Tag: data
-
How Hunters International Used the Browser to Breach Enterprises”Š”, “ŠAnd Why They Didn’t See It”¦
How Hunters International Used the Browser to Breach Enterprises”Š”, “ŠAnd Why They Didn’t See It Coming At RSAC 2025, Cato Networks delivered a presentation that SOC teams and CISOs will want to pay attention to: “Suspicious Minds”Š”, “ŠHunting Threats That Don’t Trigger Security Alerts.” The session showcased ransomware campaigns that bypassed traditional detection. In some cases,…
-
Commvault clients should beware of campaign targeting cloud applications, CISA says
CISA weighed in on a cyberthreat to Commvault customers that the data management giant had reported in multiple blog posts earlier this year. First seen on therecord.media Jump to article: therecord.media/commvault-clients-cloud-applications-cyberthreat-cisa-alert
-
N.C. Pathology Practice Notifying 236,000 of Data Theft Hack
Did Marlboro-Chesterfield Pathology Pay Cybercrime Gang Safepay a Ransom?. A North Carolina pathology practice is notifying nearly 236,000 patients of a hacking incident discovered in January. Marlboro-Chesterfield Pathology says it took steps to ensure the hackers deleted its stolen data. Newcomer ransomware group Safepay is apparently the culprit in the attack. First seen on govinfosecurity.com…
-
Microsoft, DOJ Take Actions Against ‘Favored Info-Stealing Malware’ Lumma
Lumma malware, a MaaS platform active since 2022, has stolen data from 1.7M+ devices, targeting cryptos, logins, and financial information on Windows systems. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-lumma-malware-windows-microsoft-doj/
-
Noyb Threatens Meta with Lawsuit for Violating GDPR to Train AI on E.U. User Data From May 27
Austrian privacy non-profit noyb (none of your business) has sent Meta’s Irish headquarters a cease-and-desist letter, threatening the company with a class action lawsuit if it proceeds with its plans to train users’ data for training its artificial intelligence (AI) models without an explicit opt-in.The move comes weeks after the social media behemoth announced its…
-
A Hyperscaler for Cybersecurity
Tags: access, automation, business, cloud, compliance, computing, control, cybersecurity, data, detection, edr, endpoint, group, infrastructure, intelligence, mssp, network, service, siem, soc, software, threat, tool, updateHyperscalers like AWS and GCP have transformed IT and general tech. Now it’s time for the cybersecurity industry to catch up by shifting to specialized hyperscaler platforms built for security operations (SecOps) at scale. Why the cybersecurity industry needs its own hyperscaler IT hyperscalers evolved to meet the challenges of web-scale computing back in the…
-
Dozens of malicious packages on NPM collect host and network data
60 packages have been discovered in the NPM index that attempt to collect sensitive host and network data and send it to a Discord webhook controlled by the threat actor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/dozens-of-malicious-packages-on-npm-collect-host-and-network-data/
-
Editors’ Panel: CrowdStrike Legal Storm Signals Bigger Risks
Also: Privacy on the Line in 23andMe Sale; Google Leads Cyber Aid Charge. In this week’s update, ISMG editors unpacked CrowdStrike’s escalating legal troubles following its global outage, the fate of consumer DNA data as 23andMe’s assets hit the auction block, and why tech giants are banding together to pressure Washington for faster, smarter foreign…
-
U.S. policy moves reflect big tech issues with state AI laws
House Republicans proposed a 10-year moratorium on state AI rules, reflecting a concern among tech companies about the growing patchwork of state AI and data privacy measures. First seen on techtarget.com Jump to article: www.techtarget.com/searchcio/news/366624575/US-policy-moves-reflect-big-tech-issues-with-state-AI-laws
-
Rethinking Data Privacy in the Age of Generative AI
The key to navigating this new GenAI landscape is a balanced approach, one that fosters transparency, strengthens regulatory frameworks, and embraces privacy-enhancing technologies. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/rethinking-data-privacy-age-generative-ai
-
How AI Is Transforming SASE, Zero Trust for Modern Enterprises
AI transforms secure access service edge (SASE) deployments, automating security policies and threat detection while coaching users on data protection. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/how-ai-transform-sase-zero-trust-networks-security
-
