Collecting Cyber-News from over 60 sources

Tag: defense

US must prioritize cybersecurity training for the military’s engineers

Mar 13, 2025 9:53 PM

Tags: cybersecurity, defense, military, training

The Defense Department faces a startling capability gap. First seen on defensescoop.com Jump to article: defensescoop.com/2025/03/13/prioritize-cybersecurity-training-military-engineers/
AI security defenses potentially circumvented via picklescan flaws

Mar 13, 2025 9:53 PM

Tags: ai, defense, flaw

First seen on scworld.com Jump to article: www.scworld.com/brief/ai-security-defenses-potentially-circumvented-via-picklescan-flaws
DFARS 101: Protecting CUI in Defense Contracts

Mar 13, 2025 4:52 PM

Tags: business, compliance, cybersecurity, defense, guide

If your company handles Controlled Unclassified Information (CUI) for defense contracts, you’ve likely encountered DFARS and its key cybersecurity clauses: 7012, 7019, 7020, and 7021. But what exactly is DFARS, why is compliance crucial, and how can your business ensure it meets the requirements? This guide provides a high-level overview of DFARS compliance, including its……
Breaking the Barriers to a Password-Free Life in Enterprise: Meet SafeNet eToken Fusion NFC PIV security key

Mar 13, 2025 1:52 PM

Tags: access, authentication, cloud, compliance, control, credentials, data, defense, encryption, fido, framework, government, healthcare, identity, infrastructure, mobile, nfc, password, phishing, regulation, service, software, strategy, technology, windows

Breaking the Barriers to a Password-Free Life in Enterprise: Meet SafeNet eToken Fusion NFC PIV security key madhav Thu, 03/13/2025 – 06:46 As large organizations increasingly shift towards passwordless solutions, the benefits are clear: enhanced user experience, improved security, and significant cost savings. The FIDO (Fast Identity Online) standard has emerged as the gold standard…
Generative AI red teaming: Tips and techniques for putting LLMs to the test

Mar 13, 2025 7:52 AM

Tags: ai, attack, best-practice, business, data, defense, detection, exploit, framework, group, guide, infrastructure, injection, LLM, mitigation, mitre, ml, nist, privacy, RedTeam, risk, skills, strategy, technology, threat, tool, vulnerability

Defining objectives and scopeAssembling a teamThreat modelingAddressing the entire application stackDebriefing, post-engagement analysis, and continuous improvementGenerative AI red teaming complements traditional red teaming by focusing on the nuanced and complex aspects of AI-driven systems including accounting for new testing dimensions such as AI-specific threat modeling, model reconnaissance, prompt injection, guardrail bypass, and more. AI red-teaming…
Fortinet Addresses Security Issues in FortiSandbox, FortiOS, and Other Products

Mar 13, 2025 7:52 AM

Tags: cyber, defense, fortinet, incident response, security-incident, update, vulnerability

Fortinet’s Product Security Incident Response Team (PSIRT) announced the resolution of several critical and high-severity security vulnerabilities affecting various Fortinet products, including FortiSandbox and FortiOS. These updates are part of Fortinet’s ongoing efforts to enhance the security and reliability of its solutions, ensuring a robust defense against potential threats. Summary of Resolved Issues A total…
CISA Defunds Threat-Sharing Hubs for States and Elections

Mar 12, 2025 10:53 PM

Tags: cisa, cyber, cybersecurity, defense, election, group, infrastructure, threat

Cyber Defense Agency Axes Funding for Key ISACs as Trump Shifts Federal Priorities. The Cybersecurity and Infrastructure Security Agency is eliminating $10 million in annual funding for two key cybersecurity hubs supporting states and local elections as agency officials tell Information Security Media Group the move is aimed at eliminating waste and realigning priorities. First…
Trump nominates cyber vet Sean Plankey for CISA chief amid DOGE cuts and firings

Mar 12, 2025 7:52 PM

Tags: cisa, cyber, cybersecurity, defense, disinformation, election, government, infrastructure, jobs, RedTeam, tool

Plankey’s potential impact on CISA’s staff and spending cuts: CISA has long been a target of Republicans, primarily due to the minimal amount of now-discontinued work the agency conducted on misinformation efforts. It has also experienced heavy staff and spending cuts spurred by Elon Musk’s DOGE initiative.Over the past seven weeks, CISA has endured at…
SSRF Exploitation Surge Highlights Evolving Cyberthreats

