Tag: cyber
-
Crypto Platform OKX Suspends Tool Abused by North Korean Hackers
Cryptocurrency platform OKX has announced the temporary suspension of its Decentralized Exchange (DEX) aggregator tool. This decision comes on the heels of coordinated attacks by certain media outlets and unsuccessful attempts by the notorious Lazarus Group”, a hacking entity linked to North Korea”, to exploit OKX’s DeFi services. Background on the Lazarus Group The Lazarus…
-
Cobalt Strike 4.11 Released with Built-In Evasion Features for Red Teams
Cobalt Strike, a highly advanced threat emulation tool, has released version 4.11, packing a robust suite of features designed to enhance evasion capabilities for red teams. This latest update introduces several novel technologies and improvements, solidifying Cobalt Strike’s position as a leading platform for offensive security operations. Key Features of Cobalt Strike 4.11 1. Enhanced…
-
Cyberangriff auf einen Süßwarenhersteller in Kanada
Ganong in St. Stephen hit by ransomware cyber attack First seen on country94.ca Jump to article: www.country94.ca/2025/03/14/ganong-in-st-stephen-hit-by-ransomware-cyber-attack/
-
PoC Exploit Released for Linux Kernel UseFree Vulnerability
A proof-of-concept (PoC) exploit has been released for a use-after-free vulnerability in the Linux kernel, identified as CVE-2024-36904. This vulnerability is located in the TCP subsystem of the Linux kernel and is caused by the inet_twsk_hashdance() function inserting the time-wait socket into the established hash table before setting its reference counter. CVE Overview CVE-2024-36904 affects the Linux…
-
Attack time frames are shrinking rapidly. Here’s how cyber teams can cope.
Time frame changes to time to exploit: The time frames are quickly shortening as the focus by a variety of attackers’ ransomware efforts shift to data stealing first, rather than trying to collect ransoms.A recent Huntress Cyber Report shows that that TTE, which the researchers refer to as “time-to-ransom” or TTR, has dropped to a few…
-
Not all cuts are equal: Security budget choices disproportionately impact risk
Tags: ai, application-security, attack, awareness, backdoor, breach, bug-bounty, business, ceo, ciso, cloud, compliance, container, control, cyber, cybersecurity, data, iam, identity, incident response, infrastructure, monitoring, phishing, risk, risk-management, service, software, strategy, technology, threat, tool, training, update, usa, vulnerability[Source: Splunk] As cyber threats evolve at an unprecedented pace, delaying essential technology upgrades can severely impact an organization. The newest technological updates are introduced to enhance an organization’s security offerings and directly address recently identified challenges.”Outdated systems lack new features and functionality that allow for more sophisticated offerings, like moving to the cloud,” Kirsty…
-
Denmark Issues Warning on Major Cyber Attacks Targeting Telecom Sector
Denmark has announced a heightened alert status for the telecommunications sector due to an increased threat from cyber attacks. According to a recent threat assessment by the Danish Agency for Social Security, the risk level for cyber espionage against the Danish telecom sector has been elevated to >>HIGH.
-
Google Launches Open-Source OSV-Scanner for Detecting Security Vulnerabilities
Google has announced the launch ofOSV-Scanner V2, an open-source tool designed to enhance vulnerability scanning and remediation across various software ecosystems. This update follows the recent release of OSV-SCALIBR, another powerful tool in the OSV suite, which together form a comprehensive platform for managing vulnerability metadata and streamlining vulnerability detection and management. Key Features of OSV-Scanner…
-
White House exempts cyber pros from mass layoffs; Judge reinstates CISA firings
CISA document process raises security concerns: It’s unclear why CISA posted its request for fired employees to send a password-protected attachment containing personally identifiable information to a publicly promoted email address. It’s also unclear how the password-protected document process would work. CISA did not respond to CSO’s request for clarification.Some cybersecurity professionals cast doubt on…
-
Australia Sues FIIG Investment Firm in Cyber ‘Wake-Up Call’
Regulators Say FIIG Lacked Basic Security Measures to Prevent 2023 Breach. The Australian financial regulator has filed a lawsuit against FIIG Securities Limited, accusing the leading investment and financing company of having inadequate cybersecurity controls to stop a threat actor from stealing the confidential personal information of 18,000 customers. First seen on govinfosecurity.com Jump to…
-
News alert: Link11’s research shows DDoS attacks are more targeted, and doubled, year-over-year
Frankfurt, Germany, Mar. 17, 2025, CyberNewswire, Cyberattacks are no longer an abstract threat they dominate risk planning for companies worldwide. The latest Link11 European Cyber Report shows an alarming trend: the number of DDoS attacks has more than… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/news-alert-link11s-research-shows-ddos-attacks-are-more-targeted-and-doubled-year-over-year/
-
Unbefugter Zugriff auf das Ticket-System eines Telekommunikationsdienstleisters aus der Schweiz
Ascom affected by cyber attack First seen on ascom.com Jump to article: www.ascom.com/news/Business-News/cyberattack/
-
Denmark Warns of Increased Cyber Espionage Against Telecom Sector
A new threat assessment from the Danish Civil Protection Authority (SAMSIK) warned of cyberattacks targeting the telecommunications sector after citing a wave of incidents hitting European organizations the past few years. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/denmark-warns-increased-cyber-espionage-telecom-sector
-
Apache Tomcat RCE Vulnerability Under Fire With 2-Step Exploit
The researchers who discovered the initial assault warned that the simple, staged attack is just the beginning for advanced exploit sequences that will test cyber defenses in new and more difficult ways. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/apache-tomcat-rce-vulnerability-exploit
-
Supply Chain Attack Targets 23,000 GitHub Repositories