New Formjacking Malware Targets E-Commerce Sites to Steal Credit Card Data
A disturbing new formjacking malware has emerged, specifically targeting WooCommerce-based e-commerce sites to steal sensitive credit card information, as recently uncovered by the Wordfence Threat Intelligence team. Unlike conventional card skimmers that overlay fake forms on checkout pages, this malware seamlessly integrates into the legitimate payment workflow of WooCommerce sites, mimicking their design and functionality…
-
Inside LockBit: Data Leak Reveals Leading Affiliates and How They Operate
A massive data leak from the LockBit ransomware group, published on its hijacked leak site, has provided an unprecedented glimpse into the inner workings of one of the most notorious Ransomware-as-a-Service (RaaS) operations. The leaked data, spanning from December 19, 2024, to April 29, 2025, primarily pertains to the group’s “LockBit Lite” panel a lower-tier…
-
Operation Endgame 2.0: DanaBusted
Tags: access, attack, backup, banking, breach, business, cloud, communications, control, crypto, cybercrime, data, defense, detection, email, espionage, firewall, fraud, government, group, Hardware, infection, intelligence, international, law, malicious, malware, middle-east, network, programming, ransomware, russia, service, supply-chain, switch, threat, tool, ukraine, update, windowsIntroductionOn May 22, 2025, international law enforcement agencies released information about additional actions that were taken in conjunction with Operation Endgame, an ongoing, coordinated effort to dismantle and prosecute cybercriminal organizations, including those behind DanaBot. This action mirrors the original Operation Endgame, launched in May 2024, which disrupted SmokeLoader, IcedID, SystemBC, Pikabot, and Bumblebee. Zscaler…
-
Is privacy becoming a luxury? A candid look at consumer data use
In this Help Net Security interview, Dr. Joy Wu, Assistant Professor, UBC Sauder School of Business, discusses the psychological and societal impacts of data monetization, why … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/23/joy-wu-ubc-sauder-school-of-business-privacy-luxury/
-
CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets
Tags: advisory, backup, cisa, cloud, cyber, cybersecurity, data, exploit, infrastructure, microsoft, service, software, threat, vulnerability, zero-dayOn May 22, 2025, Commvault, a leading enterprise data backup provider, issued an urgent advisory regarding active cyber threat activity targeting its Metallic software-as-a-service (SaaS) application, which is hosted in the Microsoft Azure cloud environment. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that threat actors exploited a zero-day vulnerability (CVE-2025-3928) in Commvault’s web…
-
Response to CISA Advisory (AA25-141B): Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations
AttackIQ has updated an existing assessment template in response to the CISA Advisory (AA25-141B) published on May 21, 2025, which disseminates Tactics, Techniques and Procedures (TTPs) and Indicators of Compromise (IOCs), associated with threat actors deploying the LummaC2 information stealer malware, identified through FBI investigations as recent as May 2025. First seen on securityboulevard.com Jump…
-
Microsoft raises posse to target dangerous Lumma malware
Microsoft, along with a consortium of partners, has seized and disrupted a significant part of the Lumma malware-as-a-service network used to steal data and funds First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366624474/Microsoft-raises-posse-to-target-dangerous-Lumma-malware
-
Russian APT28 compromised Western logistics and IT firms to track aid to Ukraine
Tags: access, advisory, api, authentication, cctv, cloud, computer, container, credentials, cve, cybersecurity, data, detection, email, exploit, flaw, government, hacker, identity, infrastructure, Internet, login, malicious, malware, mfa, military, network, ntlm, office, open-source, password, phishing, powershell, russia, service, software, threat, tool, ukraine, vulnerabilityCredential guessing and spearphishing: The attackers used brute-force credential guessing techniques, also known as password spraying, to gain initial access to accounts. This was complemented with targeted phishing emails that directed recipients to fake login pages for government entities or Western cloud email providers. These phishing pages were stored on free web hosting services or…
-
Bribery-Led Coinbase Hack Affects 70,000 Crypto Customers
