Tag: control
-
ASUS Router Hijackings Highlight Urgent Need for Advanced Threat Detection and Response
Introduction: A Breach Beyond the EndpointA new campaign targeting ASUS routers has compromised more than 9,000 devices worldwide, exposing a hidden weakness in many organizations’ security strategies: insufficient visibility and control at the edge. The attack, dubbed ViciousTrap, exploits CVE-2023-39780″, a command injection vulnerability”, to deploy malware that persists even after reboots and firmware updates.…
-
Posture ≠Protection
CSPM, DSPM, ASPM, SSPM, ESPM, the alphabet soup of Security Posture Management (SPM) tools promises visibility into risk. They map misconfigurations, surface exposure paths and highlight policy gaps. That can be useful. But let’s not confuse awareness with action. They don’t block threats.They don’t enforce controls.They don’t prevent breaches. SPMs detect, then delegate. A ticket.…
-
Interlock and the Kettering Ransomware Attack: ClickFix’s Persistence
Tags: access, attack, breach, captcha, ciso, computer, control, credentials, cyberattack, data, data-breach, detection, endpoint, exploit, group, healthcare, HIPAA, incident response, injection, malicious, mobile, network, phishing, powershell, ransom, ransomware, risk, saas, service, technology, threat, tool, vulnerabilityIn healthcare, every minute of downtime isn’t just a technical problem”Š”, “Šit’s a patient safety risk. CNN recently reported that Kettering Health, a major hospital network in Ohio, was hit by a ransomware attack. According to CNN, the Interlock ransomware group claimed responsibility, sending a chilling reminder that healthcare remains a prime target for this particular…
-
Cisco Wireless LAN Controllers under threat again after critical exploit details go public
A call for urgent patching: Cisco had patched the max severity flaw, CVSS 10 out of 10, in mid-May rollouts for customers with service contracts and through Cisco TAC for customers without service contracts.Researchers recommended promptly upgrading to the latest version of the affected software, as no other workaround is available. “For security teams, the…
-
CFOs Targeted in Sophisticated Phishing Campaign Using Legit NetBird Tool
CFOs are being targeted in a global phishing campaign using the legit NetBird tool to stealthily take control of devices, Trellix researchers warn. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/cfos-targeted-phishing-campaign-netbird/
-
Six Levers That Quietly Change Your Risk and How to Spot Them
Most people think risk only moves when you add controls, but five other hidden forces are quietly reshaping your exposure behind the scenes. This post breaks down the six levers that actually move the math, so you can stop treating risk like a snapshot and start reading it like a live feed. First seen on…
-
Severe Vulnerabilities in Consilium CS5000 Fire Panels Allow Remote System Takeover
Two severe cybersecurity vulnerabilities have been disclosed in the Consilium Safety CS5000 Fire Panel, a widely deployed industrial control system integral to fire safety across sectors like commercial facilities, healthcare, transportation, and government services. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued alert ICSA-25-148-03 on May 29, 2025, warning that these flaws could enable…
-
Attackers Exploit Microsoft Entra Billing Roles to Escalate Privileges in Organizational Environments
A startling discovery by BeyondTrust researchers has unveiled a critical vulnerability in Microsoft Entra ID and Azure environments, where attackers can exploit lesser-known billing roles to escalate privileges within organizational tenants. This sophisticated attack vector leverages the ability of guest users, often invited for collaboration with limited permissions, to create and control Azure subscriptions in…
-
Attackers Exploit Microsoft Entra Billing Roles to Escalate Privileges
A recent discovery by security researchers at BeyondTrust has revealed a critical, yet by-design, security gap in Microsoft Entra ID that could allow external guest users to gain powerful control over Azure environments. Contrary to common assumptions, Entra B2B guest accounts”, typically used for collaboration with external partners”, can leverage specific billing roles to create…
-
Hackers Use Gh0st RAT to Hijack Internet Café Systems for Crypto Mining
Hackers have been targeting Internet cafés in South Korea since the second half of 2024, exploiting specialized management software to install malicious tools for cryptocurrency mining. According to a detailed report from AhnLab SEcurity intelligence Center (ASEC), the attackers, active since 2022, are using the notorious Gh0st RAT (Remote Access Trojan) to seize control of…
-
US Treasury sanctioned the firm Funnull Technology as major cyber scam facilitator
The U.S. sanctioned Funnull Technology and Liu Lizhi for aiding romance scams that caused major crypto losses through fraud infrastructure. The U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Philippines-based company Funnull Technology Inc. and its admin Liu Lizhi for enabling romance scams, causing $200M in U.S. victim losses. A romance scam…
-
Novel PumaBot slips into IoT surveillance with stealthy SSH break-ins