Mar 12, 2025 7:52 PM

Tags: attack, defense, exploit, update, vulnerability

Coordinated SSRF attacks exploit critical vulnerabilities across platforms, urging organizations to update defenses and mitigate emerging cyberthreats. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/cybersecurity/ssrf-exploitation-surge-evolving-threats/
Europe urged to seize ‘opportunity’ by replacing US funding for Ukraine cyber defense

Mar 12, 2025 5:52 PM

Tags: cyber, defense, ukraine

“This is an opportunity for Europe. We should take a bigger role,” said Tanel Sepp, Estonia’s cyber ambassador at large, about the funding gap left in the wake of President Donald Trump’s freezing of funds. First seen on therecord.media Jump to article: therecord.media/europe-opportunity-tallinn-funding-replace
What is Rootkit Detection and Prevention

Mar 11, 2025 1:54 PM

Tags: computer, cyberattack, dark-web, defense, detection, malicious, network, software

The intricacy of cyberattacks is growing. Imagine a stealthy cyberattack that infiltrates your network, computers, etc, hides malicious software, and silently dismantles your defenses without detection. This is how the rootkit works. Another aspect that makes rootkits a serious problem is that they are now easily available on the dark web, once exclusive only to……
Scam spoofs Binance website and uses TRUMP coin as lure for malware

Mar 10, 2025 5:53 PM

Tags: access, defense, hacker, malicious, malware, phishing, scam, tool

Researchers at phishing defense company Cofense say hackers are spreading a malicious remote access tool through a fake Binance page that offers access to the TRUMP coin. First seen on therecord.media Jump to article: therecord.media/email-scam-spoofs-binance-offers-trump-coin-connectwise-rat
Review: The Cybersecurity Trinity

Mar 10, 2025 5:53 PM

Tags: ai, automation, cyber, cybersecurity, defense

The Cybersecurity Trinity provides a comprehensive approach to modern cybersecurity by integrating AI, automation, and active cyber defense (ACD) into a unified strategy. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/03/10/review-the-cybersecurity-trinity/
10 Best Penetration Testing Companies in 2025

Mar 8, 2025 11:53 AM

Tags: application-security, cyber, cyberattack, cybersecurity, defense, exploit, malicious, penetration-testing, service, vulnerability

Penetration testing companies play a vital role in strengthening the cybersecurity defenses of organizations by identifying vulnerabilities in their systems, applications, and networks. These firms simulate real-world cyberattacks to uncover weaknesses that could be exploited by malicious actors, helping businesses implement proactive security measures. They provide services tailored to various industries, including web application security,…
Compensating Controls, Customized Approach and Tokenization in PCI DSS 4.0

Mar 7, 2025 8:53 PM

Tags: breach, control, cyber, data, defense, PCI, threat
Cybersecurity Snapshot: CSA Outlines Data Security Challenges and Best Practices, While ISACA Offers Tips To Retain IT Pros

Mar 7, 2025 8:53 PM

Tags: advisory, ai, awareness, banking, best-practice, business, cloud, compliance, corporate, crime, crypto, cve, cyber, cybercrime, cybersecurity, data, defense, exploit, extortion, finance, fraud, governance, government, group, healthcare, infrastructure, iot, jobs, mail, malicious, microsoft, mitigation, monitoring, network, nis-2, privacy, qr, ransom, ransomware, regulation, resilience, risk, risk-assessment, risk-management, scam, service, strategy, technology, threat, tool, vmware, vulnerability, vulnerability-management, zero-day

Check out best practices for shoring up data security and reducing cyber risk. Plus, get tips on how to improve job satisfaction among tech staff. Meanwhile, find out why Congress wants federal contractors to adopt vulnerability disclosure programs. And get the latest on cyber scams; zero-day vulnerabilities; and critical infrastructure security. Dive into six things…
Pentagon Cuts Threaten Programs That Secure Loose Nukes and Weapons of Mass Destruction

Mar 6, 2025 8:53 PM

Tags: defense

Documents obtained by WIRED show the US Department of Defense is considering cutting up to 75 percent of workers who stop the spread of chemical, biological, and nuclear weapons. First seen on wired.com Jump to article: www.wired.com/story/pentagon-cuts-nukes-chemical-weapons-wmd/
Ransomware goes postal: US healthcare firms receive fake extortion letters

