Tag: threat
-
ThreatLocker Patch Management: A Security-First Approach to Closing Vulnerability Windows
Patching is basic cyber hygiene, but executing it at scale, securely, and fast? That’s the real challenge. ThreatLocker’s Patch Management flips the script with control, visibility, and Zero Trust workflows built for today’s threat landscape. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/threatlocker-patch-management-a-security-first-approach-to-closing-vulnerability-windows/
-
The Day I Found an APT Group In the Most Unlikely Place
Dark Reading Confidential Episode 6: Cyber researchers Ismael Valenzuela and Vitor Ventura share riveting stories about the creative tricks they used to track down advanced persistent threat groups, and the surprises they discovered along the way. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/the-day-i-found-an-apt-group-in-the-most-unlikely-place
-
Definition TIP – Was ist eine Threat Intelligence Platform?
First seen on security-insider.de Jump to article: www.security-insider.de/was-ist-eine-threat-intelligence-platform-tip-a-b6e9912c0fd548c2d4d94cc6f949bd3b/
-
Critical flaw in OpenPGP.js raises alarms for encrypted email services
Tags: attack, backdoor, crypto, email, flaw, group, malicious, open-source, risk, service, supply-chain, threat, tool, vulnerabilityTrusting open code: The incident also underscores a familiar trade-off. Open-source libraries such as OpenPGP.js are widely used because they offer transparency, broad adoption, and the advantages of community input and peer review.But trusting open source libraries also means inheriting any flaws they might have, even subtle ones, that can go unnoticed for years.”This vulnerability…
-
IBM Warns: One-Third of Cyber Attacks Use Advanced Tactics to Steal Login Credentials
IBM X-Force’s 2024 cybersecurity report, nearly one-third of cyber intrusions now rely on identity-based attacks, exploiting valid login credentials to breach systems. This alarming trend, continuing for the second consecutive year, highlights a shift in threat actor strategies, moving away from traditional brute-force methods to stealthier, more persistent tactics. Attackers are increasingly leveraging sophisticated tools,…
-
SideWinder APT Hackers Exploits Legacy Office Vulnerabilities to Deploy Malware Undetected
Tags: apt, credentials, cyber, exploit, government, hacker, malware, microsoft, military, office, threat, vulnerabilityThe Acronis Threat Research Unit (TRU) has revealed an advanced campaign believed to be orchestrated by the SideWinder advanced persistent threat (APT) group. This operation, running through early 2025, has primarily targeted high-value government and military institutions across Sri Lanka, Bangladesh, and Pakistan, exploiting unpatched legacy Microsoft Office vulnerabilities to deploy credential-stealing malware while evading…
-
A house full of open windows: Why telecoms may never purge their networks of Salt Typhoon
Experts tell CyberScoop that the U.S. telecom system is just too technologically fragmented to gather a clear picture of threats, and too big to ever fully eject all espionage efforts. First seen on cyberscoop.com Jump to article: cyberscoop.com/salt-typhoon-chinese-hackers-us-telecom-breach/
-
Over 1.5 Million Indian Websites Targeted in Coordinated Attacks
In a significant escalation of cyber warfare, over 1.5 million Indian websites have been targeted in a series of coordinated cyberattacks attributed to seven Advanced Persistent Threat (APT) groups, primarily based in Pakistan. These attacks, following the Pahalgam terror strike and India’s subsequent Operation Sindoor, aimed at critical infrastructure and government websites across the country.…
-
Navigating the Digital Seas: Addressing Cybersecurity Challenges in Maritime Shipping
The maritime industry is undergoing a significant digital transformation, integrating advanced technologies to enhance efficiency and connectivity. However, this digital evolution brings forth escalating cybersecurity risks that cannot be overlooked. The Rising Tide of Cyber Threats A recent report by Thetius highlights the increasing vulnerability of maritime operations to cyber threats, while the Allianz Risk…
-
New Phishing Attack Uses AES Malicious npm Packages to Office 365 Login Credentials
Fortra’s Suspicious Email Analysis (SEA) team uncovered a highly sophisticated phishing campaign targeting Microsoft Office 365 (O365) credentials. Unlike typical phishing attempts, this attack stood out due to its intricate use of modern technologies and developer infrastructure. The threat actors employed a multi-layered strategy involving AES (Advanced Encryption Standard) encryption, malicious npm (Node Package Manager)…
-
Hazy Hawk Targets DNS Vulnerabilities to Hijack Cloud Resources and Spread Malware
The threat actor gained attention in February 2025 after successfully hijacking a subdomain of the U.S. Centers for Disease Control and Prevention (CDC). Sophisticated threat actor dubbed >>Hazy Hawk
-
Threat intelligence platform buyer’s guide: Top vendors, selection advice
Tags: ai, attack, automation, breach, cloud, computing, credentials, crowdstrike, cyber, cybersecurity, dark-web, data, data-breach, deep-fake, detection, dns, edr, email, endpoint, exploit, finance, firewall, fraud, gartner, google, group, guide, identity, incident response, infrastructure, intelligence, kubernetes, law, malicious, malware, microsoft, mitigation, monitoring, network, open-source, phishing, privacy, risk, service, siem, soar, soc, sophos, sql, supply-chain, technology, threat, tool, vpn, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) found that since 2023 the majority of exploits were zero days, meaning exploiting heretofore unknown methods. And according to the latest Verizon Data Breach Investigations report (DBIR), the percentage of AI-assisted malicious emails doubled to 10% of the totals they observed over the past two years, making staying…