A critical security incident has been uncovered involving the popular GitHub Action tj-actions/changed-files, which is used in over 23,000 repositories. The attack involves a malicious modification of the Action’s code, leading to the exposure of CI/CD secrets in GitHub Actions build logs. This vulnerability was detected by StepSecurity’s Harden-Runner, a tool designed to secure CI/CD…
-
MassJacker Clipper Malware Targets Users Installing Pirated Software
A recent investigation has uncovered previously unknown cryptojacking malware, dubbed MassJacker, which primarily targets users who download pirated software from sites like pesktop.com. This malware operates by replacing cryptocurrency wallet addresses copied by users with those belonging to the attackers, aiming to redirect funds to the threat actors’ wallets. The discovery highlights the risks associated…
-
SocGholish Exploits Compromised Websites to Deliver RansomHub Ransomware
SocGholish, a sophisticated malware-as-a-service (MaaS) framework, has been identified as a key enabler in the distribution of RansomHub ransomware. This malicious framework exploits compromised websites by injecting them with obfuscated JavaScript loaders, which redirect users to fake browser update notifications. These notifications trick users into downloading and executing malicious files, thereby initiating the infection process.…
-
New Steganographic Malware Hides in JPG Files to Deploy Multiple Password Stealers
A recent cybersecurity threat has emerged in the form of a steganographic campaign that uses seemingly harmless JPG files to distribute multiple types of malware, including password stealers like Remcos and AsyncRAT. This sophisticated attack begins with a phishing email containing a malicious Excel document that exploits a known vulnerability, CVE-2017-0199, to initiate the infection…
-
New C++-Based IIS Malware Mimics cmd.exe to Evade Detection
A recent discovery by Palo Alto Networks’ Unit 42 has shed light on sophisticated malware targeting Internet Information Services (IIS) servers. This malware, developed in C++/CLI, a rare choice for malware authors, has been designed to mimic the behavior of cmd.exe to evade detection. The malware operates as a passive backdoor, integrating itself into the…
-
New KnowBe4 Report Finds Education Sector Unprepared for Escalating Cyberattacks
KnowBe4, the cybersecurity platform that comprehensively addresses human risk management, today announced a new report, “From Primary Schools to Universities, The Global Education Sector is Unprepared for Escalating Cyber Attacks”. The education sector was the most targeted industry for cyberattacks in 2024, according to several reports, including one from Check Point Research. The sector has also…
-
What Is Exposure Management and Why Does It Matter?
Tags: access, attack, breach, business, ciso, cloud, compliance, credentials, cve, cyber, cybersecurity, data, data-breach, group, identity, infrastructure, iot, metric, password, phishing, risk, service, software, technology, threat, tool, vulnerability, vulnerability-managementEach Monday, the Tenable Exposure Management Academy will provide the practical, real-world guidance you need to shift from vulnerability management to exposure management. In our first blog in this new series, we get you started with an overview of the differences between the two and explore how cyber exposure management can benefit your organization. Traditional…
-
GitHub accounts targeted with fake security alerts
Possible DPRK links: Luc4m’s X post hinted at possible nation-state connections, adding, “Smells #DPRK?” While nothing else was said on the X thread, North Korea is known for using click-fix attacks for its cyber espionage activities, with Contagious Interviews being a prominent one of those campaigns.All GitHub fake alerts included the same login information, location:…
-
Kentico Xperience CMS Vulnerability Enables Remote Code Execution
In recent security research, vulnerabilities in the Kentico Xperience CMS have come to light, highlighting significant risks for users who rely on this Content Management System (CMS). Specifically, two primary issues were identified: an Authentication Bypass vulnerability and a Post-Authentication Remote Code Execution (RCE) vulnerability. These vulnerabilities, collectively forming a powerful exploit chain, allow attackers to gain full control…
-
Wazuh SIEM Vulnerability Enables Remote Malicious Code Execution
A critical vulnerability, identified as CVE-2025-24016, has been discovered in the Wazuh Security Information and Event Management (SIEM) platform. This vulnerability affects versions 4.4.0 to 4.9.0 and allows attackers with API access to execute arbitrary Python code remotely, potentially leading to complete system compromise. The flaw stems from the unsafe deserialization of Distributed API (DAPI)…
-
Espressif Systems Flaws Allow Hackers to Execute Arbitrary Code
A series of vulnerabilities has been discovered in Espressif Systems’ ESP32 devices, specifically affecting the BluFi module within the ESP-IDF framework. BluFi is designed to simplify WiFi configuration using a Bluetooth interface. These flaws, identified by the NCC Group, enable attackers to execute arbitrary code on ESP32 devices and potentially access sensitive information such as…
-
How can I integrate NHI controls into my cloud security framework?
Are Non-Human Identities the Key to a Secure Cloud Environment? With the surge of cloud-based operations, businesses face a continuous challenge to maintain a secure environment. One innovative approach to this is the strategic integration of Non-Human Identities (NHIs) into a company’s cyber defense protocol. So how can businesses leverage the power of NHIs for……
-
UK Cybersecurity Weekly News Roundup 16 March 2025
Tags: access, apple, attack, backdoor, backup, compliance, control, cyber, cyberattack, cybercrime, cybersecurity, data, encryption, finance, firewall, government, group, hacking, insurance, law, lockbit, malicious, network, office, privacy, ransomware, regulation, risk, russia, service, software, virusWelcome to this week’s edition of our cybersecurity news roundup, bringing you the latest developments and insights from the UK and beyond. UK Government’s Stance on Encryption Raises Global Concerns The UK government has ordered Apple to provide backdoor access to iCloud users’ encrypted backups under the Investigatory Powers Act of 2016. This secret order…