Mar 5, 2025 7:34 PM

Tags: access, attack, awareness, breach, ciso, communications, cybersecurity, dark-web, data, data-breach, defense, email, extortion, fraud, group, healthcare, law, mail, network, ransom, ransomware, scam, threat, unauthorized

Phantom extortion: Ransomware impersonation is nothing new. In 2019, organizations across the US reportedly received emails deploying the same fake breach modus operandi as the recent letter writers ‘pay up now because we have your data’. In truth, such campaigns are probably commonplace but are dismissed as obvious ruses and rarely reported on.However, by 2023…
We’re losing”Š”, “Šbut it can’t get any worse, right?

Mar 5, 2025 5:34 PM

Tags: access, ai, antivirus, api, attack, chatgpt, cloud, control, crowdstrike, cybersecurity, defense, detection, edr, encryption, github, infection, injection, korea, LLM, malicious, malware, mandiant, ml, monitoring, network, north-korea, openai, phishing, powershell, service, social-engineering, threat, tool

We’re losing”Š”, “Šbut it can’t get any worse, right? LLMs are being used in many ways by attackers; how blind are you? We’re spending hundreds of billions and losing trillions in cybersecurity. The industry structure is partially to blame. AI is here to help, right? Well, as others have pointed out, AI is being adopted more rapidly…
Critical vulnerabilities expose network security risks in Keysight’s infrastructure

Mar 5, 2025 3:34 PM

Tags: access, advisory, attack, best-practice, cisa, control, cve, cyber, cybersecurity, data, defense, exploit, flaw, infrastructure, Internet, malicious, mitigation, network, risk, service, software, strategy, threat, unauthorized, update, vpn, vulnerability

Potential threats to enterprises: Successful exploitation of these vulnerabilities could have dire consequences, including system crashes, arbitrary file deletions, and unauthorized access to sensitive information. Attackers leveraging these flaws may gain control over affected devices, facilitating further attacks within an enterprise’s network.Furthermore, multiple path traversal vulnerabilities (CVE-2025-21095 and CVE-2025-23416) identified in the affected software versions…
Why Supply Chain Attacks Are The Biggest Threat To Businesses?

Mar 5, 2025 12:34 PM

Tags: attack, defense, healthcare, india, software, supply-chain, threat, usa

In 2024, approximately 183,000 customers worldwide were affected by supply chain attacks. In terms of frequency, the software supply chain experienced one attack every 48 hours. Surprisingly, India is among the most targeted countries, along with the USA, UK, Australia, Japan, and Germany. Manufacturing, healthcare, defense, and aerospace are among the most targeted sectors. Among……
Chinese cyber espionage growing across all industry sectors

Mar 5, 2025 9:34 AM

Tags: access, attack, authentication, botnet, breach, china, cisco, credentials, crowdstrike, cyber, cyberespionage, defense, espionage, exploit, finance, flaw, government, group, identity, Internet, iot, law, malware, mfa, network, service, social-engineering, technology, threat, update, vulnerability

New cyber operations in key sectors: Historically, Chinese cyberespionage groups have predominantly targeted organizations from the government, technology, and telecommunications sectors and that continued in 2024. Government orgs were a target for China-linked threat actors in virtually all regions of the world, and Salt Typhoon, a cyber unit tied to China’s MSS, made headlines in…
Microsoft pushes a lot of products on users, but here’s one cybersecurity can embrace

Mar 5, 2025 8:34 AM

Tags: access, attack, authentication, best-practice, business, cisa, cloud, cybersecurity, data-breach, defense, governance, government, identity, mfa, microsoft, monitoring, password, phishing, service, siem

Entra monitors for suspicious activity: Entra monitors for activities that are more than likely being carried out by attackers. So, for example, the following actions are monitored:Users with leaked credentials.Sign-ins from anonymous IP addresses.Impossible travel to atypical locations.Sign-ins from infected devices.Sign-ins from IP addresses with suspicious activity.Sign-ins from unfamiliar locations.You can set a threshold for…
Getting the Most Value Out of the OSCP: The PEN-200 Course