-
Poor DNS hygiene is leading to domain hijacking
Tags: attack, authentication, ciso, cloud, control, credentials, detection, dns, email, exploit, incident response, intelligence, threat, toolDNS hijacking comes in many forms: DNS hijacking comes in many forms. In 2019, CSO inteviewed Paul Vixie, a DNS system contributor, about the need to strengthen security. We later wrote about the problem of abandoned domain names. And things haven’t changed a lot since then. Most CISOs may be familiar with typosquatting, where “firm.com”…
-
What good threat intelligence looks like in practice
In this Help Net Security interview, Anuj Goel, CEO of Cyware, discusses how threat intelligence is no longer a nice to have, it’s a core cyber defense requirement. But … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/21/anuj-goel-cyware-good-threat-intelligence/
-
Poor DNS hygiene is leading to domain hijacking: Report
Tags: attack, authentication, ciso, cloud, control, credentials, detection, dns, email, exploit, incident response, intelligence, threat, toolDNS hijacking comes in many forms: DNS hijacking comes in many forms. In 2019, CSO inteviewed Paul Vixie, a DNS system contributor, about the need to strengthen security. We later wrote about the problem of abandoned domain names. And things haven’t changed a lot since then. Most CISOs may be familiar with typosquatting, where “firm.com”…
-
The Role of Microsegmentation in Managing Lateral Movement Through Inbound and Outbound Traffic Policies
Microsegmentation has become a foundational component of enterprise security and a Zero Trust Architecture (ZTA). As threats continue to grow in complexity, the ability to contain and limit the spread of an attack inside the network is critical. Traditional perimeter-focused security… Read More First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/the-role-of-microsegmentation-in-managing-lateral-movement-through-inbound-and-outbound-traffic-policies/
-
Free to Choose the Right Security for Your Cloud
Is Choosing Cloud Security a Complex Task? From financial services and healthcare to DevOps and SOC teams, businesses across sectors are grappling with the complexity of managing Non-Human Identities (NHIs). NHIs, essentially machine identities, are a critical component of an organization’s cybersecurity. They play a pivotal role in reducing threats by securing both the machine……
-
Exabeam and Vectra AI Integrate Platforms to Boost Threat Detection and Unify Security Operations
First seen on scworld.com Jump to article: www.scworld.com/news/exabeam-and-vectra-ai-integrate-platforms-to-boost-threat-detection-and-unify-security-operations
-
Push Security Debuts Global Partner Program to Address Identity-Driven Threats
First seen on scworld.com Jump to article: www.scworld.com/news/push-security-debuts-global-partner-program-to-address-identity-driven-threats
-
CloudSEK Secures $19M to Advance Predictive Cyber Threat Intelligence
First seen on scworld.com Jump to article: www.scworld.com/brief/cloudsek-secures-19m-to-advance-predictive-cyber-threat-intelligence
-
The Hidden Challenges in Threat Detection and Response for MSSPs
First seen on scworld.com Jump to article: www.scworld.com/perspective/the-hidden-challenges-in-threat-detection-and-response-for-mssps
-
Let’s Talk About SaaS Risk Again”¦ This Time, Louder.
By Kevin Hanes, CEO of Reveal Security A few weeks ago, I shared a thought that sparked a lot of discussion: SaaS is not a black box we can ignore. It’s a rich, dynamic attack surface and one that attackers are increasingly targeting. That urgency was echoed powerfully in JPMorgan CISO Patrick Opet’s open letter…
-
Summer Cyberattacks
Why the Heat Brings a Surge in Credential-Based Threats Summer is synonymous with vacations, long weekends, and out-of-office replies”, but it’s also peak season for cybercrime. As security teams scale back and employees unplug, attackers ramp up their efforts. Summer cyberattacks are a growing concern for organizations, particularly those managing identity systems like Active Directory…
-
Hazy Hawk Exploits DNS Records to Hijack CDC, Corporate Domains for Malware Delivery
A threat actor known as Hazy Hawk has been observed hijacking abandoned cloud resources of high-profile organizations, including Amazon S3 buckets and Microsoft Azure endpoints, by leveraging misconfigurations in the Domain Name System (DNS) records.The hijacked domains are then used to host URLs that direct users to scams and malware via traffic distribution systems (TDSes),…
-
Hazy Hawk gang exploits DNS misconfigs to hijack trusted domains
A threat actor named ‘Hazy Hawk’ has been using DNS CNAME hijacking to hijack abandoned cloud endpoints of domains belonging to trusted organizations and incorporate them in large-scale scam delivery and traffic distribution systems (TDS). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hazy-hawk-gang-exploits-dns-misconfigs-to-hijack-trusted-domains/
-
Large Retailers Land in Scattered Spider’s Ransomware Web
The threat group games IT help desks to gain entry into retailer networks, and signs show it has shifted its attention from the UK to US targets. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/large-retailers-scattered-spider-ransomware-web
-
‘Hazy Hawk’ Cybercrime Gang Swoops In for Cloud Resources
Since December 2023, the threat group has preyed on domains belonging to the US Centers for Disease Control and Prevention (CDC) and numerous other reputable organizations worldwide to redirect users to malicious sites. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/hazy-hawk-cybercrime-gang-cloud-resources