a relentless barrage of security alerts generated by SIEMs and EDRs.

Five Eyes Agencies Expose APT29's Evolving Cloud Attack Tactics

Cybersecurity and intelligence agencies from the Five Eyes nations have released a joint advisory detailing the evolving tactics of the Russian state-sponsored threat actor known as APT29. The hacking outfit, also known as BlueBravo, Cloaked Ursa, Cozy Bear, Midnight Blizzard (formerly Nobelium), and The Dukes, is assessed to be affiliated with the Foreign Intelligence Service (SVR) of the

New Hugging Face Vulnerability Exposes AI Models to Supply Chain Attacks

Cybersecurity researchers have found that it's possible to compromise the Hugging Face Safetensors conversion service to ultimately hijack the models submitted by users and result in supply chain attacks. "It's possible to send malicious pull requests with attacker-controlled data from the Hugging Face service to any repository on the platform, as well as hijack any models that are submitted

China warns of fake digital currency wallets fleecing netizens

Scammers' tactics are tiresomely familiar: get-rich-quick schemes and data harvesting

China's Ministry of Industry and Information Technology has warned local netizens that fake wallet apps for the nation's central bank digital currency (CBDC) are already circulating and being abused by scammers.…

CVE-2023-52161: inet-wireless daemon (iwd) APs allowed clients to connect with a NULL key, bypassing the WiFi password

submitted by /u/supernetworks
[link] [comments]

Nevada sues to deny kids access to Meta's Messenger encryption

State government says it's thinking of the children

A law firm acting on behalf of the Nevada Attorney General Aaron Ford has asked a state court to issue a temporary restraining order (TRO) denying minors access to encrypted communication in Meta's Messenger application.…

Windows Sysinternals - Sysmon - A practical guide to implementation and essential tips

submitted by /u/clod81
[link] [comments]

ALPHV/BlackCat responsible for Change Healthcare cyberattack

US government's bounty hasn't borne fruit as whack-a-mole game goes on

Updated The ALPHV/BlackCat ransomware gang is reportedly responsible for the massive Change Healthcare cyberattack that has disrupted pharmacies across the US since last week.…

WordPress Plugin Alert - Critical SQLi Vulnerability Threatens 200K+ Websites

A critical security flaw has been disclosed in a popular WordPress plugin called Ultimate Member that has more than 200,000 active installations. The vulnerability, tracked as CVE-2024-1071, carries a CVSS score of 9.8 out of a maximum of 10. Security researcher Christiaan Swiers has been credited with discovering and reporting the flaw. In an advisory published last week, WordPress

Back from the dead: LockBit taunts cops, threatens to leak Trump docs

Officials have until March 2 to cough up or stolen data gets leaked

Updated LockBit claims it's back in action just days after an international law enforcement effort seized the ransomware gang's servers and websites, and retrieved more than 1,000 decryption keys to assist victims.…

It's now possible to find the AWS Account ID for any S3 Bucket (private or public)

submitted by /u/tracebit
[link] [comments]

Advanced CyberChef Techniques for Configuration Extraction - Detailed Walkthrough and Examples

submitted by /u/Embeere
[link] [comments]

QR Code Phishing with EvilGophish

submitted by /u/fin3ss3g0d
[link] [comments]

New IDAT Loader Attacks Using Steganography to Deploy Remcos RAT

Ukrainian entities based in Finland have been targeted as part of a malicious campaign distributing a commercial remote access trojan known as Remcos RAT using a malware loader called IDAT Loader. The attack has been attributed to a threat actor tracked by the Computer Emergency Response Team of Ukraine (CERT-UA) under the moniker UAC-0184. "The attack, as part of the IDAT Loader, used

“SubdoMailing” — Thousands of Hijacked Major-Brand Subdomains Found Bombarding Users With Millions of Malicious Emails

submitted by /u/pinpepnet
[link] [comments]

Everything you need to know about NIS2

Get prepared for the EU’s upgraded cybersecurity directive

Webinar The original European Union Network and Information Security (NIS) Directive certainly led to an improvement in member states' cybersecurity defences, but it struggled to do everything required as cyberattacks and threats scaled up with the growth in digitalization.…

8,000+ Domains of Trusted Brands Hijacked for Massive Spam Operation

More than 8,000 domains and 13,000 subdomains belonging to legitimate brands and institutions have been hijacked as part of a sophisticated distribution architecture for spam proliferation and click monetization. Guardio Labs is tracking the coordinated malicious activity, which has been ongoing since at least September 2022, under the name SubdoMailing. The emails range from "counterfeit

Hackers For Sale: What We Learned From China's Massive Cyber Leak

US Leading Global Alliance To Counter Foreign Government Disinformation

Fox News Hacker Was Just Journalist Doing His Job, Claim Lawyers

Lockbit Cybercrime Gang Says It Is Back Online Following Bust

230k Individuals Impacted By Data Breach At Australian Telco Tangerine

How a Right-Wing Controversy Could Sabotage US Election Security

Republicans who run elections are split over whether to keep working with the Cybersecurity and Infrastructure Security Agency to fight hackers, online falsehoods, and polling-place threats.

Security Incident & Vulnerability Response Playbooks

submitted by /u/zootea100
[link] [comments]

Data watchdog tells off outsourcing giant for scanning staff biometrics despite 'power imbalance'

2,000 employees at 38 facilities had data processed 'unlawfully', ICO says

A data protection watchdog in the UK has issued an enforcement notice to stop Serco from using facial recognition tech and fingerprint scanning to monitor staff at 38 leisure centers it runs.…

North Korean Hackers Targeting Developers with Malicious npm Packages

A set of fake npm packages discovered on the Node.js repository has been found to share ties with North Korean state-sponsored actors, new findings from Phylum show. The packages are named execution-time-async, data-time-utils, login-time-utils, mongodb-connection-utils, and mongodb-execution-utils. One of the packages in question, execution-time-async, masquerades as its legitimate

Fox News 'hacker' turns out to be journalist whose lawyers say was doing his job

Also, another fake iOS app slips into the store, un-cybersafe EV chargers leave UK shelves, and critical vulns

Infosec in brief A Florida journalist has been arrested and charged with breaking into protected computer systems in a case his lawyers say was less "hacking," more "good investigative journalism." …

Three Tips to Protect Your Secrets from AI Accidents

Last year, the Open Worldwide Application Security Project (OWASP) published multiple versions of the "OWASP Top 10 For Large Language Models," reaching a 1.0 document in August and a 1.1 document in October. These documents not only demonstrate the rapidly evolving nature of Large Language Models, but the evolving ways in which they can be attacked and defended. We're going to talk in this

Banking Trojans Target Latin America and Europe Through Google Cloud Run

Cybersecurity researchers are warning about a spike in email phishing campaigns that are weaponizing the Google Cloud Run service to deliver various banking trojans such as Astaroth (aka Guildma), Mekotio, and Ousaban (aka Javali) to targets across Latin America (LATAM) and Europe. "The infection chains associated with these malware families feature the use of malicious

Exploiting inconsistent UTF-8 handling in mbstring to bypass an XSS filter in Joomla

submitted by /u/albinowax
[link] [comments]

Join us in Seoul this May. Last chance to submit you talk for TyphoonCon 2024!

submitted by /u/LongjumpingLime4139
[link] [comments]