Mar 4, 2025 6:34 PM

Tags: access, antivirus, attack, awareness, backdoor, cloud, compliance, conference, control, credentials, cve, cybersecurity, data, defense, detection, dos, edr, endpoint, exploit, github, gitlab, guide, hacker, hacking, jobs, kali, linkedin, linux, login, malicious, malware, mandiant, microsoft, network, ntlm, open-source, password, penetration-testing, powershell, programming, rce, remote-code-execution, risk, service, skills, software, tactics, theft, threat, tool, unauthorized, update, vmware, vulnerability, windows

In this second post of a five-part series, I provide advice on how to best utilize the PEN-200 course material for a successful career in ethical hacking. Disclaimer: All opinions expressed in this article are solely my own. I have reviewed the content to ensure compliance with OffSec’s copyright policies and agreements. I have not been…
Bypassing AV Detection Anti-Malware Scans with Red Team Tool SpecterInsight

Mar 4, 2025 5:34 PM

Tags: antivirus, cyber, defense, detection, malware, RedTeam, tool

In an era where antivirus (AV) solutions and anti-malware scan interfaces (AMSI) are becoming increasingly sophisticated, red team operators and penetration testers face mounting challenges in evading detection. SpecterInsight, a powerful offensive security tool, has emerged as a solution to bypass these defenses while maintaining stealth. The latest version, SpecterInsight 4.2.0, introduces advanced payload crafting…
Hackers Exploit Microsoft Teams Quick Assist for Remote Access

Mar 4, 2025 5:34 PM

Tags: access, attack, corporate, cyber, cybercrime, cybersecurity, defense, exploit, group, hacker, microsoft, ransomware, threat, tool, unauthorized

Cybersecurity researchers have uncovered a sophisticated campaign in which threat actors are exploiting Microsoft Teams and Quick Assist to gain unauthorized remote access to enterprise systems. The attacks, attributed to ransomware groups such as Black Basta and Cactus, demonstrate the growing trend of cybercriminals abusing legitimate tools to bypass security defenses and infiltrate corporate networks.…
7 key trends defining the cybersecurity market today

Mar 4, 2025 11:34 AM

Tags: access, ai, attack, cisco, ciso, cloud, compliance, control, crowdstrike, cyber, cybersecurity, data, defense, detection, endpoint, fortinet, gartner, google, governance, group, ibm, intelligence, microsoft, ml, network, okta, resilience, risk, service, siem, startup, strategy, technology, threat, tool, vulnerability, zero-trust

Market leaders are gaining share: The cybersecurity market has a dizzying number of single-product vendors, but a handful of powerful platform providers have risen above the pack and are gaining market share.According to research firm Canalys, the top 12 vendors benefited the most from customers taking early steps to transition to platforms. Collectively, they accounted…
CISA maintains stance on Russian cyber threats despite policy shift

Mar 4, 2025 8:34 AM

Tags: cisa, cyber, defense, russia, threat

US CISA confirms no change in defense against Russian cyber threats despite the Trump administration’s pause on offensive operations. US CISA stated there is no change in defending against Russian cyber threats, despite the Trump administration’s temporary pause on offensive cyber operations. US Defense Secretary Pete Hegseth has recently ordered US Cyber Command to pause…
US Eases Off Russia in Cyberspace

Mar 3, 2025 11:34 PM

Tags: cyber, defense, russia

Reports: Cyber Command Ordered to Halt Offensive Operations Against Russia. Russia won’t have the United States to worry about in cyberspace in an apparent concession to Moscow meant to grease talks between the two capitals over the fate of Ukraine. Defense Secretary Pete Hegseth ordered U.S. Cyber Command to halt offensive cyber operations against Russia.…
Fighting Back: 4 Essential Ransomware Defense Strategies for CISOs in 2025

Mar 3, 2025 10:34 PM

Tags: breach, ciso, cyber, defense, extortion, ransomware, strategy, tactics, tool

Focus on Cyber Hygiene, Advanced Tools and Rapid Response to Outsmart Attackers Modern cyberthreats require modern defense tactics. Ransomware now employs multilayered extortion tactics that target operations and reputations. With 68% of breaches involving human error, CISOs and leaders must focus on cyber hygiene, advanced security tools and rapid response strategies. First seen on govinfosecurity.com…