bypasses the usual playbook of conducting internet-wide scanning and instead brute-forces secure shell (SSH) credentials for a list of targets it receives from a command and control (C2) server.”DarkTrace researchers have identified a custom Go-based Linux botnet targeting embedded Linux Internet of Things (IoT) devices,” researchers said in a blog post. “The botnet gains initial access…
-
U.S. Sanctions Funnull for $200M Romance Baiting Scams Tied to Crypto Fraud
The U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) has levied sanctions against a Philippines-based company named Funnull Technology Inc. and its administrator Liu Lizhi for providing infrastructure to conduct romance baiting scams that led to massive cryptocurrency losses.The Treasury accused the Taguig-headquartered company of enabling thousands of websites involved in First seen…
-
North Korean IT Workers Exploit Legitimate Software and Network Tactics to Evade EDR
A North Korean IT worker, operating under a false identity, was uncovered infiltrating a Western organization with a sophisticated remote-control system. This incident, exposed during a U.S. federal raid on a suspected laptop farm, showcases a chilling trend where adversaries leverage legitimate software and low-level network protocols to evade traditional Endpoint Detection and Response (EDR)…
-
Critical Cisco IOS XE Flaw Permits Arbitrary File Upload, PoC Released
A critical security vulnerability, tracked as CVE-2025-20188, has been discovered in Cisco IOS XE Wireless LAN Controllers (WLCs), threatening enterprise wireless infrastructures worldwide. This flaw, scoring a maximum 10.0 on the CVSS scale, allows unauthenticated remote attackers to upload arbitrary files and potentially execute commands as root, granting full control over affected devices. The vulnerability…
-
Securing Windows 11 and Server 2025: What CISOs should know about the latest updates
Susan Bradley / CSOYou can prevent Recall use by turning off the saving of snapshots and also disabling Click to Do. Alternatively, if you want to enable the service, I recommend setting a list of applications that you want filtered as well as excluding a list of URLs.In addition, you can set policies for Copilot.…
-
Warning: Threat actors now abusing Google Apps Script in phishing attacks
script[.]google[.]com. The attacker is betting the user will see and trust the Google brand, and therefore trust the content.”By using a trusted platform to host the phishing page, the threat actor creates a false sense of security, obscuring the underlying threat with the goal of getting the recipient to enter their email and password without…
-
Tenable Bolsters AI Controls With Apex Security Acquisition
Apex Security Detection Tools Help Tenable Spot Accidental and Malicious AI Misuse. Tenable is acquiring Israeli startup Apex Security to extend AI security features that go beyond asset discovery. With user-level controls and risk mitigation for AI usage, Tenable aims to accelerate its exposure management roadmap by integrating Apex into Tenable One later this year.…
-
APT41 Uses Google Calendar Events for C2
APT41, a Chinese state-sponsored threat actor also known as Double Dragon, used Google Calendar as command-and-control infrastructure during a campaign last fall. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/apt41-uses-google-calendar-events-c2
-
From bottleneck to business enabler: making PKI work for digital transformation
Traditional PKI often creates security and agility bottlenecks due to manual processes and poor integration. As enterprises adopt cloud, DevOps, and Zero Trust, automated and scalable certificate management becomes essential. Modern PKI solutions must offer automation, policy enforcement, seamless integration, and broad coverage. Automated Internal PKI provides centralized control and lifecycle automation, enabling secure, efficient…
-
Getting Ahead of AI Risk: What Comes Next for Tenable
The acquisition of Apex Security adds a powerful new layer of visibility, context and control to the Tenable One Exposure Management Platform to govern usage, enforce policy and control exposure across both the AI that organizations use and the AI they build. Over the past 25 years, we’ve seen the attack surface shift dramatically, from…
-
Most LLMs don’t pass the security sniff test
Advice to CSOs: Lee said that CSOs should consider the following before approving any LLM:Training data: figure out where the model got its info. Random web grabs expose your secrets;Prompt history: if your questions stick around on their servers, they’ll turn up in the next breach bulletin;Credentials: stolen API keys and weak passwords keep attackers…
-
Microsoft Entra’s billing roles pose privilege escalation risks in Azure
Potential abuse for persistence, elevated access: Essentially, guest users assigned specific billing roles, such as “Billing Account Contributor”, can create new Azure subscriptions within a host tenant. This action does not require explicit permissions in the target tenant, effectively allowing guests to establish a foothold without direct administrative oversight.Once a subscription is created, the guest…
-
China-linked APT41 used Google Calendar as C2 to control its TOUGHPROGRESS malware
Google says China-linked group APT41 controlled malware via Google Calendar to target governments through a hacked site. Google warns that China-linked APT41 used TOUGHPROGRESS malware with Google Calendar as C2, targeting various government entities via a compromised website.