Hacker Demanded $20M Ransom to Delete Stolen Personal, Financial Information. A months-long data breach led to the theft of personal and financial information of nearly 70,000 Coinbase customers. Coinbase said the breach dates back to December and was aided by bribery schemes targeting the company’s overseas customer support agents. First seen on govinfosecurity.com Jump to…
-
Coca-Cola, Bottling Partner Named in Separate Ransomware and Data Breach Claims
Coca-Cola and its bottling partner CCEP targeted in separate cyber incidents, with the Everest ransomware gang and the Gehenna hacking group claiming data breaches involving sensitive employee and CRM data. First seen on hackread.com Jump to article: hackread.com/coca-cola-bottling-partner-ransomware-data-breach/
-
Following Data Breach, Multiple Stalkerware Apps Go Offline
The same easily exploitable vulnerability was found in three of the apps that led to the compromise of victims’ data. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/following-data-breach-stalkerware-apps-offline
-
Evaluating open-source tools for data masking
Can you use open-source tools to mask sensitive production data for use in testing and development? We explore the available options and weigh the pros and cons of relying on DIY data masking solutions. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/evaluating-open-source-tools-for-data-masking/
-
How to prevent data leakage in your AI applications with Tonic Textual and Snowpark Container Services
Tonic Textual provides advanced Named Entity Recognition (NER) and synthetic replacement of sensitive free-text data. Today, we are excited to announce that Tonic Textual is now available on the Snowflake Data Platform via Snowpark Container Services (SPCS). SPCS enables you to run containerized workloads directly within Snowflake, ensuring that your data doesn’t leave your Snowflake…
-
De-Identifying Your Text Data in Snowflake Using Tonic Textual
Discover how Tonic Textual revolutionizes data privacy in Snowflake. Learn to create and implement a UDF for secure, compliant free-text data use in our latest article. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/de-identifying-your-text-data-in-snowflake-using-tonic-textual/
-
Shields Health to Pay $15.35M to Settle Lawsuit in 2022 Hack
Medical Imaging Provider’s Data Theft Incident Affected Nearly 2.4M Individuals. Shields Health Care Group, a Massachusetts-based provider of medical imaging services with 30 facilities in New England, agreed to pay $15.35 million to settle a consolidated proposed class action litigation centered on a 2022 hacking incident that affected nearly 2.4 million individuals. First seen on…
-
Randall Munroe’s XKCD ‘Baker’s Units’
Tags: datavia the cosmic humor & dry-as-the-desert wit of Randall Munroe, creator of XKCD Permalink First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2025/05/randall-munroes-xkcd-bakers-units/
-
Russian Hackers Exploit Oracle Cloud Infrastructure to Target Scaleway Object Storage
Russian threat actors have been leveraging trusted cloud infrastructure platforms like Oracle Cloud Infrastructure (OCI) Object Storage and Scaleway Object Storage to propagate sophisticated attacks using the Lumma Stealer malware. This malware-as-a-service (MaaS) infostealer, also known as LummaC2 Stealer, targets Windows systems to siphon credentials, system data, and cryptocurrency wallets. Investigations conducted in 2025 reveal…
-
How Identity Plays a Part in 5 Stages of a Cyber Attack
Tags: access, attack, authentication, breach, cloud, computer, container, control, credentials, cyber, data, data-breach, detection, endpoint, exploit, group, iam, identity, intelligence, malicious, malware, mfa, microsoft, monitoring, password, powershell, ransomware, risk, technology, threat, tool, vulnerabilityWhile credential abuse is a primary initial access vector, identity compromise plays a key role in most stages of a cyber attack. Here’s what you need to know, and how Tenable can help. Identity compromise plays a pivotal role in how attackers move laterally through an organization. Credential abuse is the top initial access vector,…
-
The Voter Experience
Technology and innovation have transformed every part of society, including our electoral experiences. Campaigns are spending and doing more than at any other time in history. Ever-growing war chests fuel billions of voter contacts every cycle. Campaigns now have better ways of scaling outreach methods and offer volunteers and donors more efficient ways to